{ "statistics": { "processing": [ { "name": "CAPE", "time": 3.767 }, { "name": "AnalysisInfo", "time": 0.016 }, { "name": "BehaviorAnalysis", "time": 0.945 }, { "name": "Debug", "time": 0.001 }, { "name": "NetworkAnalysis", "time": 0.511 }, { "name": "UrlAnalysis", "time": 0.483 }, { "name": "script_log_processing", "time": 0.001 }, { "name": "ProcessMemory", "time": 0.0 } ], "signatures": [ { "name": "packer_themida", "time": 0.0 }, { "name": "stealth_network", "time": 0.0 }, { "name": "disable_driver_via_blocklist", "time": 0.0 }, { "name": "disable_driver_via_hvcidisallowedimages", "time": 0.0 }, { "name": "disable_hypervisor_protected_code_integrity", "time": 0.0 }, { "name": "pendingfilerenameoperations_Operations", "time": 0.0 }, { "name": "anomalous_deletefile", "time": 0.0 }, { "name": "antiav_360_libs", "time": 0.0 }, { "name": "antiav_ahnlab_libs", "time": 0.0 }, { "name": "antiav_avast_libs", "time": 0.0 }, { "name": "antiav_bitdefender_libs", "time": 0.0 }, { "name": "antiav_bullguard_libs", "time": 0.0 }, { "name": "antiav_emsisoft_libs", "time": 0.0 }, { "name": "antiav_qurb_libs", "time": 0.0 }, { "name": "antiav_servicestop", "time": 0.0 }, { "name": "antiav_apioverride_libs", "time": 0.0 }, { "name": "antidebug_guardpages", "time": 0.0 }, { "name": "antidebug_ntcreatethreadex", "time": 0.0 }, { "name": "antiav_nthookengine_libs", "time": 0.0 }, { "name": "antidebug_outputdebugstring", "time": 0.0 }, { "name": "antidebug_setunhandledexceptionfilter", "time": 0.0 }, { "name": "antidebug_windows", "time": 0.0 }, { "name": "antiemu_wine_func", "time": 0.0 }, { "name": "antisandbox_cuckoocrash", "time": 0.0 }, { "name": "antisandbox_foregroundwindows", "time": 0.0 }, { "name": "antisandbox_mouse_hook", "time": 0.0 }, { "name": "mouse_movement_detect", "time": 0.0 }, { "name": "antisandbox_sboxie_libs", "time": 0.0 }, { "name": "antisandbox_sboxie_objects", "time": 0.0 }, { "name": "antisandbox_script_timer", "time": 0.0 }, { "name": "antisandbox_sleep", "time": 0.0 }, { "name": "antisandbox_sunbelt_libs", "time": 0.0 }, { "name": "antisandbox_unhook", "time": 0.0 }, { "name": "hardware_id_profiling", "time": 0.0 }, { "name": "antivm_directory_objects", "time": 0.0 }, { "name": "antivm_display", "time": 0.0 }, { "name": "antivm_generic_disk", "time": 0.0 }, { "name": "antivm_generic_scsi", "time": 0.0 }, { "name": "antivm_generic_services", "time": 0.0 }, { "name": "antivm_generic_system", "time": 0.0 }, { "name": "antivm_checks_available_memory", "time": 0.0 }, { "name": "detect_virtualization_via_recent_files", "time": 0.0 }, { "name": "antivm_vbox_libs", "time": 0.0 }, { "name": "antivm_vbox_window", "time": 0.0 }, { "name": "antivm_vmware_events", "time": 0.0 }, { "name": "antivm_vmware_libs", "time": 0.0 }, { "name": "antivm_wmi", "time": 0.0 }, { "name": "api_spamming", "time": 0.0 }, { "name": "api_uuidfromstringa", "time": 0.0 }, { "name": "bcdedit_command", "time": 0.0 }, { "name": "bootkit", "time": 0.0 }, { "name": "direct_hdd_access", "time": 0.0 }, { "name": "physical_drive_access", "time": 0.0 }, { "name": "potential_overwrite_mbr", "time": 0.0 }, { "name": "read_file_raw_disk_access", "time": 0.0 }, { "name": "suspicious_iocontrol_codes", "time": 0.0 }, { "name": "browser_needed", "time": 0.0 }, { "name": "firefox_disables_process_tab", "time": 0.0 }, { "name": "amsi_enumeration", "time": 0.0 }, { "name": "regsvr32_squiblydoo_dll_load", "time": 0.0 }, { "name": "suspicious_ntdll_disk_load", "time": 0.0 }, { "name": "direct_syscall_evasion", "time": 0.0 }, { "name": "unbacked_syscall_execution", "time": 0.0 }, { "name": "uac_bypass_cmstp", "time": 0.0 }, { "name": "uac_bypass_eventvwr", "time": 0.0 }, { "name": "uac_bypass_windows_Backup", "time": 0.0 }, { "name": "privilege_elevation_check", "time": 0.0 }, { "name": "queries_computer_name", "time": 0.0 }, { "name": "queries_user_name", "time": 0.0 }, { "name": "creates_largekey", "time": 0.0 }, { "name": "creates_nullvalue", "time": 0.0 }, { "name": "access_windows_passwords_vault", "time": 0.0 }, { "name": "dump_lsa_via_windows_error_reporting", "time": 0.0 }, { "name": "lsass_credential_dumping", "time": 0.0 }, { "name": "critical_process", "time": 0.0 }, { "name": "query_fips_reconnaissance", "time": 0.0 }, { "name": "cryptopool_domains", "time": 0.0 }, { "name": "dead_connect", "time": 0.0 }, { "name": "dead_link", "time": 0.0 }, { "name": "debugs_self", "time": 0.0 }, { "name": "decoy_image", "time": 0.0 }, { "name": "deletes_consolehost_history", "time": 0.0 }, { "name": "deletes_self", "time": 0.0 }, { "name": "deletes_shadow_copies", "time": 0.0 }, { "name": "deletes_system_state_backup", "time": 0.0 }, { "name": "dep_bypass", "time": 0.0 }, { "name": "dep_disable", "time": 0.0 }, { "name": "disables_mappeddrives_autodisconnect", "time": 0.0 }, { "name": "disables_spdy", "time": 0.0 }, { "name": "disables_wfp", "time": 0.0 }, { "name": "add_windows_defender_exclusions", "time": 0.0 }, { "name": "mountpoints_volume_discovery", "time": 0.0 }, { "name": "dll_load_uncommon_file_types", "time": 0.0 }, { "name": "dllload_suspicious_directory", "time": 0.0 }, { "name": "document_script_exe_drop", "time": 0.0 }, { "name": "driver_load", "time": 0.0 }, { "name": "install_kernel_driver_service", "time": 0.0 }, { "name": "malformed_dll_loading", "time": 0.0 }, { "name": "dynamic_function_loading", "time": 0.0 }, { "name": "registers_vectored_exception_handler", "time": 0.0 }, { "name": "exec_crash", "time": 0.0 }, { "name": "process_creation_suspicious_location", "time": 0.0 }, { "name": "exploit_getbasekerneladdress", "time": 0.0 }, { "name": "exploit_gethaldispatchtable", "time": 0.0 }, { "name": "exploit_heapspray", "time": 0.0 }, { "name": "downloads_from_filehosting", "time": 0.0 }, { "name": "generic_phish", "time": 0.0 }, { "name": "http_request", "time": 0.0 }, { "name": "infostealer_browser", "time": 0.0 }, { "name": "infostealer_browser_password", "time": 0.0 }, { "name": "infostealer_cookies", "time": 0.0 }, { "name": "infostealer_keylog", "time": 0.0 }, { "name": "captures_screenshot", "time": 0.0 }, { "name": "injection_createremotethread", "time": 0.0 }, { "name": "creates_suspended_process", "time": 0.0 }, { "name": "injection_explorer", "time": 0.0 }, { "name": "injection_module_stomping_probing", "time": 0.0 }, { "name": "injection_needextension", "time": 0.0 }, { "name": "injection_network_traffic", "time": 0.0 }, { "name": "injection_runpe", "time": 0.0 }, { "name": "section_mapping_injection", "time": 0.0 }, { "name": "injection_themeinitapihook", "time": 0.0 }, { "name": "apc_injection", "time": 0.0 }, { "name": "resumethread_remote_process", "time": 0.0 }, { "name": "injection_write_exe_process", "time": 0.0 }, { "name": "injection_write_process", "time": 0.0 }, { "name": "internet_dropper", "time": 0.0 }, { "name": "interprocess_comms_mutex", "time": 0.0 }, { "name": "interprocess_comms_named_pipe", "time": 0.0 }, { "name": "interprocess_comms_shared_memory", "time": 0.0 }, { "name": "escalate_privilege_via_named_pipe", "time": 0.0 }, { "name": "ipc_namedpipe", "time": 0.0 }, { "name": "js_phish", "time": 0.0 }, { "name": "js_suspicious_redirect", "time": 0.0 }, { "name": "execute_binary_via_internet_explorer_exporter", "time": 0.0 }, { "name": "execute_binary_via_run_exe_helper_utility", "time": 0.0 }, { "name": "execute_ps_via_syncappvpublishingserver", "time": 0.0 }, { "name": "malicious_dynamic_function_loading", "time": 0.0 }, { "name": "reads_memory_remote_process", "time": 0.0 }, { "name": "unbacked_exception_filter", "time": 0.0 }, { "name": "unbacked_process_mitigation_alteration", "time": 0.0 }, { "name": "thread_unbacked_memory", "time": 0.0 }, { "name": "unbacked_api_resolution", "time": 0.0 }, { "name": "unbacked_dotnet_execution", "time": 0.0 }, { "name": "unbacked_library_load", "time": 0.0 }, { "name": "unbacked_memory_apc_execution", "time": 0.0 }, { "name": "unbacked_memory_protection_alteration", "time": 0.0 }, { "name": "unbacked_mutex_creation", "time": 0.0 }, { "name": "unbacked_process_creation", "time": 0.0 }, { "name": "unbacked_veh_registration", "time": 0.0 }, { "name": "unbacked_com_instantiation", "time": 0.0 }, { "name": "unbacked_crypto_operations", "time": 0.0 }, { "name": "unbacked_delay_execution", "time": 0.0 }, { "name": "unbacked_file_dropping", "time": 0.0 }, { "name": "unbacked_process_enumeration", "time": 0.0 }, { "name": "unbacked_registry_modification", "time": 0.0 }, { "name": "unbacked_service_manipulation", "time": 0.0 }, { "name": "unbacked_token_manipulation", "time": 0.0 }, { "name": "unbacked_wmi_execution", "time": 0.0 }, { "name": "unbacked_bind_shell", "time": 0.0 }, { "name": "unbacked_dns_resolution", "time": 0.0 }, { "name": "unbacked_memory_network_connection", "time": 0.0 }, { "name": "unbacked_named_pipe_creation", "time": 0.0 }, { "name": "unbacked_useragent_retrieval", "time": 0.0 }, { "name": "mimics_filetime", "time": 0.0 }, { "name": "amsi_bypass_via_com_registry", "time": 0.0 }, { "name": "access_auto_logons_via_registry", "time": 0.0 }, { "name": "access_boot_key_via_registry", "time": 0.0 }, { "name": "create_suspicious_lnk_files", "time": 0.0 }, { "name": "credential_access_via_windows_credential_history", "time": 0.0 }, { "name": "dll_hijacking_via_microsoft_exchange", "time": 0.0 }, { "name": "dll_hijacking_via_waas_medic_svc_com_typelib", "time": 0.0 }, { "name": "execute_file_downloaded_via_openssh", "time": 0.0 }, { "name": "execute_safe_mode_from_suspicious_process", "time": 0.0 }, { "name": "execute_scripts_via_microsoft_management_console", "time": 0.0 }, { "name": "execute_suspicious_processes_via_windows_mssql_service", "time": 0.0 }, { "name": "execution_from_self_extracting_archive", "time": 0.0 }, { "name": "ip_address_discovery_via_trusted_program", "time": 0.0 }, { "name": "load_dll_via_control_panel", "time": 0.0 }, { "name": "network_connection_via_suspicious_process", "time": 0.0 }, { "name": "potential_location_discovery_via_unusual_process", "time": 0.0 }, { "name": "store_executable_registry", "time": 0.0 }, { "name": "Suspicious_Execution_Via_MicrosoftExchangeTransportAgent", "time": 0.0 }, { "name": "suspicious_java_execution_via_win_scripts", "time": 0.0 }, { "name": "Suspicious_Scheduled_Task_Creation_Via_Masqueraded_XML_File", "time": 0.0 }, { "name": "uses_restart_manager_for_suspicious_activities", "time": 0.0 }, { "name": "modify_desktop_wallpaper", "time": 0.0 }, { "name": "modify_zoneid_ads", "time": 0.0 }, { "name": "move_file_on_reboot", "time": 0.0 }, { "name": "multiple_useragents", "time": 0.0 }, { "name": "network_anomaly", "time": 0.0 }, { "name": "network_bind", "time": 0.0 }, { "name": "etherhiding_smart_contract_call", "time": 0.0 }, { "name": "network_cnc_https_archive", "time": 0.0 }, { "name": "network_cnc_https_free_webhosting", "time": 0.0 }, { "name": "network_cnc_https_generic", "time": 0.0 }, { "name": "network_cnc_https_interactsh", "time": 0.0 }, { "name": "network_cnc_https_opensource", "time": 0.0 }, { "name": "network_cnc_https_pastesite", "time": 0.0 }, { "name": "network_cnc_https_payload", "time": 0.0 }, { "name": "network_cnc_https_serviceinterface", "time": 0.0 }, { "name": "network_cnc_https_socialmedia", "time": 0.0 }, { "name": "network_cnc_https_telegram", "time": 0.0 }, { "name": "network_cnc_https_tempstorage", "time": 0.0 }, { "name": "network_cnc_https_temp_urldns", "time": 0.0 }, { "name": "network_cnc_https_urlshortener", "time": 0.0 }, { "name": "network_cnc_https_useragent", "time": 0.0 }, { "name": "network_cnc_smtps_exfil", "time": 0.0 }, { "name": "network_cnc_smtps_generic", "time": 0.0 }, { "name": "network_dns_idn", "time": 0.0 }, { "name": "network_dns_suspicious_querytype", "time": 0.0 }, { "name": "network_dns_tunneling_request", "time": 0.0 }, { "name": "explorer_http", "time": 0.0 }, { "name": "network_fake_useragent", "time": 0.0 }, { "name": "legitimate_domain_abuse", "time": 0.0 }, { "name": "suspicious_communication_trusted_site", "time": 0.0 }, { "name": "network_tor", "time": 0.0 }, { "name": "office_com_load", "time": 0.0 }, { "name": "office_dotnet_load", "time": 0.0 }, { "name": "office_mshtml_load", "time": 0.0 }, { "name": "office_vb_load", "time": 0.0 }, { "name": "office_wmi_load", "time": 0.0 }, { "name": "office_cve2017_11882_network", "time": 0.0 }, { "name": "office_cve_2021_40444", "time": 0.0 }, { "name": "office_cve_2021_40444_m2", "time": 0.0 }, { "name": "office_flash_load", "time": 0.0 }, { "name": "office_postscript", "time": 0.0 }, { "name": "office_suspicious_processes", "time": 0.0 }, { "name": "decompress_exe", "time": 0.0 }, { "name": "persistence_via_autodial_dll_registry", "time": 0.0 }, { "name": "persistence_autorun", "time": 0.0 }, { "name": "persistence_autorun_tasks", "time": 0.0 }, { "name": "persistence_bootexecute", "time": 0.0 }, { "name": "persistence_registry_script", "time": 0.0 }, { "name": "powershell_download", "time": 0.0 }, { "name": "powershell_request", "time": 0.0 }, { "name": "createtoolhelp32snapshot_module_enumeration", "time": 0.0 }, { "name": "enumerates_running_processes", "time": 0.0 }, { "name": "process_interest", "time": 0.0 }, { "name": "process_needed", "time": 0.0 }, { "name": "ransomware_iocp_asynchronous_encryption", "time": 0.0 }, { "name": "kernel_crypto_driver_abuse", "time": 0.0 }, { "name": "mass_data_encryption", "time": 0.0 }, { "name": "ransomware_extension_hijack", "time": 0.0 }, { "name": "mass_file_modification_access", "time": 0.0 }, { "name": "ransomware_attribute_stripping", "time": 0.0 }, { "name": "ransomware_file_modifications", "time": 0.0 }, { "name": "mass_ransom_note_drop", "time": 0.0 }, { "name": "ransomware_message", "time": 0.0 }, { "name": "recon_beacon", "time": 0.0 }, { "name": "recon_programs", "time": 0.0 }, { "name": "recon_systeminfo", "time": 0.0 }, { "name": "accesses_recyclebin", "time": 0.0 }, { "name": "removes_zoneid_ads", "time": 0.0 }, { "name": "script_created_process", "time": 0.0 }, { "name": "script_network_activity", "time": 0.0 }, { "name": "suspicious_js_script", "time": 0.0 }, { "name": "javascript_timer", "time": 0.0 }, { "name": "secure_login_phishing", "time": 0.0 }, { "name": "securityxploded_modules", "time": 0.0 }, { "name": "get_clipboard_data", "time": 0.0 }, { "name": "sets_autoconfig_url", "time": 0.0 }, { "name": "spoofs_procname", "time": 0.0 }, { "name": "stack_pivot", "time": 0.0 }, { "name": "stack_pivot_file_created", "time": 0.0 }, { "name": "stack_pivot_process_create", "time": 0.0 }, { "name": "set_clipboard_data", "time": 0.0 }, { "name": "stealth_childproc", "time": 0.0 }, { "name": "stealth_system_procname", "time": 0.0 }, { "name": "stealth_timeout", "time": 0.0 }, { "name": "stealth_window", "time": 0.0 }, { "name": "queries_keyboard_layout", "time": 0.0 }, { "name": "queries_locale_api", "time": 0.0 }, { "name": "terminates_remote_process", "time": 0.0 }, { "name": "uiautomationcore_load", "time": 0.0 }, { "name": "user_enum", "time": 0.0 }, { "name": "mmc_dll_script_load", "time": 0.0 }, { "name": "mmc_dotnet_load", "time": 0.0 }, { "name": "virus", "time": 0.0 }, { "name": "webmail_phish", "time": 0.0 }, { "name": "persists_dev_util", "time": 0.0 }, { "name": "spawns_dev_util", "time": 0.0 }, { "name": "alters_windows_utility", "time": 0.0 }, { "name": "overwrites_accessibility_utility", "time": 0.0 }, { "name": "Potential_Lateral_Movement_Via_SMBEXEC", "time": 0.0 }, { "name": "potential_WebShell_Via_ScreenConnectServer", "time": 0.0 }, { "name": "uses_Microsoft_HTML_Help_Executable", "time": 0.0 }, { "name": "wiper_zeroedbytes", "time": 0.0 }, { "name": "wmi_create_process", "time": 0.0 }, { "name": "wmi_script_process", "time": 0.0 }, { "name": "deletes_files", "time": 0.0 }, { "name": "drops_files", "time": 0.0 }, { "name": "reads_files", "time": 0.0 }, { "name": "writes_files", "time": 0.0 }, { "name": "antianalysis_tls_section", "time": 0.0 }, { "name": "antivirus_clamav", "time": 0.0 }, { "name": "antivirus_virustotal", "time": 0.0 }, { "name": "bad_certs", "time": 0.0 }, { "name": "bad_ssl_certs", "time": 0.0 }, { "name": "banker_zeus_p2p", "time": 0.0 }, { "name": "banker_zeus_url", "time": 0.0 }, { "name": "bot_athenahttp", "time": 0.0 }, { "name": "bot_dirtjumper", "time": 0.0 }, { "name": "bot_drive", "time": 0.0 }, { "name": "bot_drive2", "time": 0.0 }, { "name": "bot_madness", "time": 0.0 }, { "name": "byod_loldrivers_match", "time": 0.0 }, { "name": "byod_novel_driver", "time": 0.0 }, { "name": "byod_post_load_exploitation", "time": 0.0 }, { "name": "byod_driver_service_install", "time": 0.0 }, { "name": "com_spawned_process", "time": 0.0 }, { "name": "family_proxyback", "time": 0.0 }, { "name": "flare_capa_antianalysis", "time": 0.0 }, { "name": "flare_capa_collection", "time": 0.0 }, { "name": "flare_capa_communication", "time": 0.0 }, { "name": "flare_capa_compiler", "time": 0.0 }, { "name": "flare_capa_datamanipulation", "time": 0.0 }, { "name": "flare_capa_executable", "time": 0.0 }, { "name": "flare_capa_hostinteraction", "time": 0.0 }, { "name": "flare_capa_impact", "time": 0.0 }, { "name": "flare_capa_lib", "time": 0.0 }, { "name": "flare_capa_linking", "time": 0.0 }, { "name": "flare_capa_loadcode", "time": 0.0 }, { "name": "flare_capa_malwarefamily", "time": 0.0 }, { "name": "flare_capa_nursery", "time": 0.0 }, { "name": "flare_capa_persistence", "time": 0.0 }, { "name": "flare_capa_runtime", "time": 0.0 }, { "name": "flare_capa_targeting", "time": 0.0 }, { "name": "threatfox", "time": 0.0 }, { "name": "log4shell", "time": 0.0 }, { "name": "mimics_extension", "time": 0.0 }, { "name": "network_ip_exe", "time": 0.0 }, { "name": "network_dga", "time": 0.0 }, { "name": "network_dga_fraunhofer", "time": 0.0 }, { "name": "network_dyndns", "time": 0.002 }, { "name": "network_icmp", "time": 0.0 }, { "name": "network_irc", "time": 0.0 }, { "name": "network_open_proxy", "time": 0.0 }, { "name": "network_smtp", "time": 0.0 }, { "name": "network_torgateway", "time": 0.001 }, { "name": "origin_langid", "time": 0.0 }, { "name": "origin_resource_langid", "time": 0.0 }, { "name": "overlay", "time": 0.0 }, { "name": "pe_deep_entrypoint", "time": 0.0 }, { "name": "packer_unknown_pe_section_name", "time": 0.0 }, { "name": "packer_aspack", "time": 0.0 }, { "name": "packer_aspirecrypt", "time": 0.0 }, { "name": "packer_bedsprotector", "time": 0.0 }, { "name": "packer_confuser", "time": 0.0 }, { "name": "packer_enigma", "time": 0.0 }, { "name": "packer_entropy", "time": 0.0 }, { "name": "packer_mpress", "time": 0.0 }, { "name": "packer_nate", "time": 0.0 }, { "name": "packer_nspack", "time": 0.0 }, { "name": "packer_smartassembly", "time": 0.0 }, { "name": "packer_spices", "time": 0.0 }, { "name": "packer_themida", "time": 0.0 }, { "name": "packer_titan", "time": 0.0 }, { "name": "packer_upx", "time": 0.0 }, { "name": "packer_vmprotect", "time": 0.0 }, { "name": "packer_yoda", "time": 0.0 }, { "name": "pe_cert_invalid_signature", "time": 0.0 }, { "name": "pe_cert_self_signed", "time": 0.0 }, { "name": "pe_cert_suspicious_issuer", "time": 0.0 }, { "name": "punch_plus_plus_pcres", "time": 0.0 }, { "name": "procmem_yara", "time": 0.0 }, { "name": "recon_checkip", "time": 0.001 }, { "name": "sigma_events", "time": 0.0 }, { "name": "static_authenticode", "time": 0.0 }, { "name": "invalid_authenticode_signature", "time": 0.0 }, { "name": "static_dotnet_anomaly", "time": 0.0 }, { "name": "static_java", "time": 0.0 }, { "name": "static_pdf", "time": 0.0 }, { "name": "contains_pe_overlay", "time": 0.0 }, { "name": "static_pe_anomaly", "time": 0.0 }, { "name": "pe_compile_timestomping", "time": 0.0 }, { "name": "static_pe_pdbpath", "time": 0.0 }, { "name": "static_rat_config", "time": 0.0 }, { "name": "static_versioninfo_anomaly", "time": 0.0 }, { "name": "browser_credential_theft_headless", "time": 0.0 }, { "name": "suricata_alert", "time": 0.0 }, { "name": "volatility_devicetree_1", "time": 0.0 }, { "name": "volatility_handles_1", "time": 0.0 }, { "name": "volatility_ldrmodules_1", "time": 0.0 }, { "name": "volatility_ldrmodules_2", "time": 0.0 }, { "name": "volatility_malfind_1", "time": 0.0 }, { "name": "volatility_malfind_2", "time": 0.0 }, { "name": "volatility_modscan_1", "time": 0.0 }, { "name": "volatility_svcscan_1", "time": 0.0 }, { "name": "volatility_svcscan_2", "time": 0.0 }, { "name": "volatility_svcscan_3", "time": 0.0 }, { "name": "whois_create", "time": 0.0 }, { "name": "accesses_mailslot", "time": 0.0 }, { "name": "accesses_netlogon_regkey", "time": 0.001 }, { "name": "accesses_public_folder", "time": 0.0 }, { "name": "accesses_sysvol", "time": 0.0 }, { "name": "writes_sysvol", "time": 0.0 }, { "name": "adds_admin_user", "time": 0.0 }, { "name": "adds_user", "time": 0.0 }, { "name": "overwrites_admin_password", "time": 0.0 }, { "name": "antianalysis_detectfile", "time": 0.003 }, { "name": "antianalysis_detectreg", "time": 0.18 }, { "name": "modify_attachment_manager", "time": 0.0 }, { "name": "antiav_detectfile", "time": 0.006 }, { "name": "antiav_detectreg", "time": 0.862 }, { "name": "antiav_srp", "time": 0.0 }, { "name": "antiav_whitespace", "time": 0.0 }, { "name": "antidebug_devices", "time": 0.001 }, { "name": "antiemu_windefend", "time": 0.0 }, { "name": "antiemu_wine_reg", "time": 0.0 }, { "name": "antisandbox_cuckoo_files", "time": 0.0 }, { "name": "antisandbox_fortinet_files", "time": 0.0 }, { "name": "antisandbox_joe_anubis_files", "time": 0.0 }, { "name": "antisandbox_sboxie_mutex", "time": 0.0 }, { "name": "antisandbox_sunbelt_files", "time": 0.0 }, { "name": "antisandbox_threattrack_files", "time": 0.0 }, { "name": "antivm_bochs_keys", "time": 0.016 }, { "name": "antivm_generic_bios", "time": 0.013 }, { "name": "antivm_generic_diskreg", "time": 0.034 }, { "name": "antivm_hyperv_keys", "time": 0.016 }, { "name": "antivm_parallels_keys", "time": 0.048 }, { "name": "antivm_recentdocs", "time": 0.0 }, { "name": "antivm_vbox_devices", "time": 0.001 }, { "name": "antivm_vbox_files", "time": 0.003 }, { "name": "antivm_vbox_keys", "time": 0.098 }, { "name": "antivm_vmware_devices", "time": 0.0 }, { "name": "antivm_vmware_files", "time": 0.001 }, { "name": "antivm_vmware_keys", "time": 0.065 }, { "name": "antivm_vmware_mutexes", "time": 0.0 }, { "name": "antivm_vpc_files", "time": 0.0 }, { "name": "antivm_vpc_keys", "time": 0.033 }, { "name": "antivm_vpc_mutex", "time": 0.0 }, { "name": "antivm_xen_keys", "time": 0.048 }, { "name": "ketrican_regkeys", "time": 0.007 }, { "name": "bitcoin_opencl", "time": 0.0 }, { "name": "enumerates_physical_drives", "time": 0.0 }, { "name": "bot_russkill", "time": 0.0 }, { "name": "browser_addon", "time": 0.0 }, { "name": "chromium_browser_extension_directory", "time": 0.0 }, { "name": "browser_helper_object", "time": 0.0 }, { "name": "browser_security", "time": 0.001 }, { "name": "browser_startpage", "time": 0.0 }, { "name": "executes_headless_browser", "time": 0.0 }, { "name": "suspicious_browser_arguments", "time": 0.001 }, { "name": "ie_disables_process_tab", "time": 0.0 }, { "name": "odbcconf_bypass", "time": 0.002 }, { "name": "squiblydoo_bypass", "time": 0.0 }, { "name": "squiblytwo_bypass", "time": 0.0 }, { "name": "bypass_chromium_protection", "time": 0.0 }, { "name": "bypass_firewall", "time": 0.016 }, { "name": "checks_uac_status", "time": 0.002 }, { "name": "uac_bypass_cmstpcom", "time": 0.0 }, { "name": "uac_bypass_delegateexecute_sdclt", "time": 0.0 }, { "name": "uac_bypass_fodhelper", "time": 0.0 }, { "name": "cape_extracted_content", "time": 0.0 }, { "name": "clears_logs", "time": 0.0 }, { "name": "cmdline_obfuscation", "time": 0.0 }, { "name": "cmdline_switches", "time": 0.0 }, { "name": "cmdline_terminate", "time": 0.0 }, { "name": "cmdline_forfiles_wildcard", "time": 0.0 }, { "name": "cmdline_http_link", "time": 0.0 }, { "name": "cmdline_long_string", "time": 0.0 }, { "name": "cmdline_reversed_http_link", "time": 0.0 }, { "name": "long_commandline", "time": 0.0 }, { "name": "powershell_renamed_commandline", "time": 0.001 }, { "name": "copies_self", "time": 0.0 }, { "name": "credwiz_credentialaccess", "time": 0.0 }, { "name": "enables_wdigest", "time": 0.0 }, { "name": "vaultcmd_credentialaccess", "time": 0.0 }, { "name": "file_credential_store_access", "time": 0.0 }, { "name": "file_credential_store_write", "time": 0.0 }, { "name": "kerberos_credential_access_via_rubeus", "time": 0.0 }, { "name": "registry_credential_dumping", "time": 0.0 }, { "name": "registry_lsa_secrets_access", "time": 0.001 }, { "name": "comsvcs_credentialdump", "time": 0.0 }, { "name": "cryptomining_stratum_command", "time": 0.0 }, { "name": "deepfreeze_mutex", "time": 0.0 }, { "name": "deletes_executed_files", "time": 0.0 }, { "name": "disables_app_launch", "time": 0.0 }, { "name": "disables_auto_app_termination", "time": 0.0 }, { "name": "disables_appv_virtualization", "time": 0.0 }, { "name": "disables_backups", "time": 0.0 }, { "name": "disables_browser_warn", "time": 0.001 }, { "name": "disables_context_menus", "time": 0.0 }, { "name": "disables_cpl_disable", "time": 0.0 }, { "name": "disables_crashdumps", "time": 0.0 }, { "name": "disables_event_logging", "time": 0.0 }, { "name": "disables_folder_options", "time": 0.0 }, { "name": "disables_notificationcenter", "time": 0.0 }, { "name": "disables_power_options", "time": 0.0 }, { "name": "disables_restore_default_state", "time": 0.0 }, { "name": "disables_run_command", "time": 0.0 }, { "name": "disables_smartscreen", "time": 0.0 }, { "name": "disables_startmenu_search", "time": 0.0 }, { "name": "disables_system_restore", "time": 0.0 }, { "name": "disables_uac", "time": 0.0 }, { "name": "disables_wer", "time": 0.0 }, { "name": "disables_windows_defender", "time": 0.0 }, { "name": "disables_windows_defender_logging", "time": 0.001 }, { "name": "removes_windows_defender_contextmenu", "time": 0.001 }, { "name": "removes_windows_defender_updates", "time": 0.0 }, { "name": "windows_defender_powershell", "time": 0.0 }, { "name": "disables_windows_file_protection", "time": 0.0 }, { "name": "disables_windowsupdate", "time": 0.0 }, { "name": "disables_winfirewall", "time": 0.0 }, { "name": "folder_enumeration", "time": 0.001 }, { "name": "discover_registry_mount_points", "time": 0.002 }, { "name": "adfind_domain_enumeration", "time": 0.0 }, { "name": "domain_enumeration_commands", "time": 0.0 }, { "name": "driver_filtermanager", "time": 0.0 }, { "name": "dropper", "time": 0.0 }, { "name": "dll_archive_execution", "time": 0.0 }, { "name": "lnk_archive_execution", "time": 0.0 }, { "name": "script_archive_execution", "time": 0.0 }, { "name": "excel4_macro_urls", "time": 0.0 }, { "name": "escalate_privilege_via_ntlm_relay", "time": 0.0 }, { "name": "spooler_access", "time": 0.0 }, { "name": "spooler_svc_start", "time": 0.0 }, { "name": "mapped_drives_uac", "time": 0.0 }, { "name": "hides_recycle_bin_icon", "time": 0.0 }, { "name": "infostealer_bitcoin", "time": 0.004 }, { "name": "infostealer_ftp", "time": 0.294 }, { "name": "infostealer_im", "time": 0.163 }, { "name": "infostealer_mail", "time": 0.031 }, { "name": "Evade_Execution_Via_ASPNet_Compiler", "time": 0.0 }, { "name": "Evade_Execute_Via_DeviceCredentialDeployment", "time": 0.0 }, { "name": "Evade_Execution_Via_Filter_Manager_Control", "time": 0.0 }, { "name": "Evade_Execution_Via_Intel_GFXDownloadWrapper", "time": 0.0 }, { "name": "execute_binary_via_appvlp", "time": 0.0 }, { "name": "execute_binary_via_pcalua", "time": 0.0 }, { "name": "Execute_Binary_Via_OpenSSH", "time": 0.0 }, { "name": "execute_binary_via_pcalua", "time": 0.0 }, { "name": "Execute_Binary_Via_PesterPSModule", "time": 0.0 }, { "name": "Execute_Binary_Via_ScriptRunner", "time": 0.0 }, { "name": "execute_binary_via_ttdinject", "time": 0.0 }, { "name": "Execute_Binary_Via_VisualStudioLiveShare", "time": 0.0 }, { "name": "Execute_Msiexec_Via_Explorer", "time": 0.0 }, { "name": "execute_remote_msi", "time": 0.0 }, { "name": "execute_suspicious_powershell_via_runscripthelper", "time": 0.0 }, { "name": "execute_suspicious_powershell_via_sqlps", "time": 0.0 }, { "name": "Indirect_Command_Execution_Via_ConsoleWindowHost", "time": 0.0 }, { "name": "Perform_Malicious_Activities_Via_Headless_Browser", "time": 0.0 }, { "name": "Register_DLL_Via_CertOC", "time": 0.0 }, { "name": "Register_DLL_Via_MSIEXEC", "time": 0.0 }, { "name": "Register_DLL_Via_Odbcconf", "time": 0.0 }, { "name": "Scriptlet_Proxy_Execution_Via_Pubprn", "time": 0.0 }, { "name": "ie_martian_children", "time": 0.0 }, { "name": "office_martian_children", "time": 0.0 }, { "name": "mimics_icon", "time": 0.0 }, { "name": "masquerade_process_name", "time": 0.008 }, { "name": "mimikatz_modules", "time": 0.0 }, { "name": "ms_office_cmd_rce", "time": 0.0 }, { "name": "mount_copy_to_webdav_share", "time": 0.0 }, { "name": "potential_protocol_tunneling_via_legit_utilities", "time": 0.0 }, { "name": "potential_protocol_tunneling_via_qemu", "time": 0.0 }, { "name": "suspicious_execution_via_dotnet_remoting", "time": 0.0 }, { "name": "dotnet_clr_usagelog_regkeys", "time": 0.0 }, { "name": "modify_hostfile", "time": 0.0 }, { "name": "modify_oem_information", "time": 0.0 }, { "name": "modify_security_center_warnings", "time": 0.0 }, { "name": "modify_uac_prompt", "time": 0.0 }, { "name": "network_dns_blockchain", "time": 0.0 }, { "name": "network_dns_opennic", "time": 0.0 }, { "name": "network_dns_paste_site", "time": 0.0 }, { "name": "network_dns_reverse_proxy", "time": 0.0 }, { "name": "network_dns_temp_file_storage", "time": 0.0 }, { "name": "network_dns_temp_urldns", "time": 0.0 }, { "name": "network_dns_url_shortener", "time": 0.003 }, { "name": "network_dns_doh_tls", "time": 0.0 }, { "name": "suspicious_tld", "time": 0.003 }, { "name": "network_tor_service", "time": 0.0 }, { "name": "office_code_page", "time": 0.0 }, { "name": "office_addinloading", "time": 0.0 }, { "name": "office_perfkey", "time": 0.0 }, { "name": "office_macro", "time": 0.0 }, { "name": "changes_trust_center_settings", "time": 0.0 }, { "name": "disables_vba_trust_access", "time": 0.0 }, { "name": "office_macro_autoexecution", "time": 0.0 }, { "name": "office_macro_ioc", "time": 0.0 }, { "name": "office_macro_malicious_prediction", "time": 0.0 }, { "name": "office_macro_suspicious", "time": 0.0 }, { "name": "rtf_aslr_bypass", "time": 0.0 }, { "name": "rtf_anomaly_characterset", "time": 0.0 }, { "name": "rtf_anomaly_version", "time": 0.0 }, { "name": "rtf_embedded_content", "time": 0.0 }, { "name": "rtf_embedded_office_file", "time": 0.0 }, { "name": "rtf_exploit_static", "time": 0.0 }, { "name": "office_security", "time": 0.0 }, { "name": "accesses_office_username", "time": 0.001 }, { "name": "office_anomalous_feature", "time": 0.0 }, { "name": "office_dde_command", "time": 0.0 }, { "name": "packer_armadillo_mutex", "time": 0.0 }, { "name": "packer_armadillo_regkey", "time": 0.002 }, { "name": "persistence_ads", "time": 0.0 }, { "name": "persistence_safeboot", "time": 0.0 }, { "name": "persistence_ifeo", "time": 0.0 }, { "name": "persistence_silent_process_exit", "time": 0.0 }, { "name": "persistence_rdp_registry", "time": 0.0 }, { "name": "persistence_rdp_shadowing", "time": 0.0 }, { "name": "persistence_service", "time": 0.0 }, { "name": "persistence_shim_database", "time": 0.0 }, { "name": "powershell_scriptblock_logging", "time": 0.0 }, { "name": "powershell_command_suspicious", "time": 0.0 }, { "name": "powershell_history_save_mod", "time": 0.0 }, { "name": "powershell_renamed", "time": 0.0 }, { "name": "powershell_reversed", "time": 0.0 }, { "name": "powershell_variable_obfuscation", "time": 0.0 }, { "name": "prevents_safeboot", "time": 0.0 }, { "name": "cmdline_process_discovery", "time": 0.0 }, { "name": "ransomware_extensions_generic", "time": 0.0 }, { "name": "ransomware_extensions_known", "time": 0.002 }, { "name": "ransomware_files", "time": 0.004 }, { "name": "ransomware_recyclebin", "time": 0.0 }, { "name": "ransomware_revil_regkey", "time": 0.0 }, { "name": "reads_password_database", "time": 0.0 }, { "name": "recon_fingerprint", "time": 0.009 }, { "name": "rdptcp_key", "time": 0.0 }, { "name": "uses_rdp_clip", "time": 0.0 }, { "name": "uses_remote_desktop_session", "time": 0.0 }, { "name": "removes_networking_icon", "time": 0.0 }, { "name": "removes_pinned_programs", "time": 0.0 }, { "name": "removes_security_maintenance_icon", "time": 0.0 }, { "name": "removes_startmenu_defaults", "time": 0.0 }, { "name": "removes_username_startmenu", "time": 0.0 }, { "name": "sniffer_winpcap", "time": 0.0 }, { "name": "spreading_autoruninf", "time": 0.0 }, { "name": "stealth_hidden_extension", "time": 0.0 }, { "name": "stealth_hiddenreg", "time": 0.0 }, { "name": "stealth_hide_notifications", "time": 0.0 }, { "name": "stealth_webhistory", "time": 0.0 }, { "name": "sysinternals_psexec", "time": 0.0 }, { "name": "sysinternals_tools", "time": 0.0 }, { "name": "language_check_registry", "time": 0.004 }, { "name": "tampers_etw", "time": 0.0 }, { "name": "lsa_tampering", "time": 0.0 }, { "name": "tampers_powershell_logging", "time": 0.0 }, { "name": "territorial_disputes_sigs", "time": 0.278 }, { "name": "uses_adfind", "time": 0.0 }, { "name": "uses_ms_protocol", "time": 0.0 }, { "name": "owa_web_shell_files", "time": 0.0 }, { "name": "web_shell_files", "time": 0.0 }, { "name": "web_shell_processes", "time": 0.0 }, { "name": "dotnet_csc_build", "time": 0.0 }, { "name": "mavinject_lolbin", "time": 0.0 }, { "name": "multiple_explorer_instances", "time": 0.0 }, { "name": "script_tool_executed", "time": 0.0 }, { "name": "suspicious_certutil_use", "time": 0.0 }, { "name": "suspicious_command_tools", "time": 0.007 }, { "name": "suspicious_mpcmdrun_use", "time": 0.0 }, { "name": "suspicious_ping_use", "time": 0.0 }, { "name": "uses_powershell_copyitem", "time": 0.0 }, { "name": "uses_windows_utilities", "time": 0.007 }, { "name": "uses_windows_utilities_appcmd", "time": 0.0 }, { "name": "uses_windows_utilities_csvde_ldifde", "time": 0.0 }, { "name": "uses_windows_utilities_cipher", "time": 0.0 }, { "name": "uses_windows_utilities_clickonce", "time": 0.0 }, { "name": "uses_windows_utilities_curl", "time": 0.0 }, { "name": "uses_windows_utilities_dsquery", "time": 0.0 }, { "name": "uses_windows_utilities_esentutl", "time": 0.0 }, { "name": "uses_windows_utilities_finger", "time": 0.0 }, { "name": "uses_windows_utilities_mode", "time": 0.0 }, { "name": "uses_windows_utilities_ntdsutil", "time": 0.0 }, { "name": "uses_windows_utilities_nltest", "time": 0.0 }, { "name": "uses_windows_utilities_setx", "time": 0.0 }, { "name": "uses_windows_utilities_xcopy", "time": 0.0 }, { "name": "wmic_command_suspicious", "time": 0.0 }, { "name": "scrcons_wmi_script_consumer", "time": 0.0 } ], "reporting": [ { "name": "BinGraph", "time": 0.0 } ] }, "dropped": [ { "name": [ "590aee7bdd69b59b.customDestinations-ms~RFad57.TMP" ], "path": "/opt/CAPEv2/storage/analyses/33/files/e5a7743b9b7971160418116c3b989d4d02ca253c83e36875441637d943df3af4", "guest_paths": [ "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFad57.TMP" ], "size": 5441, "crc32": "DAC37586", "md5": "892423736d8a4f2f29de68d163c1eeae", "sha1": "96ab0f12d862ac656b1d20e01f739a66464cc667", "sha256": "e5a7743b9b7971160418116c3b989d4d02ca253c83e36875441637d943df3af4", "sha512": "52be1d14e606b03d293052c8dd74a09bf27f6d5f15c3358cca20032dbb363d5f20415f2d37e9b27207ec1fc2d8ebb19431d6b6ea63abdab27783073f4567cc17", "rh_hash": null, "ssdeep": "48:zJuzj8wi3C1U203UjXnukvjwoq2RN45ipOJ4SogZoZWRN45ipOJ4SogZo9/:Iz4x3C6fkLukvMyRN4QAHjRN4QAHk", "type": "data", "yara": [], "cape_yara": [], "clamav": [], "tlsh": "T164B1DD102BF24A59E8F78F756CB2A32096B5B9459E079BCF0244905DAC31225ED35B3B", "sha3_384": "0249653f5304e2b0cc61ea1ee53a0bd8f07e0e1791dc3c2f942614fac88f1f0dc67380bd8bfc0faa6bf9b532c8e0e0f7", "yara_hash": "05ddd2ba6af91c0093e6b2dd9d4e664e1d0c5f1a80b80cc3cd41b1840ed26afe", "options_hash": "ca3760a7292cd3fa077daf6ff5eacbed9d31b472fec95e5f2c9cfb0a258ecd10", "data": null, "strings": [ "WINDOW~1", "Windows", "powershell_ise.exe", "Roaming", "Microsoft", ";%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\powershell.exe`", "WindowsPowerShell", "Windows PowerShell", "WINDOW~1.LNK", "!AppData", "@shell32.dll,-21782", "cWindows", "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell_ise.exe", "Programs", "AppData", "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk", "desktop-74suv8w", "MICROS~1", "%systemroot%\\system32\\windowspowershell\\v1.0\\powershell_ise.exe", "sRoaming", ")Start Menu", "Windows PowerShell ISE", "?%systemroot%\\system32\\windowspowershell\\v1.0\\powershell_ise.exe", "STARTM~1", "Windows PowerShell.lnk", "5System32", "System32", "Run as Administrator", "Run ISE as Administrator", "@shell32.dll,-21786", ";Windows" ], "virustotal": { "error": true, "msg": "Unable to complete connection to VirusTotal. Status code: 429" }, "executed_tools": [ "msi_extract", "overlay", "kixtart_extract", "vbe_extract", "batch_extract", "UnAutoIt_extract", "UPX_unpack", "RarSFX_extract", "Inno_extract", "SevenZip_unpack", "de4dot_deobfuscate", "eziriz_deobfuscate", "office_one" ], "cape_type_code": 0, "cape_type": "", "pid": "" } ], "CAPE": { "payloads": [ { "name": "233b38664af7b56a54577c36e6ab454deb635e8a6b147d1b87383b6ba8a1ab22", "path": "/opt/CAPEv2/storage/analyses/33/CAPE/233b38664af7b56a54577c36e6ab454deb635e8a6b147d1b87383b6ba8a1ab22", "guest_paths": "9;?C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe;?C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe;?0x00007FFEA09D0000;?", "size": 29725, "crc32": "2D8B82AB", "md5": "7e1626b4af693bf45ee41a2f32231372", "sha1": "d02439f3b97fa42ab6991694d1abf88941e013a2", "sha256": "233b38664af7b56a54577c36e6ab454deb635e8a6b147d1b87383b6ba8a1ab22", "sha512": "9c09ad5f30b6cb809a80f408a5e95a1c94eecee69da87733a9d05d5734fb07ecf885cf9c644051be0ac9a498d827ec83ffefd83c56b594b713a47a15b8955986", "rh_hash": null, "ssdeep": "768:/abFxfxnGv14N1U4xl71kiVwYS5Txn/GpcftpPfUR2Jz0:SbF9VSCSOlJwYwTx/GpclhfG2Jg", "type": "data", "yara": [], "cape_yara": [], "clamav": [], "tlsh": "T14CD286A83BEF70ABCEDC9877ABC438DB7A7D4B11FAEF9150410940298C445264A7CD6D", "sha3_384": "d2703d892bba0f0b5da9e61e55e787eee47f8eae1aba3e30e2ad22f5d40ef06dbe9e80732188b07c21627653d006c4c6", "yara_hash": "05ddd2ba6af91c0093e6b2dd9d4e664e1d0c5f1a80b80cc3cd41b1840ed26afe", "options_hash": "ca3760a7292cd3fa077daf6ff5eacbed9d31b472fec95e5f2c9cfb0a258ecd10", "data": null, "strings": [ "C_^42", "&C_^>D", "*C_^r\\", "B_^.!", "S?C_^<&", "[&C_^Y8", "*C_^bi", "K/C_^", "X7C_I", "B_^!$", "B_^v@", "B_^A?", "B_^+H", "B_^%!", "{0C_^hr", "p", "!C_^:", "B_^+K", "s-C_^", "k$C_^", "B_^9g", "+C_^6", ";/C_^", "!C_^D", "B_^W4", "0C_^vd", "*C_^he", "c,C_^", "B_^)L", "C_^@ ", "B_^!\"", "x9C_I", "c C_^", "B_^\"^", "+)C_^", "C_^!/", "0[^_A\\A^A_]", "C0C_^ok", "3,C_^(", " ;C_I", ";&C_^c4", "c$C_^", "[*C_^zU", "S!C_^g", "B_^Q", "C%C_^", "+0C_^rh", "B_^[?", "?C_^,.", "`@C_I", "3+C_^[p", "k\"C_^", "'C_^$P", "@;C_I", "B_^O7", "C_^4$", "C*C_^", "B_^Sa", "C_^2'", "B_^5[", "B_^;C", "B_^2E", "B_^GM", "C_^)*", "B_^)I", "@?C_I", "C_^ 0", "C_^.'", "@C_^", "B_^RE", "&C_^:F", "c.C_^", "B_^1H", "C_^/L", "B_^S5", "#1C_^R", "C_^;F", "C_^(-", "30C_^qi", "*C_^p^", "C1C_^N", "P?C_I", "B_^a/", "C_^/4", "s>C_^", "B_^% ", "C+C_^Yr", "?C_^L", "C_^:!", "B_^/F", "C_^-*", "c(C_^", "{,C_^", "B_^1]", "B_^z!", "{3C_^N", "[-C_^", "C_^5I", "{ C_^", "S2C_^ ", "B_^O8", "B_^:L", "B_^W_", "C2C_^$", "c0C_^ko", "B_^|1", ">C_^w", "B_^ e", "S$C_^", "1C_^A", "k3C_^V", "p=C_I", "3C_^F", "B_^ W", "B_^a=", "B_^[L", "s%C_^", "B_^]0", "B_^t5", "B_^I;", "#%C_^", "C_^>!", "B_^?J", "0C_^^{", "C_^(!", "B_^]\\", "+C_^<", "C_^P$", "C_^#.", "s&C_^P;", "C_^+)", "B_^f;", "?C_^ 3", "B_^eG", "c)C_^", "B_^^?", "0C_^Y", "#'C_^\"Q", "S,C_^ ", "{%C_^", "#-C_^", ">C_^b", "c?C_^8(", "k+C_^Tw", "`:C_I", "B_^QQ", "?C_^*/", "+'C_^ R", "`C_^z", "h9C_I", ";-C_^", "C@C_^", "+C_^N|", "C_^'+", "c+C_^Uv", "S%C_^", "C_^%\"", "B_^~=", "#?C_^H ", "C_^:/", "B_^_0", "k?C_^6)", "c2C_^", "x7C_I", ">C_^Y", "C$C_^", "B_^gF", "1C_^4", "@EC_I", "C_^X ", "B_^`>", "s#C_^", "B_^5U", "B_^y\"", "C_^%Q", "P>C_I", " ?C_I", ";'C_^", "B_^oS", "?C_^(0", "33C_^", "B_^$c", "C/C_^", "k!C_^]", "#$C_^-", "+C_^`k", "&C_^2J", "S&C_^[7", "3'C_^", "`=C_I", "{)C_^", "[!C_^d", "S*C_^{T", "h7C_I", "C_^* ", "C_^H(", "B_^o'", "B_^a.", "C_^@,", "P=C_I", "B_^7E", "1C_^@", "C_^)O", "B_^U`", "B_^#O", "K2C_^\"", "K*C_^~S", ",C_^4", "%C_^u,", "S C_^", "C_^3J", "3C_^1", "+C_^L}", "!C_^H", ";%C_^", "B_^{ ", "C_^p4", ">C_^n", "{>C_^}", "C_^*6", "B_^cY", "C-C_^", "[,C_^", "0=C_I", "S(C_^", "/C_^{`", "K!C_^k", "B_^i*", "B_^K9", "sCC_^", "?C_^I", "@@C_I", "3\"C_^", "3?C_^F\"", ";)C_^", "C_^'P", "C_^N%", "s0C_^iq", ";,C_^&", "B_^KK", "B_^Y2", "C_^=E", "B_^~O", "3C_^>", "B_^??", "C_^b8", "+C_^F", "B_^h:", "S\"C_^", "+$C_^)", "[+C_^Vu", "!C_^3", "*C_^ma", "B_^,\"", "&C_^-L", "B_^OG", "C_^\"#", "36C_^", "B_^)[", ";4C_^", "3$C_^%", "B_^Oc", "3C_^#", "B_^3O", "3C_^:", "B_^BI", "k)C_^", "B_^ND", "C_^#0", "/C_^~^", "+C_^^m", "S/C_^", "C_^.)", "C_^B+", "B_^G<", "B_^s%", "P-", "C'C_^", "?C_^$2", "1C_^5", "P:C_I", "!C_^6", ";2C_^&", "0:C_I", "0C_^W", "3C_^%", "B_^!M", "0C_^fs", "+\"C_^", ";@C_^", "C_^L&", ",C_^.", "B_^aZ", "p>C_I", "s$C_^", ">C_^_", "C_^\"$", "0C_^du", "k0C_^jp", "&C_^@C", "B_^Q6", "+C_^@", "(8C_I", "K-C_^", "C_^?D", "B_^&b", "C_^1K", "2C_^1", "1C_^<", "+%C_^", "B_^sQ", "C_^AC", "k,C_^", "87C_I", "!C_^,", "s3C_^R", "B_^|>", "H8C_I", "B_^U4", "p:C_I", "K3C_^", "B_^gW", "B_^E<", "{/C_^", "*C_^eg", "3C_^ ", "B_^;R", "B_^Ke", "s/C_^", "C_^8$", "?C_^M", "31C_^P", "0C_^_z", "p?C_I", "3/C_^", "K'C_^", ";3C_^", "+?C_^G!", "B_^LE", "B_^G;", "B_^7Z", "#3C_^", "1C_^U", "3(C_^", "#+C_^]n", "B_^U5", "B_^!Q", "C_^w2", "3C_^'", "#,C_^,", "B_^Q7", "C_^!S", "S4C_^", "S+C_^Wt", "&C_^F@", "C_^$-", "C_^I?", "+&C_^i2", "B_^{!", "B_^3V", "C_^ $", "3C_^+", "B_^b.", "B_^W3", "K?C_^>%", ">C_^k", "2C_^0", "C_^i6", "B_^EW", "#>C_^", "B_^kU", "B_^X@", "+>C_^", "#.C_^", "B_^MS", "C_^&,", "k1C_^I", "&C_^t-", "+2C_^*", "C_^F)", "C_^<.", "1C_^B", "H9C_I", ";1C_^O", "0;C_I", "s.C_^", "B_^#!", "/C_^za", "3C_^6", "k&C_^S:", "C_^*,", "B_^Qb", "B_^[1", "s'C_^", "32C_^(", "B_^ _", "C_^T<", "B_^}1", "B_^m(", "p@C_I", "`;C_I", "B_^'\\", "B_^9S", "X8C_I", "#&C_^l1", "[0C_^ln", "s*C_^wX", "@>C_I", "#\"C_^", ";(C_^", "{#C_^", "3C_^-", "&C_^6H", "C,C_^$", "!C_^!", "{!C_^V", "B_^'M", "C_^(7", "C!C_^n", "B_^cH", "B_^M8", ";>C_^", "?C_^.-", "3*C_^", "B_^$U", "B_^8M", "0DC_I", "B_^HU", "c\"C_^", "B_^q6", "B_^\\@", "C_^2%", "*C_^gf", "B_^%N", "B_^eX", "+4C_^", " :C_I", ";$C_^!", "; C_^", "pDC_I", "&C_^DA", "*C_^q]", "3C_^)", "C_^4&", "K%C_^", "#/C_^", "+C_^Qz", "@=C_I", "&C_^BB", "B_^-J", "[)C_^", "C_^$ ", "B_^1W", "B_^=A", "&C_^L=", "B_^Y3", "B_^3G", "[@C_^", "B_^&T", "C_^\"1", "C_^V!", "B_^m8", "B_^9D", "C>C_^", "B_^6N", ";0C_^pj", "s@C_^", "B_^qR", "B_^=@", "0C_^X", "C_^:#", "%C_^v+", "[.C_^", ">C_^S", "3%C_^", "B_^-_", "3C_^J", "X9C_I", "0C_^[~", "C)C_^", "%C_^y*", "C_^\":", "B_^5F", "+C_^:", "B_^UA", "s)C_^", "B_^[2", "3@C_^", "K+C_^Xs", "!C_^A", ";?C_^D#", " >C_I", "0C_^et", "C_^&.", ";*C_^", "k@C_^", "B_^} ", " C_I", "C_^61", "0?C_I", "{?C_^2+", "[%C_^", "!C_^O", "p#C_I", "#0C_^sg", "C_^%/", "c&C_^V9", "S#C_^", "K(C_^", "s,C_^", ">C_^O", ";!C_^r", "C_^l5", "s2C_^", "0C_^bw", "&C_^J>", "+1C_^Q", "['C_^", "C_^~0", "B_^M9", "`DC_I", "1C_^7", "3C_^B", "&C_^4I", "+C_^aj", "B_^aI", "k.C_^", "+#C_^", "B_^;A", "B_^u$", "##C_^", "C_^<\"", "B_^PF", "B_^:Y", "C_^'!", "B_^WN", "C_^6%", "C_^< ", "34C_^", "'C_^)N", "S'C_^", "B_^#L", "s\"C_^", ">C_^P", "k(C_^", "C_^T\"", "C_^6#", ",C_^2", "# C_^", "S@C_^", "C_^ ;", "K.C_^", "C C_^", "+C_^B", "B_^_J", "&C_^s.", "+-C_^", "1C_^6", "S>C_^", "0@C_I", "(9C_I", "B_^.Q", "B_^v4", "C&C_^a5", ">C_^t", ";+C_^Zq", "C_^( ", "[?C_^:'", "B_^_/", "B_^YM", "{(C_^", "*C_^kc", "B_^sA", "*C_^uZ", "k#C_^", "B_^TD", "B_^e,", "k-C_^", "$C_^1", "K C_^", "B_^-G", "*C_^n`", "+6C_^", "+C_^P{", "K4C_^", "C_^&8", "0>C_I", "+@C_^", "C_^13", "0EC_I", "c*C_^yV", "3.C_^", ";\"C_^", "B_^1P", "C_^&!", "{1C_^G", "+ C_^", "3)C_^", "!C_^K", ">C_^V", "\"C_^\"", "B_^k)", "B_^&%", "C_^9G", "{2C_^", "B_^XB", "C_^R#", "++C_^\\o", "%C_^|)", "[$C_^", "C_^0(", "0C_^q", "B_^SB", "!C_^=", "B_^6h", "1C_^9", "c%C_^", "C_^J'", "C.C_^", "B_^OR", "#4C_^", "*C_^dh", "B_^QC", "B_^Md", "1C_^V", "1C_^3", "C_^z1", "{@C_^", "C_^++", "B_^]1", "k*C_^xW", "S)C_^", "[^_A\\A^A_]", "B_^DH", "B_^/X", "s(C_^", "3-C_^", "!C_^/", "0C_^ax", "s!C_^Y", "B_^$]", "#)C_^", "1C_^E", "K#C_^", "s?C_^4*", "C_^W;", "3 C_^", "{.C_^", "C_^$9", "B_^?@", "@DC_I", "C_^s3", "[3C_^^", "K$C_^", "C#C_^", "B_^-i", "B_^mC", "K1C_^M", "+(C_^", ";.C_^", "B_^DN", "+,C_^*", "*C_^lb", "1C_^?", "B_^VC", "C_^0&", "B_^Bf", "C_^,(", "B_^iV", "B_^7C", "+/C_^", "+C_^D", "PDC_I", " EC_I", "B_^j9", "C3C_^", "k/C_^", "88C_I", "B_^/^", "k'C_^", "s C_^", "1C_^2", "B_^'J", "B_^C=", "0C_^`y", "B_^/I", "S0C_^mm", "s+C_^Sx", "B_^$\"", ";#C_^", "#*C_^", "?C_^&1", "&C_^0K", "C_^,5", "1C_^T", "!C_^%", "B_^$j", "!C_^R", "s1C_^H", "{+C_^Ry", "K@C_^", "k C_^", "`EC_I", "C_^$\"", "C_^M>", "+C_^>", "3C_^/", "3&C_^f3", "B_^=K", "B_^{2", "B_^g+", "B_^@P", "P@C_I", "0C_^ue", "PEC_I", "'C_^+M", "B_^(a", "\"C_^!", "C_^$#", "B_^$&", "#@C_^", "B_^x3", "+C_^8", " DC_I", "B_^kD", "K>C_^", "&C_^o0", "B_^KT", "B_^LJ", "pEC_I", "K0C_^nl", "C_^ %", "B_^q&", "K&C_^^6", "k2C_^", "+*C_^", "C_^DA", "B_^|P", "89C_I", "B_^I:", "+.C_^", "0C_^]|", "0C_^wc", "0C_^Z", "+C_^;", "{\"C_^", "#6C_^", ">C_^\\", "B_^IF", "0C_^\\}", "C_^e7", "1C_^F", "K,C_^\"", "1C_^S", "c'C_^", "B_^b=", "*C_^o_", "*C_^s[", "B_^3\\", "?C_^0,", "C_^CB", "S1C_^L", "[1C_^K", "c!C_^`", "B_^^>", "#2C_^+", "{CC_^", "/C_^}_", "B_^o7", "B_^z2", "B_^c-", " FC_I", "{$C_^", "B_^\"V", "B_^FV", "0AC_I", "C\"C_^", "B_^Y^", "[(C_^", "B_^\"'", "C_^80", "B_^C>", ",C_^0", "`?C_I", "B_^UO", " @C_I", "B_^JL", "*C_^id", "[\"C_^", "S.C_^", "c3C_^Z", "c1C_^J", "S-C_^", "K)C_^", "C_^-M", "B_^+Z", "B_^[]", "C_^&\"", "C_^#R", "3>C_^", "B_^SP", "B_^5D", "&C_^8G", "[2C_^", "#!C_^|", "H7C_I", "[>C_^", "C?C_^A$", "3C_^3", "K\"C_^", "B_^_[", "B_^7T", "2C_^,", "+C_^_l", "B_^E=", "B_^%K", "c@C_^", "[/C_^", "'C_^'O", "B_^0 ", "#(C_^", "B_^l8", "B_^9B", "C_^8\"", "kCC_^", "B_^r6", "B_^##", ">C_^h", "0C_^cv", "B_^ZA", "P;C_I", "C_^^9", "c/C_^", "C_^7H", "!C_^(", "c#C_^", "c>C_^", ">C_^e", "C_^ 2", "B_^y?" ], "virustotal": { "error": true, "msg": "Unable to complete connection to VirusTotal. Status code: 429" }, "executed_tools": [ "msi_extract", "overlay", "kixtart_extract", "vbe_extract", "batch_extract", "UnAutoIt_extract", "UPX_unpack", "RarSFX_extract", "Inno_extract", "SevenZip_unpack", "de4dot_deobfuscate", "eziriz_deobfuscate", "office_one" ], "cape_type_code": 9, "cape_type": "Unpacked Shellcode", "process_path": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", "process_name": "powershell.exe", "module_path": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", "pid": 11260, "virtual_address": "0x00007FFEA09D0000" }, { "name": "0cb520fbce075cd66beb3dfad3f410d9feed059a22b68b8769e17c87e1b27711", "path": "/opt/CAPEv2/storage/analyses/33/CAPE/0cb520fbce075cd66beb3dfad3f410d9feed059a22b68b8769e17c87e1b27711", "guest_paths": "9;?C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe;?C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe;?0x00007FFEA08B0000;?", "size": 278, "crc32": "62540DFE", "md5": "326a9fc6a6bed2c9bc1fa4216fafb33b", "sha1": "e763264b28c99ab15fcad8fc7d0b548a7f916c21", "sha256": "0cb520fbce075cd66beb3dfad3f410d9feed059a22b68b8769e17c87e1b27711", "sha512": "b909c5cff621aebe2441eace8c72a9e9e5d1b9c96f26c83186354ccdeded5d8363313c0002c53c44569886295e0846e0b23880c0eb609641e2c53e8d7ea9769c", "rh_hash": null, "ssdeep": "6:Sa/0kfT/8Krw7f8qT/rT/kKKk1kuh+kKqkVkuhekKKk1tfKqVtfrwzrwbM+lkuhb:elmjOuutuOuNO7CGx+uV/", "type": "data", "yara": [], "cape_yara": [], "clamav": [], "tlsh": "T1A0D0C2429C653ECDC0519D3267D6A4B7A5ED211FE3CC3824411D003964AED1F10F7302", "sha3_384": "1a89cfebd10a246df0450c877d50d8c15b0ed9c3a181e663c8c7f7999edc61833a9e5f03ab0c032dfab26beaf85243a1", "yara_hash": "05ddd2ba6af91c0093e6b2dd9d4e664e1d0c5f1a80b80cc3cd41b1840ed26afe", "options_hash": "ca3760a7292cd3fa077daf6ff5eacbed9d31b472fec95e5f2c9cfb0a258ecd10", "data": null, "strings": [], "virustotal": { "error": true, "msg": "Unable to complete connection to VirusTotal. Status code: 429" }, "executed_tools": [ "msi_extract", "overlay", "kixtart_extract", "vbe_extract", "batch_extract", "UnAutoIt_extract", "UPX_unpack", "RarSFX_extract", "Inno_extract", "SevenZip_unpack", "de4dot_deobfuscate", "eziriz_deobfuscate", "office_one" ], "cape_type_code": 9, "cape_type": "Unpacked Shellcode", "process_path": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", "process_name": "powershell.exe", "module_path": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", "pid": 11260, "virtual_address": "0x00007FFEA08B0000" }, { "name": "44c97b92a962d051064603a8c8bf865cab4a4bdae213d74bef863b14048fbc7f", "path": "/opt/CAPEv2/storage/analyses/33/CAPE/44c97b92a962d051064603a8c8bf865cab4a4bdae213d74bef863b14048fbc7f", "guest_paths": "9;?C:\\Windows\\explorer.exe;?C:\\Windows\\explorer.exe;?0x000000000D430000;?", "size": 308, "crc32": "CCE08BC4", "md5": "055c8bae094e05431c92493f854665e1", "sha1": "d3ab0ac5b7da16a6aacce88b76b6c3b501d4387d", "sha256": "44c97b92a962d051064603a8c8bf865cab4a4bdae213d74bef863b14048fbc7f", "sha512": "db5ac43ebf9bb7d96432c13f8004afea7dc9fe896d9ac1fbec11589872b7b942f831b953fba53a389ff9ff50d291b7fc5f25ba7e1aff34f95edb64a5f6b77eea", "rh_hash": null, "ssdeep": "6:oAHdWMADl/EmQ8U7XS5cppZssYjkEsPMf5lFora9PKIdEmc8vUQtPb5ojdnl5:o2dWJDlzqjp7ssXDkf7FoOKmc8vpPO5z", "type": "data", "yara": [], "cape_yara": [], "clamav": [], "tlsh": "T11DE07D2B0D5920C7352E133DDC5754CE395AF6178311B243498546949A730FAE8BCC19", "sha3_384": "78c7d47bd21e141d8ba51487620e1270094aff3f560aa11cc9236777fb996e33a428cbe95764b14d0a77355496b617ec", "yara_hash": "05ddd2ba6af91c0093e6b2dd9d4e664e1d0c5f1a80b80cc3cd41b1840ed26afe", "options_hash": "ca3760a7292cd3fa077daf6ff5eacbed9d31b472fec95e5f2c9cfb0a258ecd10", "data": null, "strings": [ "@SUVH", "C:\\rl4cuydm\\dll\\ELAodRE.dll" ], "virustotal": { "error": true, "msg": "Unable to complete connection to VirusTotal. Status code: 429" }, "executed_tools": [ "msi_extract", "overlay", "kixtart_extract", "vbe_extract", "batch_extract", "UnAutoIt_extract", "UPX_unpack", "RarSFX_extract", "Inno_extract", "SevenZip_unpack", "de4dot_deobfuscate", "eziriz_deobfuscate", "office_one" ], "cape_type_code": 9, "cape_type": "Unpacked Shellcode", "process_path": "C:\\Windows\\explorer.exe", "process_name": "explorer.exe", "module_path": "C:\\Windows\\explorer.exe", "pid": 4484, "virtual_address": "0x000000000D430000" }, { "name": "9d733ac0b4917a48b31154ee4cec9e5d22deab4c217f17b5d0f5cf0ee34fec95", "path": "/opt/CAPEv2/storage/analyses/33/CAPE/9d733ac0b4917a48b31154ee4cec9e5d22deab4c217f17b5d0f5cf0ee34fec95", "guest_paths": "9;?C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe;?C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe;?0x00007DF413CD0000;?", "size": 102, "crc32": "CF697147", "md5": "705605593e45b5d609d1ba94f35e9174", "sha1": "079d49672065468974897117376eb25cc7ba4f9b", "sha256": "9d733ac0b4917a48b31154ee4cec9e5d22deab4c217f17b5d0f5cf0ee34fec95", "sha512": "b90aa812f85b73093089f02a9e0dc41731cd6b3ef1e25c85116cc26f5a7ba1fb451f627d0e9b9f912312bf8e00747aa69575e9859bf85f32bbecf7bd4bb5a73e", "rh_hash": null, "ssdeep": "3:XRaLmlQ+b/ellffu+AkBSl3+Xt/jllT/:BaLSQ+b/O/AJl3+5r/", "type": "data", "yara": [], "cape_yara": [], "clamav": [], "tlsh": "T16DB0121453830480D80040388360E34A53896800E1DE44013806314000358864AF92C2", "sha3_384": "288c44fe9d0d929868edc77bb9bc0f3e812b46f720811df29bf29d363661cfdd8ae0c0781bff0f485246d200bbfbca29", "yara_hash": "05ddd2ba6af91c0093e6b2dd9d4e664e1d0c5f1a80b80cc3cd41b1840ed26afe", "options_hash": "ca3760a7292cd3fa077daf6ff5eacbed9d31b472fec95e5f2c9cfb0a258ecd10", "data": null, "strings": [], "virustotal": { "error": true, "msg": "Unable to complete connection to VirusTotal. Status code: 429" }, "executed_tools": [ "msi_extract", "overlay", "kixtart_extract", "vbe_extract", "batch_extract", "UnAutoIt_extract", "UPX_unpack", "RarSFX_extract", "Inno_extract", "SevenZip_unpack", "de4dot_deobfuscate", "eziriz_deobfuscate", "office_one" ], "cape_type_code": 9, "cape_type": "Unpacked Shellcode", "process_path": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", "process_name": "powershell.exe", "module_path": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", "pid": 11260, "virtual_address": "0x00007DF413CD0000" } ], "configs": [] }, "info": { "version": "2.5", "started": "2026-05-28 21:04:54", "ended": "2026-05-28 21:06:27", "duration": 93, "id": 33, "category": "url", "custom": "", "machine": { "id": 29, "status": "stopping", "name": "cuckoo1", "label": "cuckoo1", "platform": "windows", "manager": "KVM", "started_on": "2026-05-28 21:04:54", "shutdown_on": "2026-05-28 21:06:27" }, "package": "edge", "timeout": false, "tlp": null, "parent_sample": null, "options": { "interactive": "1", "nohuman": "yes", "vnc_port": "5910" }, "source_url": null, "route": "none", "user_id": 1, "CAPE_current_commit": "e261551257b77d1ae36b689efcf9b3d0af4476c2" }, "behavior": { "processes": [ { "process_id": 4484, "process_name": "explorer.exe", "parent_id": 4364, "module_path": "C:\\Windows\\explorer.exe", "first_seen": "2026-05-29 01:05:01,399", "calls": [ { "timestamp": "2026-05-29 01:05:01,524", "thread_id": "4696", "caller": "0x7ff79bc7a06e", "parentcaller": "0x7ff79bc78f2b", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 0 }, { "timestamp": "2026-05-29 01:05:01,524", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc78f2b", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 1 }, { "timestamp": "2026-05-29 01:05:01,555", "thread_id": "6164", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5978ef53", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000082c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 2 }, { "timestamp": "2026-05-29 01:05:01,555", "thread_id": "6164", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 3 }, { "timestamp": "2026-05-29 01:05:01,555", "thread_id": "6252", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 4 }, { "timestamp": "2026-05-29 01:05:01,555", "thread_id": "4620", "caller": "0x7fff40c74428", "parentcaller": "0x7fff40c73a03", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "F0AE1542-F497-484B-A175-A20DB09144BA" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "8DC24A1A-6314-4769-9D68-179786F4CED6" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 5 }, { "timestamp": "2026-05-29 01:05:01,555", "thread_id": "6252", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff557c9e99", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x4574f454d" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6 }, { "timestamp": "2026-05-29 01:05:01,571", "thread_id": "6252", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 7 }, { "timestamp": "2026-05-29 01:05:01,571", "thread_id": "4620", "caller": "0x7fff40c74428", "parentcaller": "0x7fff40c73a03", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "F0AE1542-F497-484B-A175-A20DB09144BA" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "8DC24A1A-6314-4769-9D68-179786F4CED6" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 8 }, { "timestamp": "2026-05-29 01:05:01,571", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000021ac" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000231c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 9 }, { "timestamp": "2026-05-29 01:05:01,571", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000231c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fd0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 10 }, { "timestamp": "2026-05-29 01:05:01,571", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000021ac" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000021ac" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 11 }, { "timestamp": "2026-05-29 01:05:01,571", "thread_id": "6252", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff557c9e99", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x4574f454d" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 12 }, { "timestamp": "2026-05-29 01:05:01,712", "thread_id": "4696", "caller": "0x7ff79bc7a06e", "parentcaller": "0x7ff79bc78f2b", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 13 }, { "timestamp": "2026-05-29 01:05:01,712", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc78f2b", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 14 }, { "timestamp": "2026-05-29 01:05:03,337", "thread_id": "4696", "caller": "0x7ff79bc7c21a", "parentcaller": "0x7ff79bc62b6f", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "21CBC515-2DDE-4D66-8292-BA34BD25094A" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 15 }, { "timestamp": "2026-05-29 01:05:03,337", "thread_id": "4696", "caller": "0x7ff79bc7c285", "parentcaller": "0x7ff79bc62b6f", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 16 }, { "timestamp": "2026-05-29 01:05:03,337", "thread_id": "4696", "caller": "0x7ff79bca1e2d", "parentcaller": "0x7ff79bc5c798", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\rsaenh.dll" }, { "name": "BaseAddress", "value": "0x7fff56630000" } ], "repeated": 1, "id": 17 }, { "timestamp": "2026-05-29 01:05:03,337", "thread_id": "4696", "caller": "0x7ff79bc5dd72", "parentcaller": "0x7ff79bc5c5b7", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000470" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 18 }, { "timestamp": "2026-05-29 01:05:03,337", "thread_id": "4696", "caller": "0x7ff79bc5dd72", "parentcaller": "0x7ff79bc5c5b7", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00f9b281" }, { "name": "Buffer", "value": "\\x01" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 19 }, { "timestamp": "2026-05-29 01:05:03,337", "thread_id": "4696", "caller": "0x7ff79bc5dd72", "parentcaller": "0x7ff79bc5c5b7", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000470" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files (x86)\\desktop.ini" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 20 }, { "timestamp": "2026-05-29 01:05:03,337", "thread_id": "4696", "caller": "0x7ff79bc5dd72", "parentcaller": "0x7ff79bc5c5b7", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00f9b281" }, { "name": "Buffer", "value": "\\x00" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 21 }, { "timestamp": "2026-05-29 01:05:03,337", "thread_id": "4696", "caller": "0x7ff79bc5dd72", "parentcaller": "0x7ff79bc5c5b7", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000470" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files (x86)" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 22 }, { "timestamp": "2026-05-29 01:05:03,337", "thread_id": "4696", "caller": "0x7ff79bc5dd72", "parentcaller": "0x7ff79bc5c5b7", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000470" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files (x86)\\Steam" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 23 }, { "timestamp": "2026-05-29 01:05:03,883", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000458" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000214c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 24 }, { "timestamp": "2026-05-29 01:05:03,883", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000214c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fe0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 25 }, { "timestamp": "2026-05-29 01:05:03,883", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000458" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000458" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 26 }, { "timestamp": "2026-05-29 01:05:03,883", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 27 }, { "timestamp": "2026-05-29 01:05:03,883", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 28 }, { "timestamp": "2026-05-29 01:05:03,883", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000019c4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000232c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 29 }, { "timestamp": "2026-05-29 01:05:03,883", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 30 }, { "timestamp": "2026-05-29 01:05:03,883", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000232c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000019c4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 31 }, { "timestamp": "2026-05-29 01:05:03,883", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 32 }, { "timestamp": "2026-05-29 01:05:03,883", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000458" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000021b0" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 33 }, { "timestamp": "2026-05-29 01:05:03,883", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 34 }, { "timestamp": "2026-05-29 01:05:03,883", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000231c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002318" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 35 }, { "timestamp": "2026-05-29 01:05:03,883", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 36 }, { "timestamp": "2026-05-29 01:05:03,883", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002330" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002334" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 37 }, { "timestamp": "2026-05-29 01:05:03,883", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 38 }, { "timestamp": "2026-05-29 01:05:03,883", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002318" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000231c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 39 }, { "timestamp": "2026-05-29 01:05:03,883", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 40 }, { "timestamp": "2026-05-29 01:05:03,883", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000231c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002338" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 41 }, { "timestamp": "2026-05-29 01:05:03,899", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 42 }, { "timestamp": "2026-05-29 01:05:03,899", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002338" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000231c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 43 }, { "timestamp": "2026-05-29 01:05:03,899", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 44 }, { "timestamp": "2026-05-29 01:05:03,899", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000231c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002338" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 45 }, { "timestamp": "2026-05-29 01:05:03,899", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 46 }, { "timestamp": "2026-05-29 01:05:03,899", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002338" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000231c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 47 }, { "timestamp": "2026-05-29 01:05:03,899", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 48 }, { "timestamp": "2026-05-29 01:05:03,899", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000019c4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000232c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 49 }, { "timestamp": "2026-05-29 01:05:03,899", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 50 }, { "timestamp": "2026-05-29 01:05:03,899", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000021b0" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000458" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 51 }, { "timestamp": "2026-05-29 01:05:03,899", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 52 }, { "timestamp": "2026-05-29 01:05:03,899", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000232c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000458" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 53 }, { "timestamp": "2026-05-29 01:05:03,899", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 54 }, { "timestamp": "2026-05-29 01:05:03,899", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000232c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000021b0" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 55 }, { "timestamp": "2026-05-29 01:05:03,899", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 56 }, { "timestamp": "2026-05-29 01:05:03,899", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000458" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002318" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 57 }, { "timestamp": "2026-05-29 01:05:03,899", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 58 }, { "timestamp": "2026-05-29 01:05:03,899", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002318" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000458" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 59 }, { "timestamp": "2026-05-29 01:05:03,899", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 60 }, { "timestamp": "2026-05-29 01:05:03,899", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000458" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000231c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 61 }, { "timestamp": "2026-05-29 01:05:03,899", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 62 }, { "timestamp": "2026-05-29 01:05:03,899", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000231c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000458" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 63 }, { "timestamp": "2026-05-29 01:05:03,899", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 64 }, { "timestamp": "2026-05-29 01:05:03,899", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000458" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000231c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 65 }, { "timestamp": "2026-05-29 01:05:03,899", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 66 }, { "timestamp": "2026-05-29 01:05:03,899", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000231c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000458" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 67 }, { "timestamp": "2026-05-29 01:05:03,899", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 68 }, { "timestamp": "2026-05-29 01:05:03,899", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000214c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002148" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 69 }, { "timestamp": "2026-05-29 01:05:03,899", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 70 }, { "timestamp": "2026-05-29 01:05:03,899", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000458" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000231c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 71 }, { "timestamp": "2026-05-29 01:05:03,899", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 72 }, { "timestamp": "2026-05-29 01:05:03,899", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000231c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000458" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 73 }, { "timestamp": "2026-05-29 01:05:03,899", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 74 }, { "timestamp": "2026-05-29 01:05:03,899", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000458" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000231c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 75 }, { "timestamp": "2026-05-29 01:05:03,899", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 76 }, { "timestamp": "2026-05-29 01:05:03,915", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002148" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000021b0" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 77 }, { "timestamp": "2026-05-29 01:05:03,915", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 78 }, { "timestamp": "2026-05-29 01:05:03,915", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002338" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000233c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 79 }, { "timestamp": "2026-05-29 01:05:03,915", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 80 }, { "timestamp": "2026-05-29 01:05:03,915", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000233c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000021b0" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 81 }, { "timestamp": "2026-05-29 01:05:03,915", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 82 }, { "timestamp": "2026-05-29 01:05:03,915", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000021b0" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000233c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 83 }, { "timestamp": "2026-05-29 01:05:03,915", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 84 }, { "timestamp": "2026-05-29 01:05:03,915", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000233c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000021b0" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 85 }, { "timestamp": "2026-05-29 01:05:03,915", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 86 }, { "timestamp": "2026-05-29 01:05:03,915", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000021b0" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000233c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 87 }, { "timestamp": "2026-05-29 01:05:03,915", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 88 }, { "timestamp": "2026-05-29 01:05:03,915", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000233c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000021b0" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 89 }, { "timestamp": "2026-05-29 01:05:03,915", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 90 }, { "timestamp": "2026-05-29 01:05:03,915", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000021b0" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000233c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 91 }, { "timestamp": "2026-05-29 01:05:03,915", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 92 }, { "timestamp": "2026-05-29 01:05:03,915", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002318" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002314" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 93 }, { "timestamp": "2026-05-29 01:05:03,915", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 94 }, { "timestamp": "2026-05-29 01:05:03,915", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000233c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000021b0" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 95 }, { "timestamp": "2026-05-29 01:05:03,915", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 96 }, { "timestamp": "2026-05-29 01:05:03,915", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002334" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000231c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 97 }, { "timestamp": "2026-05-29 01:05:03,915", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 98 }, { "timestamp": "2026-05-29 01:05:03,915", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000231c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002314" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 99 }, { "timestamp": "2026-05-29 01:05:03,915", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 100 }, { "timestamp": "2026-05-29 01:05:03,915", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002314" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000231c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 101 }, { "timestamp": "2026-05-29 01:05:03,915", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 102 }, { "timestamp": "2026-05-29 01:05:03,915", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000231c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002314" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 103 }, { "timestamp": "2026-05-29 01:05:03,915", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 104 }, { "timestamp": "2026-05-29 01:05:03,915", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002330" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000021b0" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 105 }, { "timestamp": "2026-05-29 01:05:03,915", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 106 }, { "timestamp": "2026-05-29 01:05:03,915", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000214c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002154" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 107 }, { "timestamp": "2026-05-29 01:05:03,915", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 108 }, { "timestamp": "2026-05-29 01:05:03,930", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002154" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000214c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 109 }, { "timestamp": "2026-05-29 01:05:03,930", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 110 }, { "timestamp": "2026-05-29 01:05:03,930", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000214c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000233c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 111 }, { "timestamp": "2026-05-29 01:05:03,930", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 112 }, { "timestamp": "2026-05-29 01:05:03,930", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002314" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000231c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 113 }, { "timestamp": "2026-05-29 01:05:03,930", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 114 }, { "timestamp": "2026-05-29 01:05:03,930", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002154" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000215c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 115 }, { "timestamp": "2026-05-29 01:05:03,930", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 116 }, { "timestamp": "2026-05-29 01:05:03,930", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000233c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000214c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 117 }, { "timestamp": "2026-05-29 01:05:03,930", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 118 }, { "timestamp": "2026-05-29 01:05:03,930", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000214c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000233c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 119 }, { "timestamp": "2026-05-29 01:05:03,930", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 120 }, { "timestamp": "2026-05-29 01:05:03,930", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000233c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000214c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 121 }, { "timestamp": "2026-05-29 01:05:03,930", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 122 }, { "timestamp": "2026-05-29 01:05:03,930", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000231c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002314" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 123 }, { "timestamp": "2026-05-29 01:05:03,930", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 124 }, { "timestamp": "2026-05-29 01:05:03,930", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000214c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000233c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 125 }, { "timestamp": "2026-05-29 01:05:03,930", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 126 }, { "timestamp": "2026-05-29 01:05:03,930", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000233c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000214c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 127 }, { "timestamp": "2026-05-29 01:05:03,930", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 128 }, { "timestamp": "2026-05-29 01:05:03,930", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000214c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000233c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 129 }, { "timestamp": "2026-05-29 01:05:03,930", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 130 }, { "timestamp": "2026-05-29 01:05:03,930", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000233c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000214c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 131 }, { "timestamp": "2026-05-29 01:05:03,930", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 132 }, { "timestamp": "2026-05-29 01:05:03,930", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000214c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000233c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 133 }, { "timestamp": "2026-05-29 01:05:03,930", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 134 }, { "timestamp": "2026-05-29 01:05:03,930", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002314" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000231c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 135 }, { "timestamp": "2026-05-29 01:05:03,930", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 136 }, { "timestamp": "2026-05-29 01:05:03,930", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002148" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000232c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 137 }, { "timestamp": "2026-05-29 01:05:03,930", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 138 }, { "timestamp": "2026-05-29 01:05:03,930", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000232c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002148" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 139 }, { "timestamp": "2026-05-29 01:05:03,930", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 140 }, { "timestamp": "2026-05-29 01:05:03,930", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000233c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000214c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 141 }, { "timestamp": "2026-05-29 01:05:03,946", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 142 }, { "timestamp": "2026-05-29 01:05:03,946", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000214c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000233c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 143 }, { "timestamp": "2026-05-29 01:05:03,946", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 144 }, { "timestamp": "2026-05-29 01:05:03,946", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000233c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000214c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 145 }, { "timestamp": "2026-05-29 01:05:03,946", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 146 }, { "timestamp": "2026-05-29 01:05:03,946", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000214c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000233c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 147 }, { "timestamp": "2026-05-29 01:05:03,946", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 148 }, { "timestamp": "2026-05-29 01:05:03,946", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000233c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000214c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 149 }, { "timestamp": "2026-05-29 01:05:03,946", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 150 }, { "timestamp": "2026-05-29 01:05:03,946", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000214c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000233c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 151 }, { "timestamp": "2026-05-29 01:05:03,946", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 152 }, { "timestamp": "2026-05-29 01:05:03,946", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000233c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000214c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 153 }, { "timestamp": "2026-05-29 01:05:03,946", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 154 }, { "timestamp": "2026-05-29 01:05:03,946", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000214c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000233c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 155 }, { "timestamp": "2026-05-29 01:05:03,946", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 156 }, { "timestamp": "2026-05-29 01:05:03,946", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000215c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002154" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 157 }, { "timestamp": "2026-05-29 01:05:03,946", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 158 }, { "timestamp": "2026-05-29 01:05:03,946", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000231c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002314" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 159 }, { "timestamp": "2026-05-29 01:05:03,946", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 160 }, { "timestamp": "2026-05-29 01:05:03,946", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002148" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000232c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 161 }, { "timestamp": "2026-05-29 01:05:03,946", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 162 }, { "timestamp": "2026-05-29 01:05:03,946", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000232c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002148" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 163 }, { "timestamp": "2026-05-29 01:05:03,946", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 164 }, { "timestamp": "2026-05-29 01:05:03,946", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002148" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000232c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 165 }, { "timestamp": "2026-05-29 01:05:03,946", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 166 }, { "timestamp": "2026-05-29 01:05:03,946", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000232c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002148" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 167 }, { "timestamp": "2026-05-29 01:05:03,946", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 168 }, { "timestamp": "2026-05-29 01:05:03,946", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002148" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000232c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 169 }, { "timestamp": "2026-05-29 01:05:03,946", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 170 }, { "timestamp": "2026-05-29 01:05:03,946", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000232c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002148" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 171 }, { "timestamp": "2026-05-29 01:05:03,946", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 172 }, { "timestamp": "2026-05-29 01:05:03,946", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002148" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000233c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 173 }, { "timestamp": "2026-05-29 01:05:03,946", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 174 }, { "timestamp": "2026-05-29 01:05:03,946", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000233c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002148" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 175 }, { "timestamp": "2026-05-29 01:05:03,946", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 176 }, { "timestamp": "2026-05-29 01:05:03,946", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002334" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002148" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 177 }, { "timestamp": "2026-05-29 01:05:03,946", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 178 }, { "timestamp": "2026-05-29 01:05:03,946", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000232c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000470" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 179 }, { "timestamp": "2026-05-29 01:05:03,946", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 180 }, { "timestamp": "2026-05-29 01:05:03,946", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000470" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000232c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 181 }, { "timestamp": "2026-05-29 01:05:03,946", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 182 }, { "timestamp": "2026-05-29 01:05:03,946", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000232c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000470" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 183 }, { "timestamp": "2026-05-29 01:05:03,946", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 184 }, { "timestamp": "2026-05-29 01:05:03,946", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000470" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000232c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 185 }, { "timestamp": "2026-05-29 01:05:03,946", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 186 }, { "timestamp": "2026-05-29 01:05:03,946", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002148" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000458" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 187 }, { "timestamp": "2026-05-29 01:05:03,946", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 188 }, { "timestamp": "2026-05-29 01:05:03,946", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002334" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000233c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 189 }, { "timestamp": "2026-05-29 01:05:03,962", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 190 }, { "timestamp": "2026-05-29 01:05:03,962", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000233c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002334" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 191 }, { "timestamp": "2026-05-29 01:05:03,962", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 192 }, { "timestamp": "2026-05-29 01:05:03,962", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002334" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000233c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 193 }, { "timestamp": "2026-05-29 01:05:03,962", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 194 }, { "timestamp": "2026-05-29 01:05:03,962", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000233c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002334" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 195 }, { "timestamp": "2026-05-29 01:05:03,962", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 196 }, { "timestamp": "2026-05-29 01:05:03,962", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002334" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000233c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 197 }, { "timestamp": "2026-05-29 01:05:03,962", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 198 }, { "timestamp": "2026-05-29 01:05:03,962", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000233c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002334" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 199 }, { "timestamp": "2026-05-29 01:05:03,962", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 200 }, { "timestamp": "2026-05-29 01:05:03,962", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002334" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000233c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 201 }, { "timestamp": "2026-05-29 01:05:03,962", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 202 }, { "timestamp": "2026-05-29 01:05:03,962", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000233c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002334" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 203 }, { "timestamp": "2026-05-29 01:05:03,962", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 204 }, { "timestamp": "2026-05-29 01:05:03,962", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002334" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000233c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 205 }, { "timestamp": "2026-05-29 01:05:03,962", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 206 }, { "timestamp": "2026-05-29 01:05:03,962", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000233c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002334" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 207 }, { "timestamp": "2026-05-29 01:05:03,962", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 208 }, { "timestamp": "2026-05-29 01:05:03,962", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002334" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000233c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 209 }, { "timestamp": "2026-05-29 01:05:03,962", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 210 }, { "timestamp": "2026-05-29 01:05:03,962", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000233c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002334" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 211 }, { "timestamp": "2026-05-29 01:05:03,962", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 212 }, { "timestamp": "2026-05-29 01:05:03,962", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002334" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000233c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 213 }, { "timestamp": "2026-05-29 01:05:03,962", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 214 }, { "timestamp": "2026-05-29 01:05:03,962", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000233c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002334" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 215 }, { "timestamp": "2026-05-29 01:05:03,962", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 216 }, { "timestamp": "2026-05-29 01:05:03,962", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002334" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000233c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 217 }, { "timestamp": "2026-05-29 01:05:03,962", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 218 }, { "timestamp": "2026-05-29 01:05:03,962", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000233c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002334" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 219 }, { "timestamp": "2026-05-29 01:05:03,962", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 220 }, { "timestamp": "2026-05-29 01:05:03,962", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002334" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000233c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 221 }, { "timestamp": "2026-05-29 01:05:03,962", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 222 }, { "timestamp": "2026-05-29 01:05:03,962", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002314" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000231c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 223 }, { "timestamp": "2026-05-29 01:05:03,962", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 224 }, { "timestamp": "2026-05-29 01:05:03,962", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000231c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002314" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 225 }, { "timestamp": "2026-05-29 01:05:03,977", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 226 }, { "timestamp": "2026-05-29 01:05:03,977", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 227 }, { "timestamp": "2026-05-29 01:05:03,977", "thread_id": "4620", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000232c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000470" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 228 }, { "timestamp": "2026-05-29 01:05:03,977", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 229 }, { "timestamp": "2026-05-29 01:05:04,383", "thread_id": "4668", "caller": "0x7fff5588d4e4", "parentcaller": "0x7fff557c3285", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00f95281" }, { "name": "Buffer", "value": "\\x01" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 230 }, { "timestamp": "2026-05-29 01:05:04,383", "thread_id": "4668", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000470" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Desktop\\desktop.ini" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 231 }, { "timestamp": "2026-05-29 01:05:04,383", "thread_id": "4668", "caller": "0x7fff5588d4e4", "parentcaller": "0x7fff557c348f", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00f95281" }, { "name": "Buffer", "value": "\\x00" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 232 }, { "timestamp": "2026-05-29 01:05:04,383", "thread_id": "4668", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000470" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Desktop" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 233 }, { "timestamp": "2026-05-29 01:05:04,383", "thread_id": "4668", "caller": "0x7fff5588d4e4", "parentcaller": "0x7fff557c3285", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00f95281" }, { "name": "Buffer", "value": "\\x01" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 234 }, { "timestamp": "2026-05-29 01:05:04,383", "thread_id": "4668", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000232c" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop\\desktop.ini" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 235 }, { "timestamp": "2026-05-29 01:05:04,383", "thread_id": "4668", "caller": "0x7fff5588d4e4", "parentcaller": "0x7fff557c348f", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00f95281" }, { "name": "Buffer", "value": "\\x00" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 236 }, { "timestamp": "2026-05-29 01:05:04,383", "thread_id": "4668", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000232c" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 237 }, { "timestamp": "2026-05-29 01:05:04,383", "thread_id": "4668", "caller": "0x7fff558259d3", "parentcaller": "0x7fff55896922", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0E5AAE11-A475-4C5B-AB00-C66DE400274E" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 238 }, { "timestamp": "2026-05-29 01:05:04,383", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "2155FEE3-2419-4373-B102-6843707EB41F" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "F676C15D-596A-4CE2-8234-33996F445DB1" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 239 }, { "timestamp": "2026-05-29 01:05:04,399", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 240 }, { "timestamp": "2026-05-29 01:05:04,399", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x011938c0" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 241 }, { "timestamp": "2026-05-29 01:05:04,399", "thread_id": "4668", "caller": "0x7fff59f9d2a3", "parentcaller": "0x7fff59f6bac7", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc000003a", "pretty_return": "OBJECT_PATH_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x7fff59fed2c4" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "::\\" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 242 }, { "timestamp": "2026-05-29 01:05:04,399", "thread_id": "4668", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 243 }, { "timestamp": "2026-05-29 01:05:04,399", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002318" }, { "name": "DesiredAccess", "value": "0xc0100080", "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 244 }, { "timestamp": "2026-05-29 01:05:04,399", "thread_id": "4668", "caller": "0x7fff59f9d2a3", "parentcaller": "0x7fff59f6bac7", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc000003a", "pretty_return": "OBJECT_PATH_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x7fff59fed2c4" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "::\\" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 245 }, { "timestamp": "2026-05-29 01:05:04,399", "thread_id": "4668", "caller": "0x7fff558259d3", "parentcaller": "0x7fff55896922", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0E5AAE11-A475-4C5B-AB00-C66DE400274E" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "000214E6-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 246 }, { "timestamp": "2026-05-29 01:05:04,399", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002318" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" }, { "name": "FileInformationClass", "value": "74" }, { "name": "FileInformation", "value": "\\x02\\x00\\x00\\x00" } ], "repeated": 0, "id": 247 }, { "timestamp": "2026-05-29 01:05:04,399", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002310" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fe0000" }, { "name": "SectionOffset", "value": "0x00d9de10" }, { "name": "ViewSize", "value": "0x0000f000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 248 }, { "timestamp": "2026-05-29 01:05:04,399", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002318" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000022c8" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 249 }, { "timestamp": "2026-05-29 01:05:04,399", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001aec" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "ShareAccess", "value": "0" } ], "repeated": 0, "id": 250 }, { "timestamp": "2026-05-29 01:05:04,399", "thread_id": "4668", "caller": "0x7fff577d6bcf", "parentcaller": "0x7fff577d6883", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002348" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\STORAGE#Volume#{e32a9442-5af2-11f1-ae2c-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 1, "id": 251 }, { "timestamp": "2026-05-29 01:05:04,399", "thread_id": "4668", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d4f8e", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002348" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\MountPointManager" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 252 }, { "timestamp": "2026-05-29 01:05:04,399", "thread_id": "4668", "caller": "0x7fff577d6bcf", "parentcaller": "0x7fff577d6883", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002348" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\STORAGE#Volume#{e32a9442-5af2-11f1-ae2c-806e6f6e6963}#0000000003300000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 1, "id": 253 }, { "timestamp": "2026-05-29 01:05:04,399", "thread_id": "4668", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d4f8e", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002348" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\MountPointManager" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 254 }, { "timestamp": "2026-05-29 01:05:04,399", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000468" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_48.db" }, { "name": "FileInformationClass", "value": "74" }, { "name": "FileInformation", "value": "\\x02\\x00\\x00\\x00" } ], "repeated": 0, "id": 255 }, { "timestamp": "2026-05-29 01:05:04,399", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002108" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x12940000" }, { "name": "SectionOffset", "value": "0x00d9dd90" }, { "name": "ViewSize", "value": "0x00100000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 256 }, { "timestamp": "2026-05-29 01:05:04,399", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000468" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000020ec" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 257 }, { "timestamp": "2026-05-29 01:05:04,399", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001aec" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\imageres.dll" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 258 }, { "timestamp": "2026-05-29 01:05:04,399", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x40000003", "arguments": [ { "name": "SectionHandle", "value": "0x000022c4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fe0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00003000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 259 }, { "timestamp": "2026-05-29 01:05:04,399", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001aec" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\en-US\\imageres.dll.mui" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 260 }, { "timestamp": "2026-05-29 01:05:04,399", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000022c4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02ff0000" }, { "name": "SectionOffset", "value": "0x00d9c210" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 261 }, { "timestamp": "2026-05-29 01:05:04,399", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc000003a", "pretty_return": "OBJECT_PATH_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\SystemResources\\imageres.dll.mui.mun" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 262 }, { "timestamp": "2026-05-29 01:05:04,399", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022c4" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\SystemResources\\imageres.dll.mun" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 263 }, { "timestamp": "2026-05-29 01:05:04,399", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002310" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x12940000" }, { "name": "SectionOffset", "value": "0x00d9c1c0" }, { "name": "ViewSize", "value": "0x013c0000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 264 }, { "timestamp": "2026-05-29 01:05:04,399", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x12940000" }, { "name": "RegionSize", "value": "0x013c0000" } ], "repeated": 0, "id": 265 }, { "timestamp": "2026-05-29 01:05:04,399", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02ff0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 266 }, { "timestamp": "2026-05-29 01:05:04,399", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fe0000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 267 }, { "timestamp": "2026-05-29 01:05:04,399", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "2155FEE3-2419-4373-B102-6843707EB41F" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "F676C15D-596A-4CE2-8234-33996F445DB1" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 268 }, { "timestamp": "2026-05-29 01:05:04,399", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 269 }, { "timestamp": "2026-05-29 01:05:04,399", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x011938c0" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 270 }, { "timestamp": "2026-05-29 01:05:04,399", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x076d7e08" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 271 }, { "timestamp": "2026-05-29 01:05:04,399", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001aec" }, { "name": "DesiredAccess", "value": "0xc0100080", "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 272 }, { "timestamp": "2026-05-29 01:05:04,399", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001aec" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" }, { "name": "FileInformationClass", "value": "74" }, { "name": "FileInformation", "value": "\\x02\\x00\\x00\\x00" } ], "repeated": 0, "id": 273 }, { "timestamp": "2026-05-29 01:05:04,399", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000022c4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fe0000" }, { "name": "SectionOffset", "value": "0x00d9da70" }, { "name": "ViewSize", "value": "0x0000f000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 274 }, { "timestamp": "2026-05-29 01:05:04,399", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001aec" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002280" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 275 }, { "timestamp": "2026-05-29 01:05:04,399", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022c8" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "ShareAccess", "value": "0" } ], "repeated": 0, "id": 276 }, { "timestamp": "2026-05-29 01:05:04,399", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022c8" }, { "name": "DesiredAccess", "value": "0xc0100080", "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_48.db" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 277 }, { "timestamp": "2026-05-29 01:05:04,399", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022c8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_48.db" }, { "name": "FileInformationClass", "value": "74" }, { "name": "FileInformation", "value": "\\x02\\x00\\x00\\x00" } ], "repeated": 0, "id": 278 }, { "timestamp": "2026-05-29 01:05:04,399", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000227c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x12940000" }, { "name": "SectionOffset", "value": "0x00d9d9f0" }, { "name": "ViewSize", "value": "0x00100000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 279 }, { "timestamp": "2026-05-29 01:05:04,399", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000022c8" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002278" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 280 }, { "timestamp": "2026-05-29 01:05:04,415", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022c4" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "ShareAccess", "value": "0" } ], "repeated": 0, "id": 281 }, { "timestamp": "2026-05-29 01:05:04,415", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "317D06E8-5F24-433D-BDF7-79CE68D8ABC2" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EC5EC8A9-C395-4314-9C77-54D7A935FF70" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 282 }, { "timestamp": "2026-05-29 01:05:04,415", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 283 }, { "timestamp": "2026-05-29 01:05:04,415", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000232c" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop\\Google Chrome.lnk" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 284 }, { "timestamp": "2026-05-29 01:05:04,415", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002314" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02ff0000" }, { "name": "SectionOffset", "value": "0x00d9b8c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 285 }, { "timestamp": "2026-05-29 01:05:04,430", "thread_id": "4488", "caller": "0x745e7ad37da8", "parentcaller": "0x00000000", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002348" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 286 }, { "timestamp": "2026-05-29 01:05:04,430", "thread_id": "4488", "caller": "0x745e7ad36ba8", "parentcaller": "0x00000000", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00f7d281" }, { "name": "Buffer", "value": "\\x01" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 287 }, { "timestamp": "2026-05-29 01:05:04,430", "thread_id": "4488", "caller": "0x745e7ad368c8", "parentcaller": "0x00000000", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002348" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files\\desktop.ini" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 288 }, { "timestamp": "2026-05-29 01:05:04,430", "thread_id": "4488", "caller": "0x745e7ad36ba8", "parentcaller": "0x00000000", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00f7d281" }, { "name": "Buffer", "value": "\\x00" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 289 }, { "timestamp": "2026-05-29 01:05:04,446", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000323-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000146-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 290 }, { "timestamp": "2026-05-29 01:05:04,446", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 291 }, { "timestamp": "2026-05-29 01:05:04,446", "thread_id": "4488", "caller": "0x745e7ad35b88", "parentcaller": "0x00000000", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 292 }, { "timestamp": "2026-05-29 01:05:04,446", "thread_id": "4668", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001aec" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 293 }, { "timestamp": "2026-05-29 01:05:04,446", "thread_id": "4668", "caller": "0x7fff5588d4e4", "parentcaller": "0x7fff557c3285", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00f95281" }, { "name": "Buffer", "value": "\\x01" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 294 }, { "timestamp": "2026-05-29 01:05:04,446", "thread_id": "4668", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001aec" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\desktop.ini" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 295 }, { "timestamp": "2026-05-29 01:05:04,446", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002348" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02ff0000" }, { "name": "SectionOffset", "value": "0x00d9b8c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 296 }, { "timestamp": "2026-05-29 01:05:04,446", "thread_id": "4668", "caller": "0x7fff5588d4e4", "parentcaller": "0x7fff557c348f", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00f95281" }, { "name": "Buffer", "value": "\\x00" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 297 }, { "timestamp": "2026-05-29 01:05:04,446", "thread_id": "4668", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001aec" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 298 }, { "timestamp": "2026-05-29 01:05:04,446", "thread_id": "4668", "caller": "0x7fff5588d4e4", "parentcaller": "0x7fff557c3285", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00f95281" }, { "name": "Buffer", "value": "\\x01" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 299 }, { "timestamp": "2026-05-29 01:05:04,446", "thread_id": "4668", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001aec" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\desktop.ini" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 300 }, { "timestamp": "2026-05-29 01:05:04,446", "thread_id": "4668", "caller": "0x7fff5588d4e4", "parentcaller": "0x7fff557c348f", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00f95281" }, { "name": "Buffer", "value": "\\x00" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 301 }, { "timestamp": "2026-05-29 01:05:04,446", "thread_id": "4668", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001aec" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 302 }, { "timestamp": "2026-05-29 01:05:04,446", "thread_id": "4488", "caller": "0x745e7ad35b88", "parentcaller": "0x00000000", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 303 }, { "timestamp": "2026-05-29 01:05:04,446", "thread_id": "4668", "caller": "0x7fff55824fbc", "parentcaller": "0x7fff5581f4db", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000323-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000146-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 304 }, { "timestamp": "2026-05-29 01:05:04,446", "thread_id": "4840", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002290" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop\\Microsoft Edge.lnk" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 305 }, { "timestamp": "2026-05-29 01:05:04,446", "thread_id": "4840", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002294" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02ff0000" }, { "name": "SectionOffset", "value": "0x07fcd520" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 306 }, { "timestamp": "2026-05-29 01:05:04,446", "thread_id": "4668", "caller": "0x7fff577d6bcf", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc00000ba", "pretty_return": "FILE_IS_A_DIRECTORY", "arguments": [ { "name": "FileHandle", "value": "0x00000202" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 307 }, { "timestamp": "2026-05-29 01:05:04,446", "thread_id": "4668", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002358" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 308 }, { "timestamp": "2026-05-29 01:05:04,446", "thread_id": "4668", "caller": "0x7fff577d6c28", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002358" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 309 }, { "timestamp": "2026-05-29 01:05:04,446", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000323-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000146-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 310 }, { "timestamp": "2026-05-29 01:05:04,446", "thread_id": "4668", "caller": "0x7fff577d4d82", "parentcaller": "0x7fff577d6fe6", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002358" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 311 }, { "timestamp": "2026-05-29 01:05:04,446", "thread_id": "4668", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002358" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 312 }, { "timestamp": "2026-05-29 01:05:04,446", "thread_id": "4668", "caller": "0x7fff577d6bcf", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc00000ba", "pretty_return": "FILE_IS_A_DIRECTORY", "arguments": [ { "name": "FileHandle", "value": "0x00002358" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 313 }, { "timestamp": "2026-05-29 01:05:04,446", "thread_id": "5096", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002290" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop\\Steam.lnk" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 314 }, { "timestamp": "2026-05-29 01:05:04,446", "thread_id": "4488", "caller": "0x745e7ad37678", "parentcaller": "0x00000000", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0E5AAE11-A475-4C5B-AB00-C66DE400274E" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 315 }, { "timestamp": "2026-05-29 01:05:04,446", "thread_id": "4668", "caller": "0x7fff577d6c28", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002154" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 1, "id": 316 }, { "timestamp": "2026-05-29 01:05:04,446", "thread_id": "4668", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002154" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 317 }, { "timestamp": "2026-05-29 01:05:04,446", "thread_id": "4668", "caller": "0x7fff577d6bcf", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc00000ba", "pretty_return": "FILE_IS_A_DIRECTORY", "arguments": [ { "name": "FileHandle", "value": "0x00002154" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 318 }, { "timestamp": "2026-05-29 01:05:04,446", "thread_id": "4668", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002154" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 319 }, { "timestamp": "2026-05-29 01:05:04,446", "thread_id": "4668", "caller": "0x7fff577d6c28", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001aec" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 1, "id": 320 }, { "timestamp": "2026-05-29 01:05:04,446", "thread_id": "5096", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000470" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files (x86)\\Steam\\steam.exe" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 321 }, { "timestamp": "2026-05-29 01:05:04,446", "thread_id": "4668", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d4f8e", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001aec" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\MountPointManager" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 322 }, { "timestamp": "2026-05-29 01:05:04,446", "thread_id": "4840", "caller": "0x7fff57fc42c4", "parentcaller": "0x7fff57fc3b55", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000229c" }, { "name": "DesiredAccess", "value": "0x001200a9", "pretty_value": "FILE_GENERIC_READ|FILE_GENERIC_EXECUTE" }, { "name": "FileName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 323 }, { "timestamp": "2026-05-29 01:05:04,446", "thread_id": "4840", "caller": "0x7fff57fc44a6", "parentcaller": "0x7fff57fc3b55", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x40000003", "arguments": [ { "name": "SectionHandle", "value": "0x0000215c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x12940000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00505000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 324 }, { "timestamp": "2026-05-29 01:05:04,446", "thread_id": "4668", "caller": "0x7fff432b643e", "parentcaller": "0x7fff432b8101", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "DE77BA04-3C92-4D11-A1A5-42352A53E0E3" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "7A3BD1D9-35A9-4FB3-A467-F48CAC35E2D0" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 325 }, { "timestamp": "2026-05-29 01:05:04,446", "thread_id": "4840", "caller": "0x7fff57fd607d", "parentcaller": "0x7fff57fc521b", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x001200a9", "pretty_value": "FILE_GENERIC_READ|FILE_GENERIC_EXECUTE" }, { "name": "FileName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe.Config" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 326 }, { "timestamp": "2026-05-29 01:05:04,446", "thread_id": "4840", "caller": "0x7fff57fc46a1", "parentcaller": "0x7fff57fc3b55", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x12940000" }, { "name": "RegionSize", "value": "0x00505000" } ], "repeated": 0, "id": 327 }, { "timestamp": "2026-05-29 01:05:04,446", "thread_id": "4840", "caller": "0x7fff59fd290d", "parentcaller": "0x7fff59f635db", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x07c50000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 328 }, { "timestamp": "2026-05-29 01:05:04,446", "thread_id": "4840", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022a4" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\program files (x86)\\microsoft\\Edge\\application\\msedge.exe" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 329 }, { "timestamp": "2026-05-29 01:05:04,446", "thread_id": "4840", "caller": "0x7fff577d7786", "parentcaller": "0x7fff577d5630", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x40000003", "arguments": [ { "name": "SectionHandle", "value": "0x000022a8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x13050000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00505000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 330 }, { "timestamp": "2026-05-29 01:05:04,446", "thread_id": "5096", "caller": "0x7fff57fd607d", "parentcaller": "0x7fff57fc521b", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x001200a9", "pretty_value": "FILE_GENERIC_READ|FILE_GENERIC_EXECUTE" }, { "name": "FileName", "value": "C:\\Program Files (x86)\\Steam\\Steam.exe.Config" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 331 }, { "timestamp": "2026-05-29 01:05:04,446", "thread_id": "5096", "caller": "0x7fff57fc46a1", "parentcaller": "0x7fff57fc3b55", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x12940000" }, { "name": "RegionSize", "value": "0x00708000" } ], "repeated": 0, "id": 332 }, { "timestamp": "2026-05-29 01:05:04,446", "thread_id": "5096", "caller": "0x7fff59fd290d", "parentcaller": "0x7fff59f635db", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x07c50000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 333 }, { "timestamp": "2026-05-29 01:05:04,446", "thread_id": "4840", "caller": "0x7fff577cad9e", "parentcaller": "0x7fff581cbc42", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x13050000" }, { "name": "RegionSize", "value": "0x00505000" } ], "repeated": 0, "id": 334 }, { "timestamp": "2026-05-29 01:05:04,446", "thread_id": "5096", "caller": "0x7fff58c1937a", "parentcaller": "0x7fff44ddb79d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "2155FEE3-2419-4373-B102-6843707EB41F" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "F676C15D-596A-4CE2-8234-33996F445DB1" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 335 }, { "timestamp": "2026-05-29 01:05:04,446", "thread_id": "5096", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff5809b531", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 336 }, { "timestamp": "2026-05-29 01:05:04,446", "thread_id": "4840", "caller": "0x7fff578186ed", "parentcaller": "0x7fff432b9455", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022a8" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "ShareAccess", "value": "0" } ], "repeated": 0, "id": 337 }, { "timestamp": "2026-05-29 01:05:04,446", "thread_id": "5096", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff5809b531", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x076d6488" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 338 }, { "timestamp": "2026-05-29 01:05:04,446", "thread_id": "4840", "caller": "0x7fff432c4639", "parentcaller": "0x7fff432c45ca", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "317D06E8-5F24-433D-BDF7-79CE68D8ABC2" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EC5EC8A9-C395-4314-9C77-54D7A935FF70" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 339 }, { "timestamp": "2026-05-29 01:05:04,446", "thread_id": "5096", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002288" }, { "name": "DesiredAccess", "value": "0xc0100080", "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 340 }, { "timestamp": "2026-05-29 01:05:04,446", "thread_id": "5096", "caller": "0x7fff432c1c19", "parentcaller": "0x7fff432c32af", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002288" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" }, { "name": "FileInformationClass", "value": "74" }, { "name": "FileInformation", "value": "\\x02\\x00\\x00\\x00" } ], "repeated": 0, "id": 341 }, { "timestamp": "2026-05-29 01:05:04,446", "thread_id": "5096", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000470" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x07c50000" }, { "name": "SectionOffset", "value": "0x0354eb50" }, { "name": "ViewSize", "value": "0x0000f000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 342 }, { "timestamp": "2026-05-29 01:05:04,446", "thread_id": "5096", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff432c1d16", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002288" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000235c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 343 }, { "timestamp": "2026-05-29 01:05:04,446", "thread_id": "5096", "caller": "0x7fff578186ed", "parentcaller": "0x7fff432b9455", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002280" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "ShareAccess", "value": "0" } ], "repeated": 0, "id": 344 }, { "timestamp": "2026-05-29 01:05:04,446", "thread_id": "5096", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002280" }, { "name": "DesiredAccess", "value": "0xc0100080", "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_48.db" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 345 }, { "timestamp": "2026-05-29 01:05:04,446", "thread_id": "5096", "caller": "0x7fff432c1c19", "parentcaller": "0x7fff432c1ae1", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002280" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_48.db" }, { "name": "FileInformationClass", "value": "74" }, { "name": "FileInformation", "value": "\\x02\\x00\\x00\\x00" } ], "repeated": 0, "id": 346 }, { "timestamp": "2026-05-29 01:05:04,446", "thread_id": "5096", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002360" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x12940000" }, { "name": "SectionOffset", "value": "0x0354ead0" }, { "name": "ViewSize", "value": "0x00100000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 347 }, { "timestamp": "2026-05-29 01:05:04,446", "thread_id": "5096", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff432c1d16", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002280" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002364" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 348 }, { "timestamp": "2026-05-29 01:05:04,446", "thread_id": "5096", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000470" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\program files (x86)\\Steam\\steam.exe" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 349 }, { "timestamp": "2026-05-29 01:05:04,446", "thread_id": "5096", "caller": "0x7fff577d7786", "parentcaller": "0x7fff577d5630", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x40000003", "arguments": [ { "name": "SectionHandle", "value": "0x00002278" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x12a40000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00708000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 350 }, { "timestamp": "2026-05-29 01:05:04,446", "thread_id": "5096", "caller": "0x7fff59f9bb2a", "parentcaller": "0x7fff59f9b99e", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc000003a", "pretty_return": "OBJECT_PATH_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\program files (x86)\\SystemResources\\steam.exe.mun" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 351 }, { "timestamp": "2026-05-29 01:05:04,446", "thread_id": "5096", "caller": "0x7fff577cad9e", "parentcaller": "0x7fff581cbc42", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x12a40000" }, { "name": "RegionSize", "value": "0x00708000" } ], "repeated": 0, "id": 352 }, { "timestamp": "2026-05-29 01:05:04,462", "thread_id": "5096", "caller": "0x7fff578186ed", "parentcaller": "0x7fff432b9455", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002278" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "ShareAccess", "value": "0" } ], "repeated": 0, "id": 353 }, { "timestamp": "2026-05-29 01:05:04,462", "thread_id": "5096", "caller": "0x7fff432c4639", "parentcaller": "0x7fff432c45ca", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "317D06E8-5F24-433D-BDF7-79CE68D8ABC2" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EC5EC8A9-C395-4314-9C77-54D7A935FF70" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 354 }, { "timestamp": "2026-05-29 01:05:04,462", "thread_id": "4140", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022d4" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 355 }, { "timestamp": "2026-05-29 01:05:04,462", "thread_id": "4488", "caller": "0x745e7ad39f58", "parentcaller": "0x00000000", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002348" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 356 }, { "timestamp": "2026-05-29 01:05:04,462", "thread_id": "4140", "caller": "0x7fff57fc42c4", "parentcaller": "0x7fff57fc3b55", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022d0" }, { "name": "DesiredAccess", "value": "0x001200a9", "pretty_value": "FILE_GENERIC_READ|FILE_GENERIC_EXECUTE" }, { "name": "FileName", "value": "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 357 }, { "timestamp": "2026-05-29 01:05:04,462", "thread_id": "4140", "caller": "0x7fff57fc44a6", "parentcaller": "0x7fff57fc3b55", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x40000003", "arguments": [ { "name": "SectionHandle", "value": "0x000022dc" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x12a40000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00421000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 358 }, { "timestamp": "2026-05-29 01:05:04,462", "thread_id": "4140", "caller": "0x7fff57fd607d", "parentcaller": "0x7fff57fc521b", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x001200a9", "pretty_value": "FILE_GENERIC_READ|FILE_GENERIC_EXECUTE" }, { "name": "FileName", "value": "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe.Config" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 359 }, { "timestamp": "2026-05-29 01:05:04,462", "thread_id": "4140", "caller": "0x7fff57fc46a1", "parentcaller": "0x7fff57fc3b55", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x12a40000" }, { "name": "RegionSize", "value": "0x00421000" } ], "repeated": 0, "id": 360 }, { "timestamp": "2026-05-29 01:05:04,462", "thread_id": "4140", "caller": "0x7fff59fd290d", "parentcaller": "0x7fff59f635db", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x07eb0000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 361 }, { "timestamp": "2026-05-29 01:05:04,462", "thread_id": "4140", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002310" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\program files\\Google\\Chrome\\application\\chrome.exe" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 362 }, { "timestamp": "2026-05-29 01:05:04,462", "thread_id": "4140", "caller": "0x7fff577d7786", "parentcaller": "0x7fff577d5630", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x40000003", "arguments": [ { "name": "SectionHandle", "value": "0x00002298" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x12a40000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00421000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 363 }, { "timestamp": "2026-05-29 01:05:04,462", "thread_id": "4140", "caller": "0x7fff59f9bb2a", "parentcaller": "0x7fff59f9b99e", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc000003a", "pretty_return": "OBJECT_PATH_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\program files\\Google\\Chrome\\SystemResources\\chrome.exe.mun" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 364 }, { "timestamp": "2026-05-29 01:05:04,462", "thread_id": "4140", "caller": "0x7fff577cad9e", "parentcaller": "0x7fff581cbc42", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x12a40000" }, { "name": "RegionSize", "value": "0x00421000" } ], "repeated": 0, "id": 365 }, { "timestamp": "2026-05-29 01:05:04,462", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x745e7ad34488", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0340F119-A598-4ED9-B0AC-6F6A12D3E755" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "7F73BE3F-FB79-493C-A6C7-7EE14E245841" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 366 }, { "timestamp": "2026-05-29 01:05:04,462", "thread_id": "4488", "caller": "0x745e7ad34158", "parentcaller": "0x00000000", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 367 }, { "timestamp": "2026-05-29 01:05:04,462", "thread_id": "4140", "caller": "0x7fff578186ed", "parentcaller": "0x7fff432b9455", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022dc" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "ShareAccess", "value": "0" } ], "repeated": 0, "id": 368 }, { "timestamp": "2026-05-29 01:05:04,462", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000323-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000146-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 369 }, { "timestamp": "2026-05-29 01:05:04,462", "thread_id": "4488", "caller": "0x745e7ad35b88", "parentcaller": "0x00000000", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 370 }, { "timestamp": "2026-05-29 01:05:04,462", "thread_id": "4140", "caller": "0x7fff432c4639", "parentcaller": "0x7fff432c45ca", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "317D06E8-5F24-433D-BDF7-79CE68D8ABC2" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EC5EC8A9-C395-4314-9C77-54D7A935FF70" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 371 }, { "timestamp": "2026-05-29 01:05:04,462", "thread_id": "4840", "caller": "0x7fff577d6bcf", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc00000ba", "pretty_return": "FILE_IS_A_DIRECTORY", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Desktop" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 372 }, { "timestamp": "2026-05-29 01:05:04,462", "thread_id": "4840", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002284" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Desktop\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 373 }, { "timestamp": "2026-05-29 01:05:04,462", "thread_id": "4668", "caller": "0x7fff558259d3", "parentcaller": "0x7fff55896922", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0E5AAE11-A475-4C5B-AB00-C66DE400274E" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 374 }, { "timestamp": "2026-05-29 01:05:04,462", "thread_id": "4840", "caller": "0x7fff577d6c28", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002284" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Desktop" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 375 }, { "timestamp": "2026-05-29 01:05:04,462", "thread_id": "4668", "caller": "0x7fff558259d3", "parentcaller": "0x7fff55896922", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0E5AAE11-A475-4C5B-AB00-C66DE400274E" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 376 }, { "timestamp": "2026-05-29 01:05:04,462", "thread_id": "4840", "caller": "0x7fff577d4d82", "parentcaller": "0x7fff577d6fe6", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002284" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Desktop" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 377 }, { "timestamp": "2026-05-29 01:05:04,462", "thread_id": "4840", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002284" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Desktop\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 378 }, { "timestamp": "2026-05-29 01:05:04,462", "thread_id": "4840", "caller": "0x7fff577d6bcf", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc00000ba", "pretty_return": "FILE_IS_A_DIRECTORY", "arguments": [ { "name": "FileHandle", "value": "0x00002284" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 379 }, { "timestamp": "2026-05-29 01:05:04,462", "thread_id": "4840", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002284" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 380 }, { "timestamp": "2026-05-29 01:05:04,462", "thread_id": "4840", "caller": "0x7fff577d6c28", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002284" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 1, "id": 381 }, { "timestamp": "2026-05-29 01:05:04,462", "thread_id": "4840", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002284" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 382 }, { "timestamp": "2026-05-29 01:05:04,462", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 383 }, { "timestamp": "2026-05-29 01:05:04,462", "thread_id": "4840", "caller": "0x7fff577d6bcf", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc00000ba", "pretty_return": "FILE_IS_A_DIRECTORY", "arguments": [ { "name": "FileHandle", "value": "0x00002284" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 384 }, { "timestamp": "2026-05-29 01:05:04,462", "thread_id": "4840", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002284" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 385 }, { "timestamp": "2026-05-29 01:05:04,462", "thread_id": "4840", "caller": "0x7fff577d6c28", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002284" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 1, "id": 386 }, { "timestamp": "2026-05-29 01:05:04,462", "thread_id": "4840", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002284" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 387 }, { "timestamp": "2026-05-29 01:05:04,462", "thread_id": "4840", "caller": "0x7fff577d4d82", "parentcaller": "0x7fff577d70c7", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002318" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 388 }, { "timestamp": "2026-05-29 01:05:04,462", "thread_id": "5096", "caller": "0x7fff55825882", "parentcaller": "0x7fff558495d3", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "FBF23B40-E3F0-101B-8488-00AA003E56F8" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "000214FA-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "InternetShortcut" } ], "repeated": 0, "id": 389 }, { "timestamp": "2026-05-29 01:05:04,462", "thread_id": "4840", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d4f8e", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002298" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\MountPointManager" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 390 }, { "timestamp": "2026-05-29 01:05:04,462", "thread_id": "4668", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000323-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000146-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 391 }, { "timestamp": "2026-05-29 01:05:04,462", "thread_id": "4668", "caller": "0x7fff5581d809", "parentcaller": "0x7fff5581d730", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0340F119-A598-4ED9-B0AC-6F6A12D3E755" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "7F73BE3F-FB79-493C-A6C7-7EE14E245841" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 392 }, { "timestamp": "2026-05-29 01:05:04,462", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "FBF23B40-E3F0-101B-8488-00AA003E56F8" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "000214FA-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "InternetShortcut" } ], "repeated": 0, "id": 393 }, { "timestamp": "2026-05-29 01:05:04,462", "thread_id": "4668", "caller": "0x7fff584cf303", "parentcaller": "0x7fff584ce7f3", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 394 }, { "timestamp": "2026-05-29 01:05:04,462", "thread_id": "4840", "caller": "0x7fff432b643e", "parentcaller": "0x7fff432b8101", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "DE77BA04-3C92-4D11-A1A5-42352A53E0E3" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "7A3BD1D9-35A9-4FB3-A467-F48CAC35E2D0" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 395 }, { "timestamp": "2026-05-29 01:05:04,462", "thread_id": "4140", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 396 }, { "timestamp": "2026-05-29 01:05:04,462", "thread_id": "4140", "caller": "0x7fff55825882", "parentcaller": "0x7fff558495d3", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "FBF23B40-E3F0-101B-8488-00AA003E56F8" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "000214FA-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "InternetShortcut" } ], "repeated": 0, "id": 397 }, { "timestamp": "2026-05-29 01:05:04,462", "thread_id": "4668", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022d0" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Discord\\Update.exe" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 398 }, { "timestamp": "2026-05-29 01:05:04,462", "thread_id": "4668", "caller": "0x7fff57fc42c4", "parentcaller": "0x7fff57fc3b55", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000215c" }, { "name": "DesiredAccess", "value": "0x001200a9", "pretty_value": "FILE_GENERIC_READ|FILE_GENERIC_EXECUTE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Discord\\Update.exe" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 399 }, { "timestamp": "2026-05-29 01:05:04,462", "thread_id": "4668", "caller": "0x7fff57fc44a6", "parentcaller": "0x7fff57fc3b55", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x4000000e", "arguments": [ { "name": "SectionHandle", "value": "0x0000229c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x12a40000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x0018a000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 400 }, { "timestamp": "2026-05-29 01:05:04,462", "thread_id": "4668", "caller": "0x7fff57fd607d", "parentcaller": "0x7fff57fc521b", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x001200a9", "pretty_value": "FILE_GENERIC_READ|FILE_GENERIC_EXECUTE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Discord\\Update.exe.Config" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 401 }, { "timestamp": "2026-05-29 01:05:04,462", "thread_id": "4668", "caller": "0x7fff57fc46a1", "parentcaller": "0x7fff57fc3b55", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x12a40000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 402 }, { "timestamp": "2026-05-29 01:05:04,462", "thread_id": "4668", "caller": "0x7fff59fd290d", "parentcaller": "0x7fff59f635db", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02ff0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 403 }, { "timestamp": "2026-05-29 01:05:04,462", "thread_id": "4668", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002318" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Discord\\app.ico" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 404 }, { "timestamp": "2026-05-29 01:05:04,477", "thread_id": "4668", "caller": "0x7fff577d7906", "parentcaller": "0x7fff5786babd", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002370" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0fa50000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00046000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 405 }, { "timestamp": "2026-05-29 01:05:04,477", "thread_id": "4668", "caller": "0x7fff5786c212", "parentcaller": "0x7fff5786babd", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0fa50000" }, { "name": "RegionSize", "value": "0x00046000" } ], "repeated": 0, "id": 406 }, { "timestamp": "2026-05-29 01:05:04,477", "thread_id": "4668", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002318" }, { "name": "DesiredAccess", "value": "0x80100180", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|FILE_WRITE_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Discord\\app.ico" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 407 }, { "timestamp": "2026-05-29 01:05:04,477", "thread_id": "4668", "caller": "0x7fff57826844", "parentcaller": "0x7fff581f26ab", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002318" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Discord\\app.ico" }, { "name": "FileInformationClass", "value": "4", "pretty_value": "FileBasicInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 408 }, { "timestamp": "2026-05-29 01:05:04,477", "thread_id": "4668", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002370" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Discord\\app.ico" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 409 }, { "timestamp": "2026-05-29 01:05:04,477", "thread_id": "4668", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000022dc" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0fa50000" }, { "name": "SectionOffset", "value": "0x033ad4b0" }, { "name": "ViewSize", "value": "0x00046000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 410 }, { "timestamp": "2026-05-29 01:05:04,477", "thread_id": "4840", "caller": "0x7fff577d6bcf", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc00000ba", "pretty_return": "FILE_IS_A_DIRECTORY", "arguments": [ { "name": "FileHandle", "value": "0x80028000" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 411 }, { "timestamp": "2026-05-29 01:05:04,477", "thread_id": "4840", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002340" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 412 }, { "timestamp": "2026-05-29 01:05:04,477", "thread_id": "4668", "caller": "0x7fff432c4639", "parentcaller": "0x7fff432c45ca", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "317D06E8-5F24-433D-BDF7-79CE68D8ABC2" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EC5EC8A9-C395-4314-9C77-54D7A935FF70" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 413 }, { "timestamp": "2026-05-29 01:05:04,477", "thread_id": "5096", "caller": "0x7fff41396d8c", "parentcaller": "0x7fff41378e23", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "06EEE834-461C-42C2-8DCF-1502B527B1F9" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "0000010B-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 414 }, { "timestamp": "2026-05-29 01:05:04,477", "thread_id": "4840", "caller": "0x7fff577d6c28", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002340" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 415 }, { "timestamp": "2026-05-29 01:05:04,477", "thread_id": "4668", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 416 }, { "timestamp": "2026-05-29 01:05:04,477", "thread_id": "4840", "caller": "0x7fff577d4d82", "parentcaller": "0x7fff577d6fe6", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002340" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 417 }, { "timestamp": "2026-05-29 01:05:04,477", "thread_id": "4840", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002340" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 418 }, { "timestamp": "2026-05-29 01:05:04,477", "thread_id": "4840", "caller": "0x7fff577d6bcf", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc00000ba", "pretty_return": "FILE_IS_A_DIRECTORY", "arguments": [ { "name": "FileHandle", "value": "0x00002340" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 419 }, { "timestamp": "2026-05-29 01:05:04,477", "thread_id": "4840", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002340" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 420 }, { "timestamp": "2026-05-29 01:05:04,477", "thread_id": "4840", "caller": "0x7fff577d6c28", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002340" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 421 }, { "timestamp": "2026-05-29 01:05:04,477", "thread_id": "4140", "caller": "0x7fff41396d8c", "parentcaller": "0x7fff41281ead", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "942BC614-676C-464E-B384-D3202AAA02DA" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000000-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 422 }, { "timestamp": "2026-05-29 01:05:04,477", "thread_id": "4840", "caller": "0x7fff577d4d82", "parentcaller": "0x7fff577d6fe6", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002340" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 423 }, { "timestamp": "2026-05-29 01:05:04,477", "thread_id": "4140", "caller": "0x7fff577d6579", "parentcaller": "0x7fff5781c32f", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022d8" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Desktop\\WhatsApp Web.url" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 424 }, { "timestamp": "2026-05-29 01:05:04,477", "thread_id": "4840", "caller": "0x7fff577d6bcf", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc00000ba", "pretty_return": "FILE_IS_A_DIRECTORY", "arguments": [ { "name": "FileHandle", "value": "0x00002340" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 425 }, { "timestamp": "2026-05-29 01:05:04,477", "thread_id": "5096", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff577ce6a1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\Secur32" }, { "name": "DllBase", "value": "0x7fff48330000" } ], "repeated": 0, "id": 426 }, { "timestamp": "2026-05-29 01:05:04,477", "thread_id": "4668", "caller": "0x7fff41396d8c", "parentcaller": "0x7fff41281ead", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "942BC614-676C-464E-B384-D3202AAA02DA" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000000-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 427 }, { "timestamp": "2026-05-29 01:05:04,477", "thread_id": "4840", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002378" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 428 }, { "timestamp": "2026-05-29 01:05:04,477", "thread_id": "4840", "caller": "0x7fff577d6c28", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002378" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 1, "id": 429 }, { "timestamp": "2026-05-29 01:05:04,477", "thread_id": "4840", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002378" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 430 }, { "timestamp": "2026-05-29 01:05:04,477", "thread_id": "4840", "caller": "0x7fff577d4d82", "parentcaller": "0x7fff577d70c7", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002378" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 431 }, { "timestamp": "2026-05-29 01:05:04,477", "thread_id": "4840", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d4f8e", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002378" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\MountPointManager" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 432 }, { "timestamp": "2026-05-29 01:05:04,477", "thread_id": "4840", "caller": "0x7fff432b643e", "parentcaller": "0x7fff432b8101", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "DE77BA04-3C92-4D11-A1A5-42352A53E0E3" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "7A3BD1D9-35A9-4FB3-A467-F48CAC35E2D0" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 433 }, { "timestamp": "2026-05-29 01:05:04,477", "thread_id": "5096", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff577ce6a1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "Secur32.dll" }, { "name": "BaseAddress", "value": "0x7fff48330000" } ], "repeated": 0, "id": 434 }, { "timestamp": "2026-05-29 01:05:04,477", "thread_id": "5096", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff577ce6a1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\MLANG" }, { "name": "DllBase", "value": "0x7fff54ae0000" } ], "repeated": 0, "id": 435 }, { "timestamp": "2026-05-29 01:05:04,477", "thread_id": "4840", "caller": "0x7fff577d6bcf", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc00000ba", "pretty_return": "FILE_IS_A_DIRECTORY", "arguments": [ { "name": "FileHandle", "value": "0x80028000" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Desktop" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 436 }, { "timestamp": "2026-05-29 01:05:04,477", "thread_id": "5096", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff577ce6a1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "MLANG.dll" }, { "name": "BaseAddress", "value": "0x7fff54ae0000" } ], "repeated": 0, "id": 437 }, { "timestamp": "2026-05-29 01:05:04,477", "thread_id": "4140", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff577ce6a1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "WININET.dll" }, { "name": "BaseAddress", "value": "0x7fff48b40000" } ], "repeated": 1, "id": 438 }, { "timestamp": "2026-05-29 01:05:04,477", "thread_id": "4840", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022d8" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Desktop\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 439 }, { "timestamp": "2026-05-29 01:05:04,477", "thread_id": "4140", "caller": "0x7fff59fc1963", "parentcaller": "0x7fff59fc1798", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0125e000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 440 }, { "timestamp": "2026-05-29 01:05:04,477", "thread_id": "4840", "caller": "0x7fff577d6c28", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022ac" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Desktop" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 1, "id": 441 }, { "timestamp": "2026-05-29 01:05:04,477", "thread_id": "4140", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff4137cea7", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" }, { "name": "BaseAddress", "value": "0x7fff584a0000" } ], "repeated": 0, "id": 442 }, { "timestamp": "2026-05-29 01:05:04,477", "thread_id": "4840", "caller": "0x7fff577d6c28", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022ac" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 443 }, { "timestamp": "2026-05-29 01:05:04,477", "thread_id": "5096", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x013402cc" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Internet Explorer\\frameiconcache.dat" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 444 }, { "timestamp": "2026-05-29 01:05:04,477", "thread_id": "4840", "caller": "0x7fff577d6bcf", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc00000ba", "pretty_return": "FILE_IS_A_DIRECTORY", "arguments": [ { "name": "FileHandle", "value": "0x000022ac" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 445 }, { "timestamp": "2026-05-29 01:05:04,477", "thread_id": "5096", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x013402cc" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Internet Explorer\\tabiconcache.dat" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 446 }, { "timestamp": "2026-05-29 01:05:04,477", "thread_id": "4840", "caller": "0x7fff577d4d82", "parentcaller": "0x7fff577d6fe6", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022ac" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 447 }, { "timestamp": "2026-05-29 01:05:04,477", "thread_id": "5096", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x013402cc" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Internet Explorer\\largeiconcache.dat" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 448 }, { "timestamp": "2026-05-29 01:05:04,477", "thread_id": "4840", "caller": "0x7fff577d4d82", "parentcaller": "0x7fff577d70c7", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022ac" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 449 }, { "timestamp": "2026-05-29 01:05:04,477", "thread_id": "5096", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x013402cc" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Internet Explorer\\immersiveiconcache.dat" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 450 }, { "timestamp": "2026-05-29 01:05:04,477", "thread_id": "4840", "caller": "0x7fff432b643e", "parentcaller": "0x7fff432b8101", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "DE77BA04-3C92-4D11-A1A5-42352A53E0E3" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "7A3BD1D9-35A9-4FB3-A467-F48CAC35E2D0" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 451 }, { "timestamp": "2026-05-29 01:05:04,477", "thread_id": "5096", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x013402cc" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Internet Explorer\\imdockediconcache.dat" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 452 }, { "timestamp": "2026-05-29 01:05:04,477", "thread_id": "5096", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x013402cc" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Internet Explorer\\imtilelargeiconcache.dat" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 453 }, { "timestamp": "2026-05-29 01:05:04,477", "thread_id": "5096", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x013402cc" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Internet Explorer\\imtilesmalliconcache.dat" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 454 }, { "timestamp": "2026-05-29 01:05:04,493", "thread_id": "4140", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022f4" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\program files\\Google\\Chrome\\application\\chrome.exe" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 455 }, { "timestamp": "2026-05-29 01:05:04,493", "thread_id": "4140", "caller": "0x7fff577d7786", "parentcaller": "0x7fff577d5630", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x40000003", "arguments": [ { "name": "SectionHandle", "value": "0x000022ec" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x12e70000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00421000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 456 }, { "timestamp": "2026-05-29 01:05:04,493", "thread_id": "5096", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022b0" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\program files\\Google\\Chrome\\application\\chrome.exe" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 457 }, { "timestamp": "2026-05-29 01:05:04,493", "thread_id": "5096", "caller": "0x7fff577d7786", "parentcaller": "0x7fff577d5630", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x40000003", "arguments": [ { "name": "SectionHandle", "value": "0x000022a0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x132a0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00421000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 458 }, { "timestamp": "2026-05-29 01:05:04,493", "thread_id": "4140", "caller": "0x7fff59f9bb2a", "parentcaller": "0x7fff59f9b99e", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc000003a", "pretty_return": "OBJECT_PATH_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\program files\\Google\\Chrome\\SystemResources\\chrome.exe.mun" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 1, "id": 459 }, { "timestamp": "2026-05-29 01:05:04,493", "thread_id": "5096", "caller": "0x7fff577cad9e", "parentcaller": "0x7fff581cbc42", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x132a0000" }, { "name": "RegionSize", "value": "0x00421000" } ], "repeated": 0, "id": 460 }, { "timestamp": "2026-05-29 01:05:04,493", "thread_id": "4668", "caller": "0x7fff578186ed", "parentcaller": "0x7fff432b9455", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000237c" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "ShareAccess", "value": "0" } ], "repeated": 0, "id": 461 }, { "timestamp": "2026-05-29 01:05:04,493", "thread_id": "4140", "caller": "0x7fff578186ed", "parentcaller": "0x7fff432b9455", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022ec" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "ShareAccess", "value": "0" } ], "repeated": 0, "id": 462 }, { "timestamp": "2026-05-29 01:05:04,493", "thread_id": "5096", "caller": "0x7fff578186ed", "parentcaller": "0x7fff432b9455", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022a0" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "ShareAccess", "value": "0" } ], "repeated": 0, "id": 463 }, { "timestamp": "2026-05-29 01:05:04,493", "thread_id": "4668", "caller": "0x7fff432c4639", "parentcaller": "0x7fff432c45ca", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "317D06E8-5F24-433D-BDF7-79CE68D8ABC2" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EC5EC8A9-C395-4314-9C77-54D7A935FF70" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 464 }, { "timestamp": "2026-05-29 01:05:04,571", "thread_id": "5100", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 465 }, { "timestamp": "2026-05-29 01:05:04,571", "thread_id": "5100", "caller": "0x7fff432c5ded", "parentcaller": "0x7fff432c56be", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "AB8902B4-09CA-4BB6-B78D-A8F59079A8D5" }, { "name": "ClsContext", "value": "0x00004004", "pretty_value": "CLSCTX_LOCAL_SERVER|CLSCTX_NO_FAILURE_LOG" }, { "name": "riid", "value": "75121952-E0D0-43E5-9380-1D80483ACF72" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 466 }, { "timestamp": "2026-05-29 01:05:04,571", "thread_id": "5100", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 1, "id": 467 }, { "timestamp": "2026-05-29 01:05:04,571", "thread_id": "5100", "caller": "0x7fff578186ed", "parentcaller": "0x7fff432b9455", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022dc" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "ShareAccess", "value": "0" } ], "repeated": 0, "id": 468 }, { "timestamp": "2026-05-29 01:05:04,571", "thread_id": "4840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 469 }, { "timestamp": "2026-05-29 01:05:04,571", "thread_id": "4840", "caller": "0x7fff432c5ded", "parentcaller": "0x7fff432c56be", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "AB8902B4-09CA-4BB6-B78D-A8F59079A8D5" }, { "name": "ClsContext", "value": "0x00004004", "pretty_value": "CLSCTX_LOCAL_SERVER|CLSCTX_NO_FAILURE_LOG" }, { "name": "riid", "value": "75121952-E0D0-43E5-9380-1D80483ACF72" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 470 }, { "timestamp": "2026-05-29 01:05:04,571", "thread_id": "4840", "caller": "0x7fff578186ed", "parentcaller": "0x7fff432b9455", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000231c" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "ShareAccess", "value": "0" } ], "repeated": 0, "id": 471 }, { "timestamp": "2026-05-29 01:05:04,571", "thread_id": "4840", "caller": "0x7fff577d6bcf", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc00000ba", "pretty_return": "FILE_IS_A_DIRECTORY", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 472 }, { "timestamp": "2026-05-29 01:05:04,571", "thread_id": "4840", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000237c" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 473 }, { "timestamp": "2026-05-29 01:05:04,571", "thread_id": "4840", "caller": "0x7fff577d6c28", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000237c" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 1, "id": 474 }, { "timestamp": "2026-05-29 01:05:04,571", "thread_id": "4840", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000237c" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 475 }, { "timestamp": "2026-05-29 01:05:04,571", "thread_id": "4840", "caller": "0x7fff577d6bcf", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc00000ba", "pretty_return": "FILE_IS_A_DIRECTORY", "arguments": [ { "name": "FileHandle", "value": "0x0000237c" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 476 }, { "timestamp": "2026-05-29 01:05:04,571", "thread_id": "4840", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000237c" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 477 }, { "timestamp": "2026-05-29 01:05:04,571", "thread_id": "4840", "caller": "0x7fff577d6c28", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000237c" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 1, "id": 478 }, { "timestamp": "2026-05-29 01:05:04,571", "thread_id": "4840", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000237c" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 479 }, { "timestamp": "2026-05-29 01:05:04,571", "thread_id": "4840", "caller": "0x7fff577d6bcf", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc00000ba", "pretty_return": "FILE_IS_A_DIRECTORY", "arguments": [ { "name": "FileHandle", "value": "0x0000237c" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 480 }, { "timestamp": "2026-05-29 01:05:04,571", "thread_id": "4840", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000237c" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 481 }, { "timestamp": "2026-05-29 01:05:04,571", "thread_id": "4840", "caller": "0x7fff577d6c28", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000237c" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 1, "id": 482 }, { "timestamp": "2026-05-29 01:05:04,571", "thread_id": "4840", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000237c" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 483 }, { "timestamp": "2026-05-29 01:05:04,571", "thread_id": "4840", "caller": "0x7fff577d4d82", "parentcaller": "0x7fff577d70c7", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000237c" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 484 }, { "timestamp": "2026-05-29 01:05:04,571", "thread_id": "4840", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d4f8e", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000237c" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\MountPointManager" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 485 }, { "timestamp": "2026-05-29 01:05:04,571", "thread_id": "4840", "caller": "0x7fff432b643e", "parentcaller": "0x7fff432b8101", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "DE77BA04-3C92-4D11-A1A5-42352A53E0E3" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "7A3BD1D9-35A9-4FB3-A467-F48CAC35E2D0" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 486 }, { "timestamp": "2026-05-29 01:05:04,571", "thread_id": "4840", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022dc" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop\\Google Chrome.lnk" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 487 }, { "timestamp": "2026-05-29 01:05:04,571", "thread_id": "4840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 488 }, { "timestamp": "2026-05-29 01:05:04,571", "thread_id": "4840", "caller": "0x7fff432c5ded", "parentcaller": "0x7fff432c56be", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "AB8902B4-09CA-4BB6-B78D-A8F59079A8D5" }, { "name": "ClsContext", "value": "0x00004004", "pretty_value": "CLSCTX_LOCAL_SERVER|CLSCTX_NO_FAILURE_LOG" }, { "name": "riid", "value": "75121952-E0D0-43E5-9380-1D80483ACF72" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 489 }, { "timestamp": "2026-05-29 01:05:04,571", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 490 }, { "timestamp": "2026-05-29 01:05:04,571", "thread_id": "4840", "caller": "0x7fff5807c5e9", "parentcaller": "0x7fff5807fc58", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "E2EB4CA4-C96E-4DA4-94B1-673C8334A5BB" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "265CFCAA-9B0C-44CA-996F-4A6F6620C72D" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 491 }, { "timestamp": "2026-05-29 01:05:04,571", "thread_id": "4840", "caller": "0x7fff577d6579", "parentcaller": "0x7fff5781c32f", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022e4" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop\\Google Chrome.lnk" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 492 }, { "timestamp": "2026-05-29 01:05:04,571", "thread_id": "4840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff58096fcb", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000022e4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000022b0" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 493 }, { "timestamp": "2026-05-29 01:05:04,571", "thread_id": "4840", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022c8" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop\\Google Chrome.lnk" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 494 }, { "timestamp": "2026-05-29 01:05:04,571", "thread_id": "4840", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000227c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02ff0000" }, { "name": "SectionOffset", "value": "0x07fcd5f0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 495 }, { "timestamp": "2026-05-29 01:05:04,571", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 496 }, { "timestamp": "2026-05-29 01:05:04,587", "thread_id": "4840", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002314" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop\\Google Chrome.lnk" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 497 }, { "timestamp": "2026-05-29 01:05:04,587", "thread_id": "4840", "caller": "0x7fff578186ed", "parentcaller": "0x7fff432b9455", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002348" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "ShareAccess", "value": "0" } ], "repeated": 0, "id": 498 }, { "timestamp": "2026-05-29 01:05:04,587", "thread_id": "4840", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000237c" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop\\Microsoft Edge.lnk" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 499 }, { "timestamp": "2026-05-29 01:05:04,587", "thread_id": "4840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 500 }, { "timestamp": "2026-05-29 01:05:04,587", "thread_id": "4840", "caller": "0x7fff432c5ded", "parentcaller": "0x7fff432c56be", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "AB8902B4-09CA-4BB6-B78D-A8F59079A8D5" }, { "name": "ClsContext", "value": "0x00004004", "pretty_value": "CLSCTX_LOCAL_SERVER|CLSCTX_NO_FAILURE_LOG" }, { "name": "riid", "value": "75121952-E0D0-43E5-9380-1D80483ACF72" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 501 }, { "timestamp": "2026-05-29 01:05:04,587", "thread_id": "4840", "caller": "0x7fff5807c5e9", "parentcaller": "0x7fff5807fc58", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "E2EB4CA4-C96E-4DA4-94B1-673C8334A5BB" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "265CFCAA-9B0C-44CA-996F-4A6F6620C72D" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 502 }, { "timestamp": "2026-05-29 01:05:04,587", "thread_id": "4840", "caller": "0x7fff577d6579", "parentcaller": "0x7fff5781c32f", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022ac" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop\\Microsoft Edge.lnk" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 503 }, { "timestamp": "2026-05-29 01:05:04,587", "thread_id": "4840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff58096fcb", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000022ac" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000022b4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 504 }, { "timestamp": "2026-05-29 01:05:04,587", "thread_id": "4840", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022c8" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop\\Microsoft Edge.lnk" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 505 }, { "timestamp": "2026-05-29 01:05:04,587", "thread_id": "4840", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000227c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02ff0000" }, { "name": "SectionOffset", "value": "0x07fcd5f0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 506 }, { "timestamp": "2026-05-29 01:05:04,587", "thread_id": "4840", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022e4" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop\\Microsoft Edge.lnk" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 507 }, { "timestamp": "2026-05-29 01:05:04,587", "thread_id": "4840", "caller": "0x7fff578186ed", "parentcaller": "0x7fff432b9455", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022a0" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "ShareAccess", "value": "0" } ], "repeated": 0, "id": 508 }, { "timestamp": "2026-05-29 01:05:04,587", "thread_id": "4840", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000237c" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop\\Steam.lnk" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 509 }, { "timestamp": "2026-05-29 01:05:04,587", "thread_id": "4840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 510 }, { "timestamp": "2026-05-29 01:05:04,587", "thread_id": "4840", "caller": "0x7fff432c5ded", "parentcaller": "0x7fff432c56be", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "AB8902B4-09CA-4BB6-B78D-A8F59079A8D5" }, { "name": "ClsContext", "value": "0x00004004", "pretty_value": "CLSCTX_LOCAL_SERVER|CLSCTX_NO_FAILURE_LOG" }, { "name": "riid", "value": "75121952-E0D0-43E5-9380-1D80483ACF72" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 511 }, { "timestamp": "2026-05-29 01:05:04,587", "thread_id": "4840", "caller": "0x7fff5807c5e9", "parentcaller": "0x7fff5807fc58", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "E2EB4CA4-C96E-4DA4-94B1-673C8334A5BB" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "265CFCAA-9B0C-44CA-996F-4A6F6620C72D" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 512 }, { "timestamp": "2026-05-29 01:05:04,587", "thread_id": "4840", "caller": "0x7fff577d6579", "parentcaller": "0x7fff5781c32f", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022c0" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop\\Steam.lnk" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 513 }, { "timestamp": "2026-05-29 01:05:04,587", "thread_id": "4840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff58096fcb", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000022c0" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000022b0" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 514 }, { "timestamp": "2026-05-29 01:05:04,587", "thread_id": "4840", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022c8" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop\\Steam.lnk" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 515 }, { "timestamp": "2026-05-29 01:05:04,587", "thread_id": "4840", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000227c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02ff0000" }, { "name": "SectionOffset", "value": "0x07fcd5f0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 516 }, { "timestamp": "2026-05-29 01:05:04,587", "thread_id": "4840", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000237c" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop\\Steam.lnk" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 517 }, { "timestamp": "2026-05-29 01:05:04,587", "thread_id": "4840", "caller": "0x7fff578186ed", "parentcaller": "0x7fff432b9455", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002314" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "ShareAccess", "value": "0" } ], "repeated": 0, "id": 518 }, { "timestamp": "2026-05-29 01:05:04,587", "thread_id": "4840", "caller": "0x7fff577d6bcf", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc00000ba", "pretty_return": "FILE_IS_A_DIRECTORY", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Desktop" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 519 }, { "timestamp": "2026-05-29 01:05:04,587", "thread_id": "4840", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022dc" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Desktop\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 520 }, { "timestamp": "2026-05-29 01:05:04,587", "thread_id": "4840", "caller": "0x7fff577d6c28", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022dc" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Desktop" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 1, "id": 521 }, { "timestamp": "2026-05-29 01:05:04,602", "thread_id": "4840", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022dc" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Desktop\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 522 }, { "timestamp": "2026-05-29 01:05:04,602", "thread_id": "4840", "caller": "0x7fff577d6bcf", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc00000ba", "pretty_return": "FILE_IS_A_DIRECTORY", "arguments": [ { "name": "FileHandle", "value": "0x000022dc" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 523 }, { "timestamp": "2026-05-29 01:05:04,602", "thread_id": "4840", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022dc" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 524 }, { "timestamp": "2026-05-29 01:05:04,602", "thread_id": "4840", "caller": "0x7fff577d6c28", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022dc" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 1, "id": 525 }, { "timestamp": "2026-05-29 01:05:04,602", "thread_id": "4840", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022dc" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 526 }, { "timestamp": "2026-05-29 01:05:04,602", "thread_id": "4840", "caller": "0x7fff577d6bcf", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc00000ba", "pretty_return": "FILE_IS_A_DIRECTORY", "arguments": [ { "name": "FileHandle", "value": "0x000022dc" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 527 }, { "timestamp": "2026-05-29 01:05:04,602", "thread_id": "4840", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022dc" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 528 }, { "timestamp": "2026-05-29 01:05:04,602", "thread_id": "4840", "caller": "0x7fff577d6c28", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022dc" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 1, "id": 529 }, { "timestamp": "2026-05-29 01:05:04,602", "thread_id": "4840", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022dc" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 530 }, { "timestamp": "2026-05-29 01:05:04,602", "thread_id": "4840", "caller": "0x7fff577d4d82", "parentcaller": "0x7fff577d70c7", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022dc" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 531 }, { "timestamp": "2026-05-29 01:05:04,602", "thread_id": "4840", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d4f8e", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022dc" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\MountPointManager" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 532 }, { "timestamp": "2026-05-29 01:05:04,602", "thread_id": "4840", "caller": "0x7fff432b643e", "parentcaller": "0x7fff432b8101", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "DE77BA04-3C92-4D11-A1A5-42352A53E0E3" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "7A3BD1D9-35A9-4FB3-A467-F48CAC35E2D0" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 533 }, { "timestamp": "2026-05-29 01:05:04,602", "thread_id": "4840", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022dc" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Desktop\\Discord.lnk" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 534 }, { "timestamp": "2026-05-29 01:05:04,602", "thread_id": "4840", "caller": "0x7fff558259d3", "parentcaller": "0x7fff55896922", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0E5AAE11-A475-4C5B-AB00-C66DE400274E" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 535 }, { "timestamp": "2026-05-29 01:05:04,602", "thread_id": "4840", "caller": "0x7fff55824fbc", "parentcaller": "0x7fff5581f4db", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000323-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000146-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 536 }, { "timestamp": "2026-05-29 01:05:04,602", "thread_id": "4840", "caller": "0x7fff5581d809", "parentcaller": "0x7fff5581d730", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0340F119-A598-4ED9-B0AC-6F6A12D3E755" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "7F73BE3F-FB79-493C-A6C7-7EE14E245841" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 537 }, { "timestamp": "2026-05-29 01:05:04,602", "thread_id": "4840", "caller": "0x7fff584cf303", "parentcaller": "0x7fff584ce7f3", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 538 }, { "timestamp": "2026-05-29 01:05:04,602", "thread_id": "4840", "caller": "0x7fff558259d3", "parentcaller": "0x7fff55896922", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0E5AAE11-A475-4C5B-AB00-C66DE400274E" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 539 }, { "timestamp": "2026-05-29 01:05:04,602", "thread_id": "4840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 540 }, { "timestamp": "2026-05-29 01:05:04,602", "thread_id": "4840", "caller": "0x7fff432c5ded", "parentcaller": "0x7fff432c56be", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "AB8902B4-09CA-4BB6-B78D-A8F59079A8D5" }, { "name": "ClsContext", "value": "0x00004004", "pretty_value": "CLSCTX_LOCAL_SERVER|CLSCTX_NO_FAILURE_LOG" }, { "name": "riid", "value": "75121952-E0D0-43E5-9380-1D80483ACF72" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 541 }, { "timestamp": "2026-05-29 01:05:04,602", "thread_id": "4840", "caller": "0x7fff5807c5e9", "parentcaller": "0x7fff5807fc58", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "E2EB4CA4-C96E-4DA4-94B1-673C8334A5BB" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "265CFCAA-9B0C-44CA-996F-4A6F6620C72D" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 542 }, { "timestamp": "2026-05-29 01:05:04,602", "thread_id": "4840", "caller": "0x7fff577d6579", "parentcaller": "0x7fff5781c32f", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022dc" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Desktop\\Discord.lnk" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 543 }, { "timestamp": "2026-05-29 01:05:04,602", "thread_id": "4840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff58096fcb", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000022dc" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000231c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 544 }, { "timestamp": "2026-05-29 01:05:04,602", "thread_id": "4840", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022e4" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Desktop\\Discord.lnk" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 545 }, { "timestamp": "2026-05-29 01:05:04,602", "thread_id": "4840", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002348" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02ff0000" }, { "name": "SectionOffset", "value": "0x07fcd5f0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 546 }, { "timestamp": "2026-05-29 01:05:04,602", "thread_id": "4840", "caller": "0x7fff558259d3", "parentcaller": "0x7fff55896922", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0E5AAE11-A475-4C5B-AB00-C66DE400274E" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 547 }, { "timestamp": "2026-05-29 01:05:04,602", "thread_id": "4840", "caller": "0x7fff55824fbc", "parentcaller": "0x7fff5581f4db", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000323-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000146-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 548 }, { "timestamp": "2026-05-29 01:05:04,602", "thread_id": "4840", "caller": "0x7fff5581d809", "parentcaller": "0x7fff5581d730", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0340F119-A598-4ED9-B0AC-6F6A12D3E755" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "7F73BE3F-FB79-493C-A6C7-7EE14E245841" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 549 }, { "timestamp": "2026-05-29 01:05:04,602", "thread_id": "4840", "caller": "0x7fff584cf303", "parentcaller": "0x7fff584ce7f3", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 550 }, { "timestamp": "2026-05-29 01:05:04,602", "thread_id": "4840", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000236c" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Desktop\\Discord.lnk" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 551 }, { "timestamp": "2026-05-29 01:05:04,602", "thread_id": "4840", "caller": "0x7fff558259d3", "parentcaller": "0x7fff55896922", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0E5AAE11-A475-4C5B-AB00-C66DE400274E" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 552 }, { "timestamp": "2026-05-29 01:05:04,602", "thread_id": "4840", "caller": "0x7fff55824fbc", "parentcaller": "0x7fff5581f4db", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000323-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000146-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 553 }, { "timestamp": "2026-05-29 01:05:04,618", "thread_id": "4840", "caller": "0x7fff5581d809", "parentcaller": "0x7fff5581d730", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0340F119-A598-4ED9-B0AC-6F6A12D3E755" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "7F73BE3F-FB79-493C-A6C7-7EE14E245841" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 554 }, { "timestamp": "2026-05-29 01:05:04,618", "thread_id": "4840", "caller": "0x7fff584cf303", "parentcaller": "0x7fff584ce7f3", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 555 }, { "timestamp": "2026-05-29 01:05:04,618", "thread_id": "4840", "caller": "0x7fff558259d3", "parentcaller": "0x7fff55896922", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0E5AAE11-A475-4C5B-AB00-C66DE400274E" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 556 }, { "timestamp": "2026-05-29 01:05:04,618", "thread_id": "4840", "caller": "0x7fff578186ed", "parentcaller": "0x7fff432b9455", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022d0" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "ShareAccess", "value": "0" } ], "repeated": 0, "id": 557 }, { "timestamp": "2026-05-29 01:05:04,618", "thread_id": "4840", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 558 }, { "timestamp": "2026-05-29 01:05:04,618", "thread_id": "4840", "caller": "0x7fff55825882", "parentcaller": "0x7fff558495d3", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "FBF23B40-E3F0-101B-8488-00AA003E56F8" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "000214F9-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "InternetShortcut" } ], "repeated": 0, "id": 559 }, { "timestamp": "2026-05-29 01:05:04,618", "thread_id": "4840", "caller": "0x7fff41396d8c", "parentcaller": "0x7fff41281ead", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "942BC614-676C-464E-B384-D3202AAA02DA" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000000-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 560 }, { "timestamp": "2026-05-29 01:05:04,618", "thread_id": "4840", "caller": "0x7fff41396d8c", "parentcaller": "0x7fff41378e23", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "06EEE834-461C-42C2-8DCF-1502B527B1F9" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "0000010B-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 561 }, { "timestamp": "2026-05-29 01:05:04,618", "thread_id": "4840", "caller": "0x7fff4136a287", "parentcaller": "0x7fff41378e41", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "4DFED3F9-B794-4D3C-973B-DDA1C28105A9" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "B7F02995-84DD-4F19-970A-1625E95C8BD0" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 562 }, { "timestamp": "2026-05-29 01:05:04,618", "thread_id": "4840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 563 }, { "timestamp": "2026-05-29 01:05:04,618", "thread_id": "4840", "caller": "0x7fff432c5ded", "parentcaller": "0x7fff432c56be", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "AB8902B4-09CA-4BB6-B78D-A8F59079A8D5" }, { "name": "ClsContext", "value": "0x00004004", "pretty_value": "CLSCTX_LOCAL_SERVER|CLSCTX_NO_FAILURE_LOG" }, { "name": "riid", "value": "75121952-E0D0-43E5-9380-1D80483ACF72" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 564 }, { "timestamp": "2026-05-29 01:05:04,618", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 565 }, { "timestamp": "2026-05-29 01:05:04,618", "thread_id": "4840", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 566 }, { "timestamp": "2026-05-29 01:05:04,618", "thread_id": "4840", "caller": "0x7fff55825882", "parentcaller": "0x7fff558495d3", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "FBF23B40-E3F0-101B-8488-00AA003E56F8" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "000214F9-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "InternetShortcut" } ], "repeated": 0, "id": 567 }, { "timestamp": "2026-05-29 01:05:04,618", "thread_id": "4840", "caller": "0x7fff41396d8c", "parentcaller": "0x7fff41281ead", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "942BC614-676C-464E-B384-D3202AAA02DA" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000000-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 568 }, { "timestamp": "2026-05-29 01:05:04,618", "thread_id": "4840", "caller": "0x7fff41396d8c", "parentcaller": "0x7fff41378e23", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "06EEE834-461C-42C2-8DCF-1502B527B1F9" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "0000010B-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 569 }, { "timestamp": "2026-05-29 01:05:04,618", "thread_id": "4840", "caller": "0x7fff4136a287", "parentcaller": "0x7fff41378e41", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "4DFED3F9-B794-4D3C-973B-DDA1C28105A9" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "B7F02995-84DD-4F19-970A-1625E95C8BD0" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 570 }, { "timestamp": "2026-05-29 01:05:04,618", "thread_id": "4840", "caller": "0x7fff578186ed", "parentcaller": "0x7fff432b9455", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000236c" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "ShareAccess", "value": "0" } ], "repeated": 0, "id": 571 }, { "timestamp": "2026-05-29 01:05:04,618", "thread_id": "4840", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 572 }, { "timestamp": "2026-05-29 01:05:04,618", "thread_id": "4840", "caller": "0x7fff55825882", "parentcaller": "0x7fff558495d3", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "FBF23B40-E3F0-101B-8488-00AA003E56F8" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "000214F9-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "InternetShortcut" } ], "repeated": 0, "id": 573 }, { "timestamp": "2026-05-29 01:05:04,618", "thread_id": "4840", "caller": "0x7fff41396d8c", "parentcaller": "0x7fff41281ead", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "942BC614-676C-464E-B384-D3202AAA02DA" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000000-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 574 }, { "timestamp": "2026-05-29 01:05:04,618", "thread_id": "4840", "caller": "0x7fff41396d8c", "parentcaller": "0x7fff41378e23", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "06EEE834-461C-42C2-8DCF-1502B527B1F9" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "0000010B-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 575 }, { "timestamp": "2026-05-29 01:05:04,618", "thread_id": "4840", "caller": "0x7fff4136a287", "parentcaller": "0x7fff41378e41", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "4DFED3F9-B794-4D3C-973B-DDA1C28105A9" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "B7F02995-84DD-4F19-970A-1625E95C8BD0" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 576 }, { "timestamp": "2026-05-29 01:05:04,618", "thread_id": "4840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 577 }, { "timestamp": "2026-05-29 01:05:04,618", "thread_id": "4840", "caller": "0x7fff432c5ded", "parentcaller": "0x7fff432c56be", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "AB8902B4-09CA-4BB6-B78D-A8F59079A8D5" }, { "name": "ClsContext", "value": "0x00004004", "pretty_value": "CLSCTX_LOCAL_SERVER|CLSCTX_NO_FAILURE_LOG" }, { "name": "riid", "value": "75121952-E0D0-43E5-9380-1D80483ACF72" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 578 }, { "timestamp": "2026-05-29 01:05:04,618", "thread_id": "4840", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 579 }, { "timestamp": "2026-05-29 01:05:04,618", "thread_id": "4840", "caller": "0x7fff55825882", "parentcaller": "0x7fff558495d3", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "FBF23B40-E3F0-101B-8488-00AA003E56F8" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "000214F9-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "InternetShortcut" } ], "repeated": 0, "id": 580 }, { "timestamp": "2026-05-29 01:05:04,618", "thread_id": "4840", "caller": "0x7fff41396d8c", "parentcaller": "0x7fff41281ead", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "942BC614-676C-464E-B384-D3202AAA02DA" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000000-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 581 }, { "timestamp": "2026-05-29 01:05:04,618", "thread_id": "4840", "caller": "0x7fff41396d8c", "parentcaller": "0x7fff41378e23", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "06EEE834-461C-42C2-8DCF-1502B527B1F9" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "0000010B-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 582 }, { "timestamp": "2026-05-29 01:05:04,618", "thread_id": "4840", "caller": "0x7fff4136a287", "parentcaller": "0x7fff41378e41", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "4DFED3F9-B794-4D3C-973B-DDA1C28105A9" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "B7F02995-84DD-4F19-970A-1625E95C8BD0" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 583 }, { "timestamp": "2026-05-29 01:05:04,618", "thread_id": "4840", "caller": "0x7fff578186ed", "parentcaller": "0x7fff432b9455", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002344" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "ShareAccess", "value": "0" } ], "repeated": 0, "id": 584 }, { "timestamp": "2026-05-29 01:05:05,102", "thread_id": "6164", "caller": "0x7fff41dbe842", "parentcaller": "0x7fff59fc16e9", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000236c" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "\\Device\\Bam" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 585 }, { "timestamp": "2026-05-29 01:05:05,399", "thread_id": "4696", "caller": "0x7ff79bc5ddb7", "parentcaller": "0x7ff79bc5c5b7", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000323-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000146-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 586 }, { "timestamp": "2026-05-29 01:05:05,399", "thread_id": "4696", "caller": "0x7ff79bc5ddb7", "parentcaller": "0x7ff79bc5c5b7", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 587 }, { "timestamp": "2026-05-29 01:05:05,399", "thread_id": "4696", "caller": "0x7ff79bc5ddb7", "parentcaller": "0x7ff79bc5c5b7", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000021ac" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files (x86)\\Steam\\steam.exe" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 588 }, { "timestamp": "2026-05-29 01:05:05,399", "thread_id": "4696", "caller": "0x7ff79bc5ddb7", "parentcaller": "0x7ff79bc5c5b7", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000021ac" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000236c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 589 }, { "timestamp": "2026-05-29 01:05:05,399", "thread_id": "4696", "caller": "0x7ff79bc5ddb7", "parentcaller": "0x7ff79bc5c5b7", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000021ac" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files (x86)\\Steam\\steam.exe" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 590 }, { "timestamp": "2026-05-29 01:05:05,399", "thread_id": "4696", "caller": "0x7ff79bc5ddb7", "parentcaller": "0x7ff79bc5c5b7", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x40000003", "arguments": [ { "name": "SectionHandle", "value": "0x000022f8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x12a40000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00708000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 591 }, { "timestamp": "2026-05-29 01:05:05,399", "thread_id": "4696", "caller": "0x7ff79bc5ddb7", "parentcaller": "0x7ff79bc5c5b7", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x12a40000" }, { "name": "RegionSize", "value": "0x00708000" } ], "repeated": 0, "id": 592 }, { "timestamp": "2026-05-29 01:05:05,399", "thread_id": "4696", "caller": "0x7ff79bc5ddb7", "parentcaller": "0x7ff79bc5c5b7", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000021ac" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files (x86)\\Steam\\steam.exe" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 593 }, { "timestamp": "2026-05-29 01:05:05,399", "thread_id": "4696", "caller": "0x7ff79bc5ddb7", "parentcaller": "0x7ff79bc5c5b7", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x40000003", "arguments": [ { "name": "SectionHandle", "value": "0x000022f8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x12a40000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00708000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 594 }, { "timestamp": "2026-05-29 01:05:05,399", "thread_id": "4696", "caller": "0x7ff79bc5ddb7", "parentcaller": "0x7ff79bc5c5b7", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x12a40000" }, { "name": "RegionSize", "value": "0x00708000" } ], "repeated": 0, "id": 595 }, { "timestamp": "2026-05-29 01:05:05,399", "thread_id": "4696", "caller": "0x7ff79bc5ddb7", "parentcaller": "0x7ff79bc5c5b7", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000021ac" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files (x86)\\Steam\\steam.exe" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 596 }, { "timestamp": "2026-05-29 01:05:05,399", "thread_id": "4696", "caller": "0x7ff79bc5ddb7", "parentcaller": "0x7ff79bc5c5b7", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x40000003", "arguments": [ { "name": "SectionHandle", "value": "0x000022f8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x12a40000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00708000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 597 }, { "timestamp": "2026-05-29 01:05:05,399", "thread_id": "4696", "caller": "0x7ff79bc5ddb7", "parentcaller": "0x7ff79bc5c5b7", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x12a40000" }, { "name": "RegionSize", "value": "0x00708000" } ], "repeated": 0, "id": 598 }, { "timestamp": "2026-05-29 01:05:05,399", "thread_id": "4696", "caller": "0x7ff79bc5ddb7", "parentcaller": "0x7ff79bc5c5b7", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000021ac" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files (x86)\\Steam\\steam.exe" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 599 }, { "timestamp": "2026-05-29 01:05:05,399", "thread_id": "4696", "caller": "0x7ff79bc5ddb7", "parentcaller": "0x7ff79bc5c5b7", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x40000003", "arguments": [ { "name": "SectionHandle", "value": "0x000022f8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x12a40000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00708000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 600 }, { "timestamp": "2026-05-29 01:05:05,399", "thread_id": "4696", "caller": "0x7ff79bc5ddb7", "parentcaller": "0x7ff79bc5c5b7", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x12a40000" }, { "name": "RegionSize", "value": "0x00708000" } ], "repeated": 0, "id": 601 }, { "timestamp": "2026-05-29 01:05:05,399", "thread_id": "4696", "caller": "0x7ff79bc1afc1", "parentcaller": "0x7ff79bc5de65", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 602 }, { "timestamp": "2026-05-29 01:05:05,415", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002328" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000022fc" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 603 }, { "timestamp": "2026-05-29 01:05:05,415", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000022fc" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02ff0000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 604 }, { "timestamp": "2026-05-29 01:05:05,415", "thread_id": "4696", "caller": "0x7ff79bc4ebcc", "parentcaller": "0x7ff79bc512d4", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000021ac" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 605 }, { "timestamp": "2026-05-29 01:05:05,415", "thread_id": "4696", "caller": "0x7ff79bc4ebcc", "parentcaller": "0x7ff79bc512d4", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000021ac" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 606 }, { "timestamp": "2026-05-29 01:05:05,415", "thread_id": "4696", "caller": "0x7ff79bc4ebcc", "parentcaller": "0x7ff79bc512d4", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000021ac" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 607 }, { "timestamp": "2026-05-29 01:05:05,415", "thread_id": "4696", "caller": "0x7ff79bc4ebcc", "parentcaller": "0x7ff79bc512d4", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000021ac" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 608 }, { "timestamp": "2026-05-29 01:05:05,415", "thread_id": "4696", "caller": "0x7ff79bc4ebcc", "parentcaller": "0x7ff79bc512d4", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000021ac" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 609 }, { "timestamp": "2026-05-29 01:05:05,415", "thread_id": "4696", "caller": "0x7ff79bc4ebcc", "parentcaller": "0x7ff79bc512d4", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00f9b281" }, { "name": "Buffer", "value": "\\x01" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 610 }, { "timestamp": "2026-05-29 01:05:05,415", "thread_id": "4696", "caller": "0x7ff79bc4ebcc", "parentcaller": "0x7ff79bc512d4", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000001" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\desktop.ini" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 611 }, { "timestamp": "2026-05-29 01:05:05,415", "thread_id": "4696", "caller": "0x7ff79bc4ebcc", "parentcaller": "0x7ff79bc512d4", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00f9b281" }, { "name": "Buffer", "value": "\\x00" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 612 }, { "timestamp": "2026-05-29 01:05:05,415", "thread_id": "4696", "caller": "0x7ff79bc4ebcc", "parentcaller": "0x7ff79bc512d4", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000021ac" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 613 }, { "timestamp": "2026-05-29 01:05:05,415", "thread_id": "4696", "caller": "0x7ff79bc4ebcc", "parentcaller": "0x7ff79bc512d4", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000021ac" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Internet Explorer" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 614 }, { "timestamp": "2026-05-29 01:05:05,415", "thread_id": "4696", "caller": "0x7ff79bc4ebcc", "parentcaller": "0x7ff79bc512d4", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00f9b281" }, { "name": "Buffer", "value": "\\x01" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 615 }, { "timestamp": "2026-05-29 01:05:05,415", "thread_id": "4696", "caller": "0x7ff79bc4ebcc", "parentcaller": "0x7ff79bc512d4", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000021ac" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 616 }, { "timestamp": "2026-05-29 01:05:05,415", "thread_id": "4696", "caller": "0x7ff79bc4ebcc", "parentcaller": "0x7ff79bc512d4", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00f9b281" }, { "name": "Buffer", "value": "\\x00" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 617 }, { "timestamp": "2026-05-29 01:05:05,415", "thread_id": "4696", "caller": "0x7ff79bc4ebcc", "parentcaller": "0x7ff79bc512d4", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000021ac" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 618 }, { "timestamp": "2026-05-29 01:05:05,430", "thread_id": "4696", "caller": "0x7ff79bc7a06e", "parentcaller": "0x7ff79bc78f2b", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 619 }, { "timestamp": "2026-05-29 01:05:05,430", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc78f2b", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 620 }, { "timestamp": "2026-05-29 01:05:05,430", "thread_id": "4696", "caller": "0x7ff79bc7a06e", "parentcaller": "0x7ff79bc78f2b", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 621 }, { "timestamp": "2026-05-29 01:05:05,430", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc78f2b", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 622 }, { "timestamp": "2026-05-29 01:05:05,430", "thread_id": "4696", "caller": "0x7ff79bc7a06e", "parentcaller": "0x7ff79bc78f2b", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 623 }, { "timestamp": "2026-05-29 01:05:05,430", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc78f2b", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 624 }, { "timestamp": "2026-05-29 01:05:05,430", "thread_id": "4636", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000021ac" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\File Explorer.lnk" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 625 }, { "timestamp": "2026-05-29 01:05:05,430", "thread_id": "4636", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000022f8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x07eb0000" }, { "name": "SectionOffset", "value": "0x0328d4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 626 }, { "timestamp": "2026-05-29 01:05:05,430", "thread_id": "4664", "caller": "0x7fff558259d3", "parentcaller": "0x7fff55896922", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0E5AAE11-A475-4C5B-AB00-C66DE400274E" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 627 }, { "timestamp": "2026-05-29 01:05:05,430", "thread_id": "4580", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022f8" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Google Chrome.lnk" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 628 }, { "timestamp": "2026-05-29 01:05:05,430", "thread_id": "4636", "caller": "0x7fff557d6fb6", "parentcaller": "0x7fff557d6ef4", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "79EAC9EE-BAF9-11CE-8C82-00AA004BA90B" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 629 }, { "timestamp": "2026-05-29 01:05:05,430", "thread_id": "4580", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000021ac" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x07eb0000" }, { "name": "SectionOffset", "value": "0x0317d080" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 630 }, { "timestamp": "2026-05-29 01:05:05,430", "thread_id": "4664", "caller": "0x7fff557c5aab", "parentcaller": "0x7fff557c519f", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "4DF0C730-DF9D-4AE3-9153-AA6B82E9795A" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "8BE2D872-86AA-4D47-B776-32CCA40C7018" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 631 }, { "timestamp": "2026-05-29 01:05:05,430", "thread_id": "4580", "caller": "0x7fff5286c1d6", "parentcaller": "0x7fff5286bde6", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "76765B11-3F95-4AF2-AC9D-EA55D8994F1A" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000000-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 632 }, { "timestamp": "2026-05-29 01:05:05,430", "thread_id": "4696", "caller": "0x7ff79bc7b354", "parentcaller": "0x7ff79bc7b12e", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 633 }, { "timestamp": "2026-05-29 01:05:05,430", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000022a4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000229c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 634 }, { "timestamp": "2026-05-29 01:05:05,430", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000229c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x07eb0000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 635 }, { "timestamp": "2026-05-29 01:05:05,430", "thread_id": "4344", "caller": "0x7ff79bc3ca89", "parentcaller": "0x7ff79bc3c93f", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001080" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\apppatch\\sysmain.sdb" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 636 }, { "timestamp": "2026-05-29 01:05:05,430", "thread_id": "4344", "caller": "0x7ff79bc3c67f", "parentcaller": "0x7ff79bc3c407", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000f80" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7df4adda0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x003e3000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 637 }, { "timestamp": "2026-05-29 01:05:05,430", "thread_id": "4340", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022a4" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Discord Inc\\Discord.lnk" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 638 }, { "timestamp": "2026-05-29 01:05:05,430", "thread_id": "4340", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000470" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x07eb0000" }, { "name": "SectionOffset", "value": "0x09f6d260" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 639 }, { "timestamp": "2026-05-29 01:05:05,430", "thread_id": "5220", "caller": "0x7ff79bc7bdd2", "parentcaller": "0x7ff79bc7a52a", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022f4" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files (x86)\\" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 640 }, { "timestamp": "2026-05-29 01:05:05,430", "thread_id": "4340", "caller": "0x7fff558259d3", "parentcaller": "0x7fff55896922", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0E5AAE11-A475-4C5B-AB00-C66DE400274E" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 641 }, { "timestamp": "2026-05-29 01:05:05,430", "thread_id": "5220", "caller": "0x7ff79bc7bdd2", "parentcaller": "0x7ff79bc7a52a", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022f4" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files (x86)\\Steam\\" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 642 }, { "timestamp": "2026-05-29 01:05:05,430", "thread_id": "5220", "caller": "0x7ff79bc7bdd2", "parentcaller": "0x7ff79bc7a52a", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022f4" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files (x86)\\Steam\\bin\\" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 643 }, { "timestamp": "2026-05-29 01:05:05,430", "thread_id": "4340", "caller": "0x7fff558259d3", "parentcaller": "0x7fff55896922", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0E5AAE11-A475-4C5B-AB00-C66DE400274E" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 644 }, { "timestamp": "2026-05-29 01:05:05,430", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 645 }, { "timestamp": "2026-05-29 01:05:05,430", "thread_id": "4344", "caller": "0x7ff79bc3a878", "parentcaller": "0x7ff79bc3a7ba", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7df4adda0000" }, { "name": "RegionSize", "value": "0x003e3000" } ], "repeated": 0, "id": 646 }, { "timestamp": "2026-05-29 01:05:05,430", "thread_id": "4696", "caller": "0x7ff79bc7a06e", "parentcaller": "0x7ff79bc78f2b", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 647 }, { "timestamp": "2026-05-29 01:05:05,430", "thread_id": "4340", "caller": "0x7fff557c5aab", "parentcaller": "0x7fff557c519f", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "4DF0C730-DF9D-4AE3-9153-AA6B82E9795A" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "8BE2D872-86AA-4D47-B776-32CCA40C7018" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 648 }, { "timestamp": "2026-05-29 01:05:05,430", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc78f2b", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 649 }, { "timestamp": "2026-05-29 01:05:05,430", "thread_id": "5220", "caller": "0x7ff79bc799ca", "parentcaller": "0x7ff79bc7a869", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 650 }, { "timestamp": "2026-05-29 01:05:05,430", "thread_id": "5220", "caller": "0x7ff79bc7bdd2", "parentcaller": "0x7ff79bc7a52a", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002108" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files (x86)\\" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 651 }, { "timestamp": "2026-05-29 01:05:05,430", "thread_id": "5220", "caller": "0x7ff79bc7bdd2", "parentcaller": "0x7ff79bc7a52a", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000228c" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files (x86)\\Steam\\" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 652 }, { "timestamp": "2026-05-29 01:05:05,430", "thread_id": "4664", "caller": "0x7fff584cf303", "parentcaller": "0x7fff584ce7f3", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 653 }, { "timestamp": "2026-05-29 01:05:05,430", "thread_id": "5220", "caller": "0x7ff79bc7bdd2", "parentcaller": "0x7ff79bc7a52a", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002164" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files (x86)\\Steam\\bin\\" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 654 }, { "timestamp": "2026-05-29 01:05:05,430", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 655 }, { "timestamp": "2026-05-29 01:05:05,430", "thread_id": "4340", "caller": "0x7fff5286c1d6", "parentcaller": "0x7fff5289766a", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "76765B11-3F95-4AF2-AC9D-EA55D8994F1A" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000000-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 656 }, { "timestamp": "2026-05-29 01:05:05,430", "thread_id": "4340", "caller": "0x7fff55824fbc", "parentcaller": "0x7fff5581f4db", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000323-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000146-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 657 }, { "timestamp": "2026-05-29 01:05:05,430", "thread_id": "4340", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5978ef53", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002328" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 658 }, { "timestamp": "2026-05-29 01:05:05,430", "thread_id": "4340", "caller": "0x7fff5581d809", "parentcaller": "0x7fff5581d730", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0340F119-A598-4ED9-B0AC-6F6A12D3E755" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "7F73BE3F-FB79-493C-A6C7-7EE14E245841" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 659 }, { "timestamp": "2026-05-29 01:05:05,430", "thread_id": "4340", "caller": "0x7fff584cf303", "parentcaller": "0x7fff584ce7f3", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 660 }, { "timestamp": "2026-05-29 01:05:05,430", "thread_id": "4696", "caller": "0x7ff79bc7a06e", "parentcaller": "0x7ff79bc66f8c", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 661 }, { "timestamp": "2026-05-29 01:05:05,430", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 662 }, { "timestamp": "2026-05-29 01:05:05,446", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 663 }, { "timestamp": "2026-05-29 01:05:05,446", "thread_id": "4664", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "2155FEE3-2419-4373-B102-6843707EB41F" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "F676C15D-596A-4CE2-8234-33996F445DB1" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 664 }, { "timestamp": "2026-05-29 01:05:05,446", "thread_id": "4664", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 665 }, { "timestamp": "2026-05-29 01:05:05,446", "thread_id": "4340", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "2155FEE3-2419-4373-B102-6843707EB41F" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "F676C15D-596A-4CE2-8234-33996F445DB1" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 666 }, { "timestamp": "2026-05-29 01:05:05,446", "thread_id": "4664", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x011938c0" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 667 }, { "timestamp": "2026-05-29 01:05:05,446", "thread_id": "4664", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x076d5e28" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 668 }, { "timestamp": "2026-05-29 01:05:05,446", "thread_id": "4340", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x076d8468" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 669 }, { "timestamp": "2026-05-29 01:05:05,446", "thread_id": "4580", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002164" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\program files\\Google\\Chrome\\application\\chrome.exe" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 670 }, { "timestamp": "2026-05-29 01:05:05,446", "thread_id": "4580", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x40000003", "arguments": [ { "name": "SectionHandle", "value": "0x00002178" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x12a40000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00421000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 671 }, { "timestamp": "2026-05-29 01:05:05,446", "thread_id": "4664", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002344" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x07eb0000" }, { "name": "SectionOffset", "value": "0x0332e360" }, { "name": "ViewSize", "value": "0x0000f000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 672 }, { "timestamp": "2026-05-29 01:05:05,446", "thread_id": "4664", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000229c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002314" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 673 }, { "timestamp": "2026-05-29 01:05:05,462", "thread_id": "4580", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc000003a", "pretty_return": "OBJECT_PATH_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\program files\\Google\\Chrome\\SystemResources\\chrome.exe.mun" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 674 }, { "timestamp": "2026-05-29 01:05:05,462", "thread_id": "4664", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000235c" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "ShareAccess", "value": "0" } ], "repeated": 0, "id": 675 }, { "timestamp": "2026-05-29 01:05:05,462", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 6, "id": 676 }, { "timestamp": "2026-05-29 01:05:05,571", "thread_id": "5000", "caller": "0x7fff57fcb8ed", "parentcaller": "0x7fff58085341", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x00002340", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x7fff580853d0" }, { "name": "Parameter", "value": "0x04b8a790" }, { "name": "CreationFlags", "value": "0x00000004" }, { "name": "ThreadId", "value": "3820" }, { "name": "ProcessId", "value": "4484" } ], "repeated": 0, "id": 677 }, { "timestamp": "2026-05-29 01:05:05,571", "thread_id": "5000", "caller": "0x7fff5781f430", "parentcaller": "0x7fff58085379", "category": "threading", "api": "NtResumeThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00002340" }, { "name": "SuspendCount", "value": "1" }, { "name": "ThreadId", "value": "3820" }, { "name": "ProcessId", "value": "4484" } ], "repeated": 0, "id": 678 }, { "timestamp": "2026-05-29 01:05:05,571", "thread_id": "4636", "caller": "0x7fff577cfcb5", "parentcaller": "0x7fff57815984", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002108" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 679 }, { "timestamp": "2026-05-29 01:05:05,571", "thread_id": "4696", "caller": "0x7ff79bc7a06e", "parentcaller": "0x7ff79bc78f2b", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 680 }, { "timestamp": "2026-05-29 01:05:05,571", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc78f2b", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 681 }, { "timestamp": "2026-05-29 01:05:05,571", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 682 }, { "timestamp": "2026-05-29 01:05:05,571", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x011938c0" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 683 }, { "timestamp": "2026-05-29 01:05:05,571", "thread_id": "4696", "caller": "0x7ff79bc7a06e", "parentcaller": "0x7ff79bc66f8c", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 684 }, { "timestamp": "2026-05-29 01:05:05,571", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 685 }, { "timestamp": "2026-05-29 01:05:05,587", "thread_id": "4576", "caller": "0x7ff79bc5b8f3", "parentcaller": "0x7ff79bc5b70d", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002358" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 686 }, { "timestamp": "2026-05-29 01:05:05,587", "thread_id": "4576", "caller": "0x7ff79bc5b8f3", "parentcaller": "0x7ff79bc5b70d", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002358" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 687 }, { "timestamp": "2026-05-29 01:05:05,587", "thread_id": "4576", "caller": "0x7ff79bc5b8f3", "parentcaller": "0x7ff79bc5b70d", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002358" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files\\WindowsApps" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 688 }, { "timestamp": "2026-05-29 01:05:05,587", "thread_id": "4576", "caller": "0x7ff79bc5b8f3", "parentcaller": "0x7ff79bc5b70d", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002358" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files\\WindowsApps\\PythonSoftwareFoundation.PythonManager_26.2.240.0_x64__3847v3x7pw1km" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 689 }, { "timestamp": "2026-05-29 01:05:05,587", "thread_id": "4576", "caller": "0x7ff79bc5b8f3", "parentcaller": "0x7ff79bc5b70d", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002358" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files\\WindowsApps\\PythonSoftwareFoundation.PythonManager_26.2.240.0_x64__3847v3x7pw1km\\_resources" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 690 }, { "timestamp": "2026-05-29 01:05:05,587", "thread_id": "4576", "caller": "0x7ff79bc5b80f", "parentcaller": "0x7ff79bc5b918", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "50EF4544-AC9F-4A8E-B21B-8A26180DB13F" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "F676C15D-596A-4CE2-8234-33996F445DB1" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 691 }, { "timestamp": "2026-05-29 01:05:05,587", "thread_id": "4576", "caller": "0x7ff79bd3c72d", "parentcaller": "0x7ff79bc5b965", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 692 }, { "timestamp": "2026-05-29 01:05:05,587", "thread_id": "4576", "caller": "0x7ff79bd3c72d", "parentcaller": "0x7ff79bc5b965", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x011938c0" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 693 }, { "timestamp": "2026-05-29 01:05:05,602", "thread_id": "4696", "caller": "0x7ff79bc7a06e", "parentcaller": "0x7ff79bc66f8c", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 694 }, { "timestamp": "2026-05-29 01:05:05,602", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 695 }, { "timestamp": "2026-05-29 01:05:05,618", "thread_id": "4696", "caller": "0x7ff79bc7a06e", "parentcaller": "0x7ff79bc66f8c", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 696 }, { "timestamp": "2026-05-29 01:05:05,618", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 697 }, { "timestamp": "2026-05-29 01:05:05,618", "thread_id": "4636", "caller": "0x7fff577d6579", "parentcaller": "0x7fff5781c32f", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002108" }, { "name": "DesiredAccess", "value": "0x00120080", "pretty_value": "FILE_READ_ATTRIBUTES|READ_CONTROL|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\explorer.exe" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 698 }, { "timestamp": "2026-05-29 01:05:05,837", "thread_id": "4576", "caller": "0x7ff79bd3c72d", "parentcaller": "0x7ff79bc5b965", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x076d9128" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 699 }, { "timestamp": "2026-05-29 01:05:05,837", "thread_id": "4664", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002178" }, { "name": "DesiredAccess", "value": "0xc0100080", "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_32.db" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 700 }, { "timestamp": "2026-05-29 01:05:05,837", "thread_id": "4576", "caller": "0x7ff79bd3c72d", "parentcaller": "0x7ff79bc5b965", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022c0" }, { "name": "DesiredAccess", "value": "0xc0100080", "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 701 }, { "timestamp": "2026-05-29 01:05:05,837", "thread_id": "4664", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002164" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Discord\\app.ico" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 702 }, { "timestamp": "2026-05-29 01:05:05,837", "thread_id": "4664", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002340" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x11b00000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00046000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 703 }, { "timestamp": "2026-05-29 01:05:05,837", "thread_id": "4664", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x11b00000" }, { "name": "RegionSize", "value": "0x00046000" } ], "repeated": 0, "id": 704 }, { "timestamp": "2026-05-29 01:05:05,837", "thread_id": "4664", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002164" }, { "name": "DesiredAccess", "value": "0x80100180", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|FILE_WRITE_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Discord\\app.ico" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 705 }, { "timestamp": "2026-05-29 01:05:05,837", "thread_id": "4576", "caller": "0x7ff79bd3c72d", "parentcaller": "0x7ff79bc5b965", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000201c" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "ShareAccess", "value": "0" } ], "repeated": 0, "id": 706 }, { "timestamp": "2026-05-29 01:05:05,837", "thread_id": "4340", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002314" }, { "name": "DesiredAccess", "value": "0xc0100080", "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_32.db" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 707 }, { "timestamp": "2026-05-29 01:05:05,852", "thread_id": "4576", "caller": "0x7ff79bd3c72d", "parentcaller": "0x7ff79bc5b965", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000201c" }, { "name": "DesiredAccess", "value": "0xc0100080", "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 708 }, { "timestamp": "2026-05-29 01:05:05,852", "thread_id": "4664", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022c8" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Discord\\app.ico" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 709 }, { "timestamp": "2026-05-29 01:05:05,852", "thread_id": "4664", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002244" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x11b00000" }, { "name": "SectionOffset", "value": "0x0332ccc0" }, { "name": "ViewSize", "value": "0x00046000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 710 }, { "timestamp": "2026-05-29 01:05:05,852", "thread_id": "4340", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002340" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x12b40000" }, { "name": "SectionOffset", "value": "0x09f6e500" }, { "name": "ViewSize", "value": "0x00100000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 711 }, { "timestamp": "2026-05-29 01:05:05,852", "thread_id": "4340", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002314" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001aec" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 712 }, { "timestamp": "2026-05-29 01:05:05,852", "thread_id": "4576", "caller": "0x7ff79bd3c72d", "parentcaller": "0x7ff79bc5b965", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000201c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db" }, { "name": "FileInformationClass", "value": "74" }, { "name": "FileInformation", "value": "\\x02\\x00\\x00\\x00" } ], "repeated": 0, "id": 713 }, { "timestamp": "2026-05-29 01:05:05,852", "thread_id": "4576", "caller": "0x7ff79bd3c72d", "parentcaller": "0x7ff79bc5b965", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002388" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x12c40000" }, { "name": "SectionOffset", "value": "0x030fdc70" }, { "name": "ViewSize", "value": "0x00100000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 714 }, { "timestamp": "2026-05-29 01:05:05,852", "thread_id": "4576", "caller": "0x7ff79bd3c72d", "parentcaller": "0x7ff79bc5b965", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000201c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002164" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 715 }, { "timestamp": "2026-05-29 01:05:05,852", "thread_id": "4340", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001b00" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Discord\\app.ico" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 716 }, { "timestamp": "2026-05-29 01:05:05,852", "thread_id": "4340", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000022f4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x11b00000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00046000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 717 }, { "timestamp": "2026-05-29 01:05:05,852", "thread_id": "4340", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x11b00000" }, { "name": "RegionSize", "value": "0x00046000" } ], "repeated": 0, "id": 718 }, { "timestamp": "2026-05-29 01:05:05,852", "thread_id": "4340", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001b00" }, { "name": "DesiredAccess", "value": "0x80100180", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|FILE_WRITE_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Discord\\app.ico" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 719 }, { "timestamp": "2026-05-29 01:05:05,852", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000204c" }, { "name": "DesiredAccess", "value": "0xc0100080", "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 720 }, { "timestamp": "2026-05-29 01:05:05,852", "thread_id": "4340", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001b00" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Discord\\app.ico" }, { "name": "FileInformationClass", "value": "4", "pretty_value": "FileBasicInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 721 }, { "timestamp": "2026-05-29 01:05:05,852", "thread_id": "4620", "caller": "0x7fff528866e4", "parentcaller": "0x7fff52884b85", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "591209C7-767B-42B2-9FBA-44EE4615F2C7" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "4E530B0A-E611-4C77-A3AC-9031D022281B" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 722 }, { "timestamp": "2026-05-29 01:05:05,852", "thread_id": "4340", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002394" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Discord\\app.ico" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 723 }, { "timestamp": "2026-05-29 01:05:05,852", "thread_id": "4340", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000238c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x11b00000" }, { "name": "SectionOffset", "value": "0x09f6cee0" }, { "name": "ViewSize", "value": "0x00046000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 724 }, { "timestamp": "2026-05-29 01:05:05,852", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002298" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "ShareAccess", "value": "0" } ], "repeated": 0, "id": 725 }, { "timestamp": "2026-05-29 01:05:05,852", "thread_id": "4340", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022f4" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "ShareAccess", "value": "0" } ], "repeated": 0, "id": 726 }, { "timestamp": "2026-05-29 01:05:05,852", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000023a0" }, { "name": "DesiredAccess", "value": "0xc0100080", "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_32.db" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 727 }, { "timestamp": "2026-05-29 01:05:05,852", "thread_id": "4340", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "317D06E8-5F24-433D-BDF7-79CE68D8ABC2" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EC5EC8A9-C395-4314-9C77-54D7A935FF70" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 728 }, { "timestamp": "2026-05-29 01:05:05,852", "thread_id": "4576", "caller": "0x7ff79bd3c72d", "parentcaller": "0x7ff79bc5b965", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001b00" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files\\WindowsApps\\PythonSoftwareFoundation.PythonManager_26.2.240.0_x64__3847v3x7pw1km\\_resources" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 1, "id": 729 }, { "timestamp": "2026-05-29 01:05:05,852", "thread_id": "4576", "caller": "0x7ff79bd3c72d", "parentcaller": "0x7ff79bc5b965", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001b00" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files\\WindowsApps\\PythonSoftwareFoundation.PythonManager_26.2.240.0_x64__3847v3x7pw1km\\_resources\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 730 }, { "timestamp": "2026-05-29 01:05:05,852", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000023a0" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000023a4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 731 }, { "timestamp": "2026-05-29 01:05:05,852", "thread_id": "4576", "caller": "0x7ff79bd3c72d", "parentcaller": "0x7ff79bc5b965", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc00000ba", "pretty_return": "FILE_IS_A_DIRECTORY", "arguments": [ { "name": "FileHandle", "value": "0x00001b00" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files\\WindowsApps\\PythonSoftwareFoundation.PythonManager_26.2.240.0_x64__3847v3x7pw1km" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 732 }, { "timestamp": "2026-05-29 01:05:05,852", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000239c" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\program files (x86)\\Steam\\bin\\cef\\cef.win64\\steamwebhelper.exe" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 733 }, { "timestamp": "2026-05-29 01:05:05,852", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x40000003", "arguments": [ { "name": "SectionHandle", "value": "0x00001aec" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x12e40000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x008f9000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 734 }, { "timestamp": "2026-05-29 01:05:05,868", "thread_id": "4576", "caller": "0x7ff79bd3c72d", "parentcaller": "0x7ff79bc5b965", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001b00" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files\\WindowsApps\\PythonSoftwareFoundation.PythonManager_26.2.240.0_x64__3847v3x7pw1km" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 1, "id": 735 }, { "timestamp": "2026-05-29 01:05:05,868", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x12e40000" }, { "name": "RegionSize", "value": "0x008f9000" } ], "repeated": 0, "id": 736 }, { "timestamp": "2026-05-29 01:05:05,868", "thread_id": "4576", "caller": "0x7ff79bd3c72d", "parentcaller": "0x7ff79bc5b965", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001b00" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files\\WindowsApps\\PythonSoftwareFoundation.PythonManager_26.2.240.0_x64__3847v3x7pw1km\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 737 }, { "timestamp": "2026-05-29 01:05:05,868", "thread_id": "4576", "caller": "0x7ff79bd3c72d", "parentcaller": "0x7ff79bc5b965", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc00000ba", "pretty_return": "FILE_IS_A_DIRECTORY", "arguments": [ { "name": "FileHandle", "value": "0x00001b00" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files\\WindowsApps" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 738 }, { "timestamp": "2026-05-29 01:05:05,868", "thread_id": "4576", "caller": "0x7ff79bd3c72d", "parentcaller": "0x7ff79bc5b965", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001b00" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files\\WindowsApps\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 739 }, { "timestamp": "2026-05-29 01:05:05,868", "thread_id": "4576", "caller": "0x7ff79bd3c72d", "parentcaller": "0x7ff79bc5b965", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001b00" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files\\WindowsApps" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 1, "id": 740 }, { "timestamp": "2026-05-29 01:05:05,868", "thread_id": "4576", "caller": "0x7ff79bd3c72d", "parentcaller": "0x7ff79bc5b965", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001b00" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files\\WindowsApps\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 741 }, { "timestamp": "2026-05-29 01:05:05,868", "thread_id": "4576", "caller": "0x7ff79bd3c72d", "parentcaller": "0x7ff79bc5b965", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc00000ba", "pretty_return": "FILE_IS_A_DIRECTORY", "arguments": [ { "name": "FileHandle", "value": "0x00001b00" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 742 }, { "timestamp": "2026-05-29 01:05:05,868", "thread_id": "4576", "caller": "0x7ff79bd3c72d", "parentcaller": "0x7ff79bc5b965", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001b00" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 743 }, { "timestamp": "2026-05-29 01:05:05,868", "thread_id": "4576", "caller": "0x7ff79bd3c72d", "parentcaller": "0x7ff79bc5b965", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001b00" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 1, "id": 744 }, { "timestamp": "2026-05-29 01:05:05,868", "thread_id": "4576", "caller": "0x7ff79bd3c72d", "parentcaller": "0x7ff79bc5b965", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001b00" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 745 }, { "timestamp": "2026-05-29 01:05:05,868", "thread_id": "4576", "caller": "0x7ff79bd3c72d", "parentcaller": "0x7ff79bc5b965", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001b00" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 746 }, { "timestamp": "2026-05-29 01:05:05,868", "thread_id": "4576", "caller": "0x7ff79bd3c72d", "parentcaller": "0x7ff79bc5b965", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001b00" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\MountPointManager" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 747 }, { "timestamp": "2026-05-29 01:05:05,868", "thread_id": "4576", "caller": "0x7ff79bd3c72d", "parentcaller": "0x7ff79bc5b965", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "317D06E8-5F24-433D-BDF7-79CE68D8ABC2" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EC5EC8A9-C395-4314-9C77-54D7A935FF70" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 748 }, { "timestamp": "2026-05-29 01:05:05,946", "thread_id": "4580", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x01344000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 749 }, { "timestamp": "2026-05-29 01:05:05,946", "thread_id": "4576", "caller": "0x7ff79bd3c72d", "parentcaller": "0x7ff79bc5b965", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "317D06E8-5F24-433D-BDF7-79CE68D8ABC2" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EC5EC8A9-C395-4314-9C77-54D7A935FF70" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 750 }, { "timestamp": "2026-05-29 01:05:05,946", "thread_id": "4576", "caller": "0x7ff79bd3c72d", "parentcaller": "0x7ff79bc5b965", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "4DB26476-6787-4046-B836-E8412A9E8A27" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "091162A4-BC96-411F-AAE8-C5122CD03363" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 751 }, { "timestamp": "2026-05-29 01:05:05,946", "thread_id": "4664", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002390" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "ShareAccess", "value": "0" } ], "repeated": 0, "id": 752 }, { "timestamp": "2026-05-29 01:05:05,962", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "317D06E8-5F24-433D-BDF7-79CE68D8ABC2" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EC5EC8A9-C395-4314-9C77-54D7A935FF70" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 753 }, { "timestamp": "2026-05-29 01:05:05,962", "thread_id": "4696", "caller": "0x7ff79bc7a06e", "parentcaller": "0x7ff79bc66f8c", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 754 }, { "timestamp": "2026-05-29 01:05:05,962", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 755 }, { "timestamp": "2026-05-29 01:05:06,305", "thread_id": "4636", "caller": "0x7ff79bc8403a", "parentcaller": "0x7ff79bc83f37", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\wpnapps" }, { "name": "DllBase", "value": "0x7fff40fb0000" } ], "repeated": 0, "id": 756 }, { "timestamp": "2026-05-29 01:05:06,321", "thread_id": "4636", "caller": "0x7ff79bc8403a", "parentcaller": "0x7ff79bc83f37", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\wpnapps.dll" }, { "name": "BaseAddress", "value": "0x7fff40fb0000" } ], "repeated": 0, "id": 757 }, { "timestamp": "2026-05-29 01:05:06,321", "thread_id": "4636", "caller": "0x7ff79bc8403a", "parentcaller": "0x7ff79bc83f37", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x00002298", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x7fff58542d30" }, { "name": "Parameter", "value": "0x0c800770" }, { "name": "CreationFlags", "value": "0x00000000" }, { "name": "ThreadId", "value": "8412" }, { "name": "ProcessId", "value": "4484" } ], "repeated": 0, "id": 758 }, { "timestamp": "2026-05-29 01:05:06,321", "thread_id": "8412", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5978ef53", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000022c0" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 759 }, { "timestamp": "2026-05-29 01:05:06,321", "thread_id": "4636", "caller": "0x7ff79bc840aa", "parentcaller": "0x7ff79bc83f37", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x000022f4", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x7fff58542d30" }, { "name": "Parameter", "value": "0x0c800630" }, { "name": "CreationFlags", "value": "0x00000000" }, { "name": "ThreadId", "value": "8324" }, { "name": "ProcessId", "value": "4484" } ], "repeated": 0, "id": 760 }, { "timestamp": "2026-05-29 01:05:06,321", "thread_id": "8324", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5978ef53", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000213c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 761 }, { "timestamp": "2026-05-29 01:05:06,321", "thread_id": "4696", "caller": "0x7ff79bc7a06e", "parentcaller": "0x7ff79bc66f8c", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 762 }, { "timestamp": "2026-05-29 01:05:06,321", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 763 }, { "timestamp": "2026-05-29 01:05:06,337", "thread_id": "4696", "caller": "0x7ff79bc7c21a", "parentcaller": "0x7ff79bc62b6f", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "21CBC515-2DDE-4D66-8292-BA34BD25094A" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 764 }, { "timestamp": "2026-05-29 01:05:06,337", "thread_id": "4696", "caller": "0x7ff79bc7c285", "parentcaller": "0x7ff79bc62b6f", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 765 }, { "timestamp": "2026-05-29 01:05:06,337", "thread_id": "4696", "caller": "0x7ff79bca1e2d", "parentcaller": "0x7ff79bc5c798", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\rsaenh.dll" }, { "name": "BaseAddress", "value": "0x7fff56630000" } ], "repeated": 1, "id": 766 }, { "timestamp": "2026-05-29 01:05:06,337", "thread_id": "4696", "caller": "0x7ff79bc5dd72", "parentcaller": "0x7ff79bc5c5b7", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001c50" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 767 }, { "timestamp": "2026-05-29 01:05:06,337", "thread_id": "4696", "caller": "0x7ff79bc5dd72", "parentcaller": "0x7ff79bc5c5b7", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001c50" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files (x86)" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 768 }, { "timestamp": "2026-05-29 01:05:06,337", "thread_id": "4696", "caller": "0x7ff79bc5dd72", "parentcaller": "0x7ff79bc5c5b7", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001c50" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files (x86)\\Steam" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 769 }, { "timestamp": "2026-05-29 01:05:06,337", "thread_id": "4696", "caller": "0x7ff79bc5ddb7", "parentcaller": "0x7ff79bc5c5b7", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000323-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000146-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 770 }, { "timestamp": "2026-05-29 01:05:06,337", "thread_id": "4696", "caller": "0x7ff79bc5ddb7", "parentcaller": "0x7ff79bc5c5b7", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 771 }, { "timestamp": "2026-05-29 01:05:06,337", "thread_id": "4696", "caller": "0x7ff79bc5ddb7", "parentcaller": "0x7ff79bc5c5b7", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022b8" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files (x86)\\Steam\\steam.exe" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 772 }, { "timestamp": "2026-05-29 01:05:06,337", "thread_id": "4696", "caller": "0x7ff79bc5ddb7", "parentcaller": "0x7ff79bc5c5b7", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000022b8" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000022f4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 773 }, { "timestamp": "2026-05-29 01:05:06,337", "thread_id": "4696", "caller": "0x7ff79bc5ddb7", "parentcaller": "0x7ff79bc5c5b7", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022b8" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files (x86)\\Steam\\steam.exe" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 774 }, { "timestamp": "2026-05-29 01:05:06,337", "thread_id": "4696", "caller": "0x7ff79bc5ddb7", "parentcaller": "0x7ff79bc5c5b7", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x40000003", "arguments": [ { "name": "SectionHandle", "value": "0x000023c0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x12e40000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00708000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 775 }, { "timestamp": "2026-05-29 01:05:06,337", "thread_id": "4696", "caller": "0x7ff79bc5ddb7", "parentcaller": "0x7ff79bc5c5b7", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x12e40000" }, { "name": "RegionSize", "value": "0x00708000" } ], "repeated": 0, "id": 776 }, { "timestamp": "2026-05-29 01:05:06,337", "thread_id": "4696", "caller": "0x7ff79bc5ddb7", "parentcaller": "0x7ff79bc5c5b7", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022b8" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files (x86)\\Steam\\steam.exe" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 777 }, { "timestamp": "2026-05-29 01:05:06,337", "thread_id": "4696", "caller": "0x7ff79bc5ddb7", "parentcaller": "0x7ff79bc5c5b7", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x40000003", "arguments": [ { "name": "SectionHandle", "value": "0x000023c0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x12e40000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00708000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 778 }, { "timestamp": "2026-05-29 01:05:06,337", "thread_id": "4696", "caller": "0x7ff79bc5ddb7", "parentcaller": "0x7ff79bc5c5b7", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x12e40000" }, { "name": "RegionSize", "value": "0x00708000" } ], "repeated": 0, "id": 779 }, { "timestamp": "2026-05-29 01:05:06,337", "thread_id": "4696", "caller": "0x7ff79bc5ddb7", "parentcaller": "0x7ff79bc5c5b7", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022b8" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files (x86)\\Steam\\steam.exe" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 780 }, { "timestamp": "2026-05-29 01:05:06,337", "thread_id": "4696", "caller": "0x7ff79bc5ddb7", "parentcaller": "0x7ff79bc5c5b7", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x40000003", "arguments": [ { "name": "SectionHandle", "value": "0x000023c0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x12e40000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00708000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 781 }, { "timestamp": "2026-05-29 01:05:06,337", "thread_id": "4696", "caller": "0x7ff79bc5ddb7", "parentcaller": "0x7ff79bc5c5b7", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x12e40000" }, { "name": "RegionSize", "value": "0x00708000" } ], "repeated": 0, "id": 782 }, { "timestamp": "2026-05-29 01:05:06,337", "thread_id": "4696", "caller": "0x7ff79bc5ddb7", "parentcaller": "0x7ff79bc5c5b7", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022b8" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files (x86)\\Steam\\steam.exe" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 783 }, { "timestamp": "2026-05-29 01:05:06,337", "thread_id": "4696", "caller": "0x7ff79bc5ddb7", "parentcaller": "0x7ff79bc5c5b7", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x40000003", "arguments": [ { "name": "SectionHandle", "value": "0x000023c0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x12e40000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00708000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 784 }, { "timestamp": "2026-05-29 01:05:06,337", "thread_id": "4696", "caller": "0x7ff79bc5ddb7", "parentcaller": "0x7ff79bc5c5b7", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x12e40000" }, { "name": "RegionSize", "value": "0x00708000" } ], "repeated": 0, "id": 785 }, { "timestamp": "2026-05-29 01:05:06,337", "thread_id": "4696", "caller": "0x7ff79bc1afc1", "parentcaller": "0x7ff79bc5de65", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 786 }, { "timestamp": "2026-05-29 01:05:06,368", "thread_id": "8324", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff584c6d2f", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001c50" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 787 }, { "timestamp": "2026-05-29 01:05:06,368", "thread_id": "8324", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 788 }, { "timestamp": "2026-05-29 01:05:06,368", "thread_id": "4636", "caller": "0x7ff79bc846d1", "parentcaller": "0x7ff79bc83f3f", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0C9281F9-6DA1-4006-8729-DE6E6B61581C" }, { "name": "ClsContext", "value": "0x00000004", "pretty_value": "CLSCTX_LOCAL_SERVER" }, { "name": "riid", "value": "DF8E9480-CA73-448E-B8F0-DA000F581428" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 789 }, { "timestamp": "2026-05-29 01:05:06,368", "thread_id": "4636", "caller": "0x7ff79bc8466f", "parentcaller": "0x7ff79bc83f5e", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 790 }, { "timestamp": "2026-05-29 01:05:06,368", "thread_id": "4636", "caller": "0x7ff79bc8466f", "parentcaller": "0x7ff79bc83f5e", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x011938c0" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 791 }, { "timestamp": "2026-05-29 01:05:06,368", "thread_id": "4636", "caller": "0x7ff79bc8466f", "parentcaller": "0x7ff79bc83f5e", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7ff79bfc6f10" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\NotifyIcon" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 792 }, { "timestamp": "2026-05-29 01:05:06,368", "thread_id": "4636", "caller": "0x7ff79bc83f6e", "parentcaller": "0x7ff79bcbffd4", "category": "filesystem", "api": "DeleteFileW", "status": false, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\NotifyIcon\\Microsoft.Explorer.Notification.{ED5178F4-43FE-D94F-51B9-7EDAECD23F8E}.png" } ], "repeated": 0, "id": 793 }, { "timestamp": "2026-05-29 01:05:06,430", "thread_id": "4744", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 794 }, { "timestamp": "2026-05-29 01:05:06,430", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000212c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002124" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 795 }, { "timestamp": "2026-05-29 01:05:06,430", "thread_id": "6252", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 796 }, { "timestamp": "2026-05-29 01:05:06,430", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002124" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 797 }, { "timestamp": "2026-05-29 01:05:06,430", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000212c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000212c" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 798 }, { "timestamp": "2026-05-29 01:05:06,430", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 799 }, { "timestamp": "2026-05-29 01:05:06,430", "thread_id": "4620", "caller": "0x7fff40c74428", "parentcaller": "0x7fff40c73a03", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "F0AE1542-F497-484B-A175-A20DB09144BA" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "8DC24A1A-6314-4769-9D68-179786F4CED6" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 800 }, { "timestamp": "2026-05-29 01:05:06,430", "thread_id": "6252", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff557c9e99", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x4574f454d" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 801 }, { "timestamp": "2026-05-29 01:05:07,102", "thread_id": "6164", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 802 }, { "timestamp": "2026-05-29 01:05:07,102", "thread_id": "6252", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 803 }, { "timestamp": "2026-05-29 01:05:07,102", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000239c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000212c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 804 }, { "timestamp": "2026-05-29 01:05:07,102", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000212c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 805 }, { "timestamp": "2026-05-29 01:05:07,102", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 806 }, { "timestamp": "2026-05-29 01:05:07,102", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000212c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 807 }, { "timestamp": "2026-05-29 01:05:07,102", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000239c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000239c" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 808 }, { "timestamp": "2026-05-29 01:05:07,102", "thread_id": "4620", "caller": "0x7fff40c74428", "parentcaller": "0x7fff40c73a03", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "F0AE1542-F497-484B-A175-A20DB09144BA" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "8DC24A1A-6314-4769-9D68-179786F4CED6" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 809 }, { "timestamp": "2026-05-29 01:05:07,102", "thread_id": "6252", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff557c9e99", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x4574f454d" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 810 }, { "timestamp": "2026-05-29 01:05:07,290", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002130" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000022f4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 811 }, { "timestamp": "2026-05-29 01:05:07,290", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000022f4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 812 }, { "timestamp": "2026-05-29 01:05:07,290", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002130" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000022f4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 813 }, { "timestamp": "2026-05-29 01:05:07,290", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000022f4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 814 }, { "timestamp": "2026-05-29 01:05:07,290", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002130" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000022f4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 815 }, { "timestamp": "2026-05-29 01:05:07,290", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000022f4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 816 }, { "timestamp": "2026-05-29 01:05:07,290", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002130" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000023b8" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 817 }, { "timestamp": "2026-05-29 01:05:07,290", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000023b8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 818 }, { "timestamp": "2026-05-29 01:05:07,368", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002130" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000022f4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 819 }, { "timestamp": "2026-05-29 01:05:07,368", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000022f4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 820 }, { "timestamp": "2026-05-29 01:05:07,368", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002130" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000022f4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 821 }, { "timestamp": "2026-05-29 01:05:07,368", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000022f4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 822 }, { "timestamp": "2026-05-29 01:05:07,368", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002130" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000022f4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 823 }, { "timestamp": "2026-05-29 01:05:07,368", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000022f4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 824 }, { "timestamp": "2026-05-29 01:05:07,368", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002130" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000022f4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 825 }, { "timestamp": "2026-05-29 01:05:07,368", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000022f4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 826 }, { "timestamp": "2026-05-29 01:05:07,399", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002254" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000022f4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 827 }, { "timestamp": "2026-05-29 01:05:07,399", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000022f4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 828 }, { "timestamp": "2026-05-29 01:05:07,399", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000022f4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002254" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 829 }, { "timestamp": "2026-05-29 01:05:07,399", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002254" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 830 }, { "timestamp": "2026-05-29 01:05:07,399", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002130" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001aec" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 831 }, { "timestamp": "2026-05-29 01:05:07,399", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001aec" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 832 }, { "timestamp": "2026-05-29 01:05:07,399", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002254" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002258" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 833 }, { "timestamp": "2026-05-29 01:05:07,399", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002258" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 834 }, { "timestamp": "2026-05-29 01:05:07,415", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002258" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000022b8" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 835 }, { "timestamp": "2026-05-29 01:05:07,415", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000022b8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 836 }, { "timestamp": "2026-05-29 01:05:07,415", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002258" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000022b8" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 837 }, { "timestamp": "2026-05-29 01:05:07,415", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000022b8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 838 }, { "timestamp": "2026-05-29 01:05:07,415", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002258" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000022b8" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 839 }, { "timestamp": "2026-05-29 01:05:07,415", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000022b8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 840 }, { "timestamp": "2026-05-29 01:05:07,415", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000225c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002258" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 841 }, { "timestamp": "2026-05-29 01:05:07,415", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002258" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 842 }, { "timestamp": "2026-05-29 01:05:07,430", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000225c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002260" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 843 }, { "timestamp": "2026-05-29 01:05:07,430", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002260" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 844 }, { "timestamp": "2026-05-29 01:05:07,430", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000225c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002258" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 845 }, { "timestamp": "2026-05-29 01:05:07,430", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002258" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 846 }, { "timestamp": "2026-05-29 01:05:07,430", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000225c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002258" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 847 }, { "timestamp": "2026-05-29 01:05:07,430", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002258" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 848 }, { "timestamp": "2026-05-29 01:05:07,430", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000225c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002258" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 849 }, { "timestamp": "2026-05-29 01:05:07,430", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002258" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 850 }, { "timestamp": "2026-05-29 01:05:07,446", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000239c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002258" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 851 }, { "timestamp": "2026-05-29 01:05:07,446", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002258" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 852 }, { "timestamp": "2026-05-29 01:05:07,446", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000239c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002258" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 853 }, { "timestamp": "2026-05-29 01:05:07,446", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002258" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 854 }, { "timestamp": "2026-05-29 01:05:07,446", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000239c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002258" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 855 }, { "timestamp": "2026-05-29 01:05:07,446", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002258" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 856 }, { "timestamp": "2026-05-29 01:05:07,446", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000239c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002258" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 857 }, { "timestamp": "2026-05-29 01:05:07,446", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002258" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 858 }, { "timestamp": "2026-05-29 01:05:07,462", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002254" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002258" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 859 }, { "timestamp": "2026-05-29 01:05:07,462", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002258" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 860 }, { "timestamp": "2026-05-29 01:05:07,462", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002254" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002258" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 861 }, { "timestamp": "2026-05-29 01:05:07,462", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002258" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 862 }, { "timestamp": "2026-05-29 01:05:07,462", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002254" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002258" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 863 }, { "timestamp": "2026-05-29 01:05:07,462", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002258" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 864 }, { "timestamp": "2026-05-29 01:05:07,462", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002254" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002258" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 865 }, { "timestamp": "2026-05-29 01:05:07,462", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002258" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 866 }, { "timestamp": "2026-05-29 01:05:07,477", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000225c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000239c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 867 }, { "timestamp": "2026-05-29 01:05:07,477", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000239c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 868 }, { "timestamp": "2026-05-29 01:05:07,477", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000225c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000239c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 869 }, { "timestamp": "2026-05-29 01:05:07,477", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000239c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 870 }, { "timestamp": "2026-05-29 01:05:07,477", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000225c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000239c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 871 }, { "timestamp": "2026-05-29 01:05:07,477", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000239c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 872 }, { "timestamp": "2026-05-29 01:05:07,477", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000225c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000239c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 873 }, { "timestamp": "2026-05-29 01:05:07,477", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000239c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 874 }, { "timestamp": "2026-05-29 01:05:07,477", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000225c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002258" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 875 }, { "timestamp": "2026-05-29 01:05:07,477", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002258" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 876 }, { "timestamp": "2026-05-29 01:05:07,477", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002260" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002258" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 877 }, { "timestamp": "2026-05-29 01:05:07,477", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002258" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 878 }, { "timestamp": "2026-05-29 01:05:07,493", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002260" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002258" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 879 }, { "timestamp": "2026-05-29 01:05:07,493", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002258" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 880 }, { "timestamp": "2026-05-29 01:05:07,493", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002260" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002258" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 881 }, { "timestamp": "2026-05-29 01:05:07,493", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002258" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 882 }, { "timestamp": "2026-05-29 01:05:07,493", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000022f4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002258" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 883 }, { "timestamp": "2026-05-29 01:05:07,493", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002258" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 884 }, { "timestamp": "2026-05-29 01:05:07,493", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000022f4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002258" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 885 }, { "timestamp": "2026-05-29 01:05:07,493", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002258" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 886 }, { "timestamp": "2026-05-29 01:05:07,493", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000022f4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002258" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 887 }, { "timestamp": "2026-05-29 01:05:07,493", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002258" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 888 }, { "timestamp": "2026-05-29 01:05:07,493", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000022f4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002258" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 889 }, { "timestamp": "2026-05-29 01:05:07,493", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002258" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 890 }, { "timestamp": "2026-05-29 01:05:07,508", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002260" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000239c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 891 }, { "timestamp": "2026-05-29 01:05:07,508", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000239c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 892 }, { "timestamp": "2026-05-29 01:05:07,508", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000225c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002260" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 893 }, { "timestamp": "2026-05-29 01:05:07,508", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002260" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 894 }, { "timestamp": "2026-05-29 01:05:07,508", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000225c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002260" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 895 }, { "timestamp": "2026-05-29 01:05:07,508", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002260" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 896 }, { "timestamp": "2026-05-29 01:05:07,508", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000225c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000239c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 897 }, { "timestamp": "2026-05-29 01:05:07,508", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000239c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 898 }, { "timestamp": "2026-05-29 01:05:07,524", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002260" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002258" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 899 }, { "timestamp": "2026-05-29 01:05:07,524", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002258" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 900 }, { "timestamp": "2026-05-29 01:05:07,524", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000022f4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002258" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 901 }, { "timestamp": "2026-05-29 01:05:07,524", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002258" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 902 }, { "timestamp": "2026-05-29 01:05:07,524", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002264" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002258" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 903 }, { "timestamp": "2026-05-29 01:05:07,524", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002258" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 904 }, { "timestamp": "2026-05-29 01:05:07,524", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002264" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002258" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 905 }, { "timestamp": "2026-05-29 01:05:07,524", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002258" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 906 }, { "timestamp": "2026-05-29 01:05:07,977", "thread_id": "4620", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\Windows.UI.Xaml" }, { "name": "DllBase", "value": "0x7fff49e50000" } ], "repeated": 0, "id": 907 }, { "timestamp": "2026-05-29 01:05:07,977", "thread_id": "4620", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\Windows.UI.Xaml.dll" }, { "name": "BaseAddress", "value": "0x7fff49e50000" } ], "repeated": 0, "id": 908 }, { "timestamp": "2026-05-29 01:05:07,977", "thread_id": "4620", "caller": "0x7fff4288f84d", "parentcaller": "0x7fff59f938c0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "56F68E55-D114-4C64-996E-6E5F2D5340B2" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00BB2761-6A77-11D0-A535-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 909 }, { "timestamp": "2026-05-29 01:05:07,977", "thread_id": "4620", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\WindowsInternal.ComposableShell.DesktopHosting" }, { "name": "DllBase", "value": "0x7fff4d380000" } ], "repeated": 0, "id": 910 }, { "timestamp": "2026-05-29 01:05:07,993", "thread_id": "4620", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\WindowsInternal.ComposableShell.DesktopHosting.dll" }, { "name": "BaseAddress", "value": "0x7fff4d380000" } ], "repeated": 0, "id": 911 }, { "timestamp": "2026-05-29 01:05:07,993", "thread_id": "4620", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\ShellComponents\\WindowsInternal.ComposableShell.Experiences.Switcher" }, { "name": "DllBase", "value": "0x7fff19080000" } ], "repeated": 0, "id": 912 }, { "timestamp": "2026-05-29 01:05:07,993", "thread_id": "4620", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\ShellComponents\\WindowsInternal.ComposableShell.Experiences.Switcher.dll" }, { "name": "BaseAddress", "value": "0x7fff19080000" } ], "repeated": 0, "id": 913 }, { "timestamp": "2026-05-29 01:05:07,993", "thread_id": "4620", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\ShellExperiences\\TileControl" }, { "name": "DllBase", "value": "0x7fff4d300000" } ], "repeated": 0, "id": 914 }, { "timestamp": "2026-05-29 01:05:07,993", "thread_id": "4620", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\ShellExperiences\\TileControl.dll" }, { "name": "BaseAddress", "value": "0x7fff4d300000" } ], "repeated": 0, "id": 915 }, { "timestamp": "2026-05-29 01:05:07,993", "thread_id": "4620", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\ShellComponents\\TaskFlowUI" }, { "name": "DllBase", "value": "0x7fff18e60000" } ], "repeated": 0, "id": 916 }, { "timestamp": "2026-05-29 01:05:07,993", "thread_id": "4620", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\ShellComponents\\TaskFlowUI.dll" }, { "name": "BaseAddress", "value": "0x7fff18e60000" } ], "repeated": 0, "id": 917 }, { "timestamp": "2026-05-29 01:05:08,008", "thread_id": "4620", "caller": "0x7fff57fcb8ed", "parentcaller": "0x7fff58096d18", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x00002114", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x7fff5809be80" }, { "name": "Parameter", "value": "0x0320f2c0" }, { "name": "CreationFlags", "value": "0x00000000" }, { "name": "ThreadId", "value": "8388" }, { "name": "ProcessId", "value": "4484" } ], "repeated": 0, "id": 918 }, { "timestamp": "2026-05-29 01:05:08,008", "thread_id": "8388", "caller": "0x7fff57fcb8ed", "parentcaller": "0x7fff57c81897", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x000020e4", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x7fff57c81b70" }, { "name": "Parameter", "value": "0x0c8131d0" }, { "name": "CreationFlags", "value": "0x00000000" }, { "name": "ThreadId", "value": "8420" }, { "name": "ProcessId", "value": "4484" } ], "repeated": 0, "id": 919 }, { "timestamp": "2026-05-29 01:05:08,008", "thread_id": "8420", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5485a36b", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002268" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 920 }, { "timestamp": "2026-05-29 01:05:08,008", "thread_id": "8420", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff54879362", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000223c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 921 }, { "timestamp": "2026-05-29 01:05:08,008", "thread_id": "8420", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff577ce6a1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "user32" }, { "name": "BaseAddress", "value": "0x7fff581b0000" } ], "repeated": 0, "id": 922 }, { "timestamp": "2026-05-29 01:05:08,008", "thread_id": "8420", "caller": "0x7fff57fcb8ed", "parentcaller": "0x7fff4a1a4521", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x00002220", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x7fff49fe8520" }, { "name": "Parameter", "value": "0x076a4970" }, { "name": "CreationFlags", "value": "0x00000000" }, { "name": "ThreadId", "value": "8424" }, { "name": "ProcessId", "value": "4484" } ], "repeated": 0, "id": 923 }, { "timestamp": "2026-05-29 01:05:08,008", "thread_id": "8420", "caller": "0x7fff57fcb8ed", "parentcaller": "0x7fff4a15f628", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x0000210c", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x7fff4a189630" }, { "name": "Parameter", "value": "0x076d54d0" }, { "name": "CreationFlags", "value": "0x00000000" }, { "name": "ThreadId", "value": "8464" }, { "name": "ProcessId", "value": "4484" } ], "repeated": 0, "id": 924 }, { "timestamp": "2026-05-29 01:05:08,008", "thread_id": "8424", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff49fe90e9", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "dxgi.dll" }, { "name": "BaseAddress", "value": "0x7fff55ef0000" } ], "repeated": 0, "id": 925 }, { "timestamp": "2026-05-29 01:05:08,008", "thread_id": "8424", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff577ce6a1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "gdi32.dll" }, { "name": "BaseAddress", "value": "0x7fff58350000" } ], "repeated": 1, "id": 926 }, { "timestamp": "2026-05-29 01:05:08,008", "thread_id": "8420", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\iertutil.dll" }, { "name": "BaseAddress", "value": "0x7fff4d6a0000" } ], "repeated": 0, "id": 927 }, { "timestamp": "2026-05-29 01:05:08,008", "thread_id": "8420", "caller": "0x7fff4a0c01ed", "parentcaller": "0x7fff4a0bfe43", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "DBCE7E40-7345-439D-B12C-114A11819A09" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "130A2F65-2BE7-4309-9A58-A9052FF2B61C" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 928 }, { "timestamp": "2026-05-29 01:05:08,008", "thread_id": "8420", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\CoreMessaging.dll" }, { "name": "BaseAddress", "value": "0x7fff54850000" } ], "repeated": 0, "id": 929 }, { "timestamp": "2026-05-29 01:05:08,008", "thread_id": "8420", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff4a19924a", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "windows.ui.dll" }, { "name": "BaseAddress", "value": "0x7fff4bfb0000" } ], "repeated": 0, "id": 930 }, { "timestamp": "2026-05-29 01:05:08,008", "thread_id": "8420", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff4bfd4bf9", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002390" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 931 }, { "timestamp": "2026-05-29 01:05:08,024", "thread_id": "8420", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\UiaManager" }, { "name": "DllBase", "value": "0x7fff46660000" } ], "repeated": 0, "id": 932 }, { "timestamp": "2026-05-29 01:05:08,024", "thread_id": "8420", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\UiaManager.dll" }, { "name": "BaseAddress", "value": "0x7fff46660000" } ], "repeated": 0, "id": 933 }, { "timestamp": "2026-05-29 01:05:08,024", "thread_id": "8420", "caller": "0x7fff4bfc1d49", "parentcaller": "0x7fff4bfd12ef", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "77CBBBB7-6CD0-48ED-A02B-52FBB0E43ECD" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "94552329-F99E-4F8A-B128-6CC2AE7FE28C" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 934 }, { "timestamp": "2026-05-29 01:05:08,024", "thread_id": "8424", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff55f01bd0", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "d3d10warp.dll" }, { "name": "BaseAddress", "value": "0x7fff4faa0000" } ], "repeated": 0, "id": 935 }, { "timestamp": "2026-05-29 01:05:08,024", "thread_id": "8424", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5f3e", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002114" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\explorer.exe" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 936 }, { "timestamp": "2026-05-29 01:05:08,024", "thread_id": "8420", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 937 }, { "timestamp": "2026-05-29 01:05:08,024", "thread_id": "8424", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001b3c" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\d3d10warp.dll" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 938 }, { "timestamp": "2026-05-29 01:05:08,024", "thread_id": "8424", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff4a155932", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "d2d1.dll" }, { "name": "BaseAddress", "value": "0x7fff53a90000" } ], "repeated": 0, "id": 939 }, { "timestamp": "2026-05-29 01:05:08,024", "thread_id": "8420", "caller": "0x7fff46663c85", "parentcaller": "0x7fff4bfc1d69", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "4B7A83D5-CF71-40AD-AB0F-BF6830E95330" }, { "name": "ClsContext", "value": "0x00000004", "pretty_value": "CLSCTX_LOCAL_SERVER" }, { "name": "riid", "value": "83140D1C-7E82-4CFB-96E4-F997CEDE7E10" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 940 }, { "timestamp": "2026-05-29 01:05:08,024", "thread_id": "8420", "caller": "0x7fff5808f55f", "parentcaller": "0x7fff5807705e", "category": "system", "api": "SetWindowsHookExW", "status": true, "return": "0x000103d9", "arguments": [ { "name": "HookIdentifier", "value": "4", "pretty_value": "WH_CALLWNDPROC" }, { "name": "ProcedureAddress", "value": "0x7fff5808fa40" }, { "name": "ModuleAddress", "value": "0x7fff58070000" }, { "name": "ThreadId", "value": "8420" } ], "repeated": 0, "id": 941 }, { "timestamp": "2026-05-29 01:05:08,024", "thread_id": "8420", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff4a19919c", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "windows.ui.core.textinput.dll" }, { "name": "BaseAddress", "value": "0x7fff406e0000" } ], "repeated": 0, "id": 942 }, { "timestamp": "2026-05-29 01:05:08,024", "thread_id": "8420", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff541cc2ff", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002078" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 943 }, { "timestamp": "2026-05-29 01:05:08,024", "thread_id": "8420", "caller": "0x7fff577f4448", "parentcaller": "0x7fff5485d2de", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x04c61000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 944 }, { "timestamp": "2026-05-29 01:05:08,040", "thread_id": "8420", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000208c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x12ebdff0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 945 }, { "timestamp": "2026-05-29 01:05:08,040", "thread_id": "8420", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff581d2b57", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\SHCore.dll" }, { "name": "BaseAddress", "value": "0x7fff58070000" } ], "repeated": 0, "id": 946 }, { "timestamp": "2026-05-29 01:05:08,040", "thread_id": "8424", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff49fe95c7", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "dwrite.dll" }, { "name": "BaseAddress", "value": "0x7fff49a90000" } ], "repeated": 0, "id": 947 }, { "timestamp": "2026-05-29 01:05:08,040", "thread_id": "8420", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000202c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x12ebf1a0" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 948 }, { "timestamp": "2026-05-29 01:05:08,040", "thread_id": "8420", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c232", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002090" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x12ebf260" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 949 }, { "timestamp": "2026-05-29 01:05:08,040", "thread_id": "8420", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002090" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x12ebf260" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 950 }, { "timestamp": "2026-05-29 01:05:08,040", "thread_id": "5000", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c232", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000020b8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x0819f6d0" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 951 }, { "timestamp": "2026-05-29 01:05:08,040", "thread_id": "5000", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 952 }, { "timestamp": "2026-05-29 01:05:08,040", "thread_id": "8420", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 953 }, { "timestamp": "2026-05-29 01:05:08,040", "thread_id": "8420", "caller": "0x7fff51828bd4", "parentcaller": "0x7fff51828b3e", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "228826AF-02E1-4226-A9E0-99A855E455A6" }, { "name": "ClsContext", "value": "0x00000404", "pretty_value": "CLSCTX_LOCAL_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "9767060C-9476-42E2-8F7B-2F10FD13765C" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 954 }, { "timestamp": "2026-05-29 01:05:08,040", "thread_id": "5000", "caller": "0x7fff430be605", "parentcaller": "0x7fff597db583", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "7ED25D63-48E5-4BE3-8539-3040B0B8991C" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "D4351E8C-208E-4C24-88AC-6E2ADD5F4BB1" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 955 }, { "timestamp": "2026-05-29 01:05:08,040", "thread_id": "8420", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff55efc5cc", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "gdi32.dll" }, { "name": "BaseAddress", "value": "0x7fff58350000" } ], "repeated": 0, "id": 956 }, { "timestamp": "2026-05-29 01:05:08,040", "thread_id": "5000", "caller": "0x7fff41dbd59f", "parentcaller": "0x7fff41dfc80c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000020c8" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "\\Device\\Bam" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 957 }, { "timestamp": "2026-05-29 01:05:08,055", "thread_id": "8420", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f04" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\Windows.UI.Xaml.Resources.19H1.dll" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 958 }, { "timestamp": "2026-05-29 01:05:08,055", "thread_id": "8420", "caller": "0x7fff577d7786", "parentcaller": "0x7fff577d5630", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x40000003", "arguments": [ { "name": "SectionHandle", "value": "0x000008f0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x12fc0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x000af000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 959 }, { "timestamp": "2026-05-29 01:05:08,055", "thread_id": "8420", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff4a130f36", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "dwrite.dll" }, { "name": "BaseAddress", "value": "0x7fff49a90000" } ], "repeated": 0, "id": 960 }, { "timestamp": "2026-05-29 01:05:08,087", "thread_id": "8424", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001eec" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\Fonts\\segoeui.ttf" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 961 }, { "timestamp": "2026-05-29 01:05:08,087", "thread_id": "8424", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c232", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000203c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x13070000" }, { "name": "SectionOffset", "value": "0x12f3db20" }, { "name": "ViewSize", "value": "0x000ea000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 962 }, { "timestamp": "2026-05-29 01:05:08,133", "thread_id": "8424", "caller": "0x7fff577f4448", "parentcaller": "0x7fff4fde9ad1", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 963 }, { "timestamp": "2026-05-29 01:05:08,133", "thread_id": "8424", "caller": "0x7fff577f4448", "parentcaller": "0x7fff4fde9ad1", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7df4ae180000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000001", "pretty_value": "PAGE_NOACCESS" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 964 }, { "timestamp": "2026-05-29 01:05:08,133", "thread_id": "8424", "caller": "0x7fff577f4448", "parentcaller": "0x7fff4fde9db5", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7df4ae180000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 965 }, { "timestamp": "2026-05-29 01:05:08,133", "thread_id": "8424", "caller": "0x7fff577f4448", "parentcaller": "0x7fff4fde9f77", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7df4ae180000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 966 }, { "timestamp": "2026-05-29 01:05:08,133", "thread_id": "8424", "caller": "0x7fff577f4448", "parentcaller": "0x7fff4fde9f77", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7df4ae181000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x40000020", "pretty_value": "PAGE_EXECUTE_READ|0x40000000" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 967 }, { "timestamp": "2026-05-29 01:05:08,415", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001e78" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002060" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 968 }, { "timestamp": "2026-05-29 01:05:08,415", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002060" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 969 }, { "timestamp": "2026-05-29 01:05:08,415", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001e78" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002060" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 970 }, { "timestamp": "2026-05-29 01:05:08,415", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002060" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 971 }, { "timestamp": "2026-05-29 01:05:08,415", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002060" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001088" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 972 }, { "timestamp": "2026-05-29 01:05:08,415", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001088" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 973 }, { "timestamp": "2026-05-29 01:05:08,415", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002060" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001088" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 974 }, { "timestamp": "2026-05-29 01:05:08,415", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001088" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 975 }, { "timestamp": "2026-05-29 01:05:08,415", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002060" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001088" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 976 }, { "timestamp": "2026-05-29 01:05:08,415", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001088" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 977 }, { "timestamp": "2026-05-29 01:05:08,415", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001fa4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001088" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 978 }, { "timestamp": "2026-05-29 01:05:08,415", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001088" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 979 }, { "timestamp": "2026-05-29 01:05:08,415", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001fa4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001088" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 980 }, { "timestamp": "2026-05-29 01:05:08,415", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001088" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 981 }, { "timestamp": "2026-05-29 01:05:08,415", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001fa4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001088" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 982 }, { "timestamp": "2026-05-29 01:05:08,415", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001088" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 983 }, { "timestamp": "2026-05-29 01:05:08,415", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001fa4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001088" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 984 }, { "timestamp": "2026-05-29 01:05:08,415", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001088" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 985 }, { "timestamp": "2026-05-29 01:05:08,415", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001fa4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001088" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 986 }, { "timestamp": "2026-05-29 01:05:08,415", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001088" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 987 }, { "timestamp": "2026-05-29 01:05:08,415", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001fa4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001f80" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 988 }, { "timestamp": "2026-05-29 01:05:08,415", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001f80" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 989 }, { "timestamp": "2026-05-29 01:05:08,415", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001fa4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001088" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 990 }, { "timestamp": "2026-05-29 01:05:08,415", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001088" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 991 }, { "timestamp": "2026-05-29 01:05:08,415", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001fa4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001088" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 992 }, { "timestamp": "2026-05-29 01:05:08,415", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001088" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 993 }, { "timestamp": "2026-05-29 01:05:08,415", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001f80" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001088" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 994 }, { "timestamp": "2026-05-29 01:05:08,415", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001088" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 995 }, { "timestamp": "2026-05-29 01:05:08,415", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001f80" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001088" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 996 }, { "timestamp": "2026-05-29 01:05:08,415", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001088" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 997 }, { "timestamp": "2026-05-29 01:05:08,415", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001f80" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000a0c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 998 }, { "timestamp": "2026-05-29 01:05:08,415", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000a0c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 999 }, { "timestamp": "2026-05-29 01:05:08,415", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001fa4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000a0c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1000 }, { "timestamp": "2026-05-29 01:05:08,415", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000a0c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1001 }, { "timestamp": "2026-05-29 01:05:08,415", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001fa4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000a0c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1002 }, { "timestamp": "2026-05-29 01:05:08,415", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000a0c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1003 }, { "timestamp": "2026-05-29 01:05:08,415", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001fa4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000a0c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1004 }, { "timestamp": "2026-05-29 01:05:08,415", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000a0c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1005 }, { "timestamp": "2026-05-29 01:05:08,415", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001fa4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000a0c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1006 }, { "timestamp": "2026-05-29 01:05:08,415", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000a0c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1007 }, { "timestamp": "2026-05-29 01:05:08,508", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001fa4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000a0c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1008 }, { "timestamp": "2026-05-29 01:05:08,508", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000a0c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1009 }, { "timestamp": "2026-05-29 01:05:08,508", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001fa4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000a0c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1010 }, { "timestamp": "2026-05-29 01:05:08,508", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000a0c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1011 }, { "timestamp": "2026-05-29 01:05:08,508", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001f80" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001088" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1012 }, { "timestamp": "2026-05-29 01:05:08,508", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001088" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1013 }, { "timestamp": "2026-05-29 01:05:08,508", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001f80" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000a0c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1014 }, { "timestamp": "2026-05-29 01:05:08,508", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000a0c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1015 }, { "timestamp": "2026-05-29 01:05:08,508", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001f80" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001e68" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1016 }, { "timestamp": "2026-05-29 01:05:08,508", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001e68" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1017 }, { "timestamp": "2026-05-29 01:05:08,508", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001e68" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001f80" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1018 }, { "timestamp": "2026-05-29 01:05:08,508", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001f80" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1019 }, { "timestamp": "2026-05-29 01:05:08,508", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001f80" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002060" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1020 }, { "timestamp": "2026-05-29 01:05:08,508", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002060" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1021 }, { "timestamp": "2026-05-29 01:05:08,508", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000a0c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002060" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1022 }, { "timestamp": "2026-05-29 01:05:08,508", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002060" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1023 }, { "timestamp": "2026-05-29 01:05:08,508", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002060" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000a0c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1024 }, { "timestamp": "2026-05-29 01:05:08,508", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000a0c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1025 }, { "timestamp": "2026-05-29 01:05:08,508", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001e68" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000019d4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1026 }, { "timestamp": "2026-05-29 01:05:08,508", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000019d4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1027 }, { "timestamp": "2026-05-29 01:05:08,508", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002060" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001e68" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1028 }, { "timestamp": "2026-05-29 01:05:08,508", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001e68" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1029 }, { "timestamp": "2026-05-29 01:05:08,508", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001e68" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000019d4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1030 }, { "timestamp": "2026-05-29 01:05:08,508", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000019d4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1031 }, { "timestamp": "2026-05-29 01:05:08,508", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000a0c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000019d4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1032 }, { "timestamp": "2026-05-29 01:05:08,508", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000019d4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1033 }, { "timestamp": "2026-05-29 01:05:08,508", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000a0c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001fc4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1034 }, { "timestamp": "2026-05-29 01:05:08,508", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001fc4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1035 }, { "timestamp": "2026-05-29 01:05:08,508", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001f80" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000019d4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1036 }, { "timestamp": "2026-05-29 01:05:08,508", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000019d4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1037 }, { "timestamp": "2026-05-29 01:05:08,508", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001f80" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000019d4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1038 }, { "timestamp": "2026-05-29 01:05:08,508", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000019d4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1039 }, { "timestamp": "2026-05-29 01:05:08,524", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001f80" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000019d4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1040 }, { "timestamp": "2026-05-29 01:05:08,524", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000019d4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1041 }, { "timestamp": "2026-05-29 01:05:08,524", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001f80" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000019d4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1042 }, { "timestamp": "2026-05-29 01:05:08,524", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000019d4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1043 }, { "timestamp": "2026-05-29 01:05:08,571", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001088" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000019d4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1044 }, { "timestamp": "2026-05-29 01:05:08,571", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000019d4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1045 }, { "timestamp": "2026-05-29 01:05:08,571", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001e68" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000019d4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1046 }, { "timestamp": "2026-05-29 01:05:08,571", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000019d4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1047 }, { "timestamp": "2026-05-29 01:05:08,587", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001088" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000019d4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1048 }, { "timestamp": "2026-05-29 01:05:08,587", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000019d4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1049 }, { "timestamp": "2026-05-29 01:05:08,587", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001088" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001fc4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1050 }, { "timestamp": "2026-05-29 01:05:08,587", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001fc4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1051 }, { "timestamp": "2026-05-29 01:05:08,587", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001fc4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000019d4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1052 }, { "timestamp": "2026-05-29 01:05:08,587", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000019d4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1053 }, { "timestamp": "2026-05-29 01:05:08,587", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001e68" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000019d4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1054 }, { "timestamp": "2026-05-29 01:05:08,587", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000019d4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1055 }, { "timestamp": "2026-05-29 01:05:08,665", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001e68" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000019d4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1056 }, { "timestamp": "2026-05-29 01:05:08,665", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000019d4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1057 }, { "timestamp": "2026-05-29 01:05:08,665", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001fc4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001e68" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1058 }, { "timestamp": "2026-05-29 01:05:08,665", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001e68" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1059 }, { "timestamp": "2026-05-29 01:05:08,680", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000019d4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001e68" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1060 }, { "timestamp": "2026-05-29 01:05:08,680", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001e68" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1061 }, { "timestamp": "2026-05-29 01:05:08,680", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000019d4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001e68" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1062 }, { "timestamp": "2026-05-29 01:05:08,680", "thread_id": "4696", "caller": "0x7ff79bded17e", "parentcaller": "0x7ff79bdf0d94", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001e68" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x035cf4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1063 }, { "timestamp": "2026-05-29 01:05:10,071", "thread_id": "4744", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1064 }, { "timestamp": "2026-05-29 01:05:10,071", "thread_id": "4620", "caller": "0x7ff79bcb8fba", "parentcaller": "0x00000000", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1065 }, { "timestamp": "2026-05-29 01:05:10,071", "thread_id": "4620", "caller": "0x7ff79bcb8fba", "parentcaller": "0x00000000", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "C2F03A33-21F5-47FA-B4BB-156362A2F239" }, { "name": "ClsContext", "value": "0x00000404", "pretty_value": "CLSCTX_LOCAL_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "6D5140C1-7436-11CE-8034-00AA006009FA" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1066 }, { "timestamp": "2026-05-29 01:05:10,071", "thread_id": "5000", "caller": "0x7fff41dbd59f", "parentcaller": "0x7fff41dfc80c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001668" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "\\Device\\Bam" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1067 }, { "timestamp": "2026-05-29 01:05:10,071", "thread_id": "5000", "caller": "0x7fff41dbe842", "parentcaller": "0x7fff41dbd62c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f80" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "\\Device\\Bam" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1068 }, { "timestamp": "2026-05-29 01:05:10,087", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 1069 }, { "timestamp": "2026-05-29 01:05:10,212", "thread_id": "4744", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1070 }, { "timestamp": "2026-05-29 01:05:10,212", "thread_id": "4696", "caller": "0x7ff79bc1f2e2", "parentcaller": "0x7ff79bc1f1d3", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1071 }, { "timestamp": "2026-05-29 01:05:10,212", "thread_id": "4696", "caller": "0x7ff79bc1f2e2", "parentcaller": "0x7ff79bc1f1d3", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "C2F03A33-21F5-47FA-B4BB-156362A2F239" }, { "name": "ClsContext", "value": "0x00000404", "pretty_value": "CLSCTX_LOCAL_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "6D5140C1-7436-11CE-8034-00AA006009FA" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1072 }, { "timestamp": "2026-05-29 01:05:10,212", "thread_id": "4620", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c232", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000019d4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09fd0000" }, { "name": "SectionOffset", "value": "0x0320f950" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1073 }, { "timestamp": "2026-05-29 01:05:10,212", "thread_id": "4812", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff584c6d2f", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001668" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1074 }, { "timestamp": "2026-05-29 01:05:10,212", "thread_id": "3820", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5978ef53", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000019d4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1075 }, { "timestamp": "2026-05-29 01:05:10,212", "thread_id": "3820", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff584c6d2f", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000016a8" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1076 }, { "timestamp": "2026-05-29 01:05:10,227", "thread_id": "4344", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1077 }, { "timestamp": "2026-05-29 01:05:10,227", "thread_id": "5000", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1078 }, { "timestamp": "2026-05-29 01:05:10,227", "thread_id": "8552", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5978ef53", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002260" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1079 }, { "timestamp": "2026-05-29 01:05:10,227", "thread_id": "6152", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5978ef53", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001fa0" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1080 }, { "timestamp": "2026-05-29 01:05:10,227", "thread_id": "3424", "caller": "0x7ff79bc79d10", "parentcaller": "0x7ff79bc79c74", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1081 }, { "timestamp": "2026-05-29 01:05:10,227", "thread_id": "6152", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff584c6d2f", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001f04" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1082 }, { "timestamp": "2026-05-29 01:05:10,227", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 1083 }, { "timestamp": "2026-05-29 01:05:10,227", "thread_id": "5000", "caller": "0x7fff41dbd59f", "parentcaller": "0x7fff41dfc80c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001fc4" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "\\Device\\Bam" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1084 }, { "timestamp": "2026-05-29 01:05:10,227", "thread_id": "5000", "caller": "0x7fff41dbe842", "parentcaller": "0x7fff41dbd62c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002414" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "\\Device\\Bam" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1085 }, { "timestamp": "2026-05-29 01:05:10,227", "thread_id": "5000", "caller": "0x7fff58519794", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "F6C29334-47DC-4397-9150-F549CF1D4861" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1086 }, { "timestamp": "2026-05-29 01:05:10,243", "thread_id": "5000", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c232", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001fc4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09fd0000" }, { "name": "SectionOffset", "value": "0x0819e510" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1087 }, { "timestamp": "2026-05-29 01:05:10,243", "thread_id": "5000", "caller": "0x7fff58519794", "parentcaller": "0x7fff517eb1dd", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "F6C29334-47DC-4397-9150-F549CF1D4861" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1088 }, { "timestamp": "2026-05-29 01:05:10,243", "thread_id": "8552", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff584c6d2f", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002410" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1089 }, { "timestamp": "2026-05-29 01:05:10,243", "thread_id": "5000", "caller": "0x7fff58519794", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "F6C29334-47DC-4397-9150-F549CF1D4861" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1090 }, { "timestamp": "2026-05-29 01:05:10,258", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 7, "id": 1091 }, { "timestamp": "2026-05-29 01:05:10,274", "thread_id": "4620", "caller": "0x7fff57fcb8ed", "parentcaller": "0x7fff58085341", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x00001fc4", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x7fff580853d0" }, { "name": "Parameter", "value": "0x04b8bd70" }, { "name": "CreationFlags", "value": "0x00000004" }, { "name": "ThreadId", "value": "5368" }, { "name": "ProcessId", "value": "4484" } ], "repeated": 0, "id": 1092 }, { "timestamp": "2026-05-29 01:05:10,274", "thread_id": "4620", "caller": "0x7fff5781f430", "parentcaller": "0x7fff58085379", "category": "threading", "api": "NtResumeThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00001fc4" }, { "name": "SuspendCount", "value": "1" }, { "name": "ThreadId", "value": "5368" }, { "name": "ProcessId", "value": "4484" } ], "repeated": 0, "id": 1093 }, { "timestamp": "2026-05-29 01:05:10,274", "thread_id": "8552", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c232", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001fc4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09fd0000" }, { "name": "SectionOffset", "value": "0x100cf510" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1094 }, { "timestamp": "2026-05-29 01:05:10,274", "thread_id": "4696", "caller": "0x7ff79bc211b7", "parentcaller": "0x7ff79bc214a4", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "95B63696-18B6-4D3E-8EC2-CDB4352318EB" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "5FEFBB8E-82C3-4EC4-93A0-05C4B9FCD4CD" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1095 }, { "timestamp": "2026-05-29 01:05:10,274", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1096 }, { "timestamp": "2026-05-29 01:05:10,274", "thread_id": "4620", "caller": "0x7fff46713ec2", "parentcaller": "0x7fff584cb8f1", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "6C3EE638-B588-4D7D-B30A-E7E36759305D" }, { "name": "ClsContext", "value": "0x00000004", "pretty_value": "CLSCTX_LOCAL_SERVER" }, { "name": "riid", "value": "54E4C428-D1D4-47D4-ADE6-46C829114A7D" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1097 }, { "timestamp": "2026-05-29 01:05:10,274", "thread_id": "4620", "caller": "0x7fff425c54ef", "parentcaller": "0x7fff425c5361", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "45BA127D-10A8-46EA-8AB7-56EA9078943C" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "54E4C428-D1D4-47D4-ADE6-46C829114A7D" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1098 }, { "timestamp": "2026-05-29 01:05:10,290", "thread_id": "6164", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff584c6d2f", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000241c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1099 }, { "timestamp": "2026-05-29 01:05:10,290", "thread_id": "6164", "caller": "0x7fff58519794", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "F1C46D71-B791-4110-8D5C-7108F22C1010" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1100 }, { "timestamp": "2026-05-29 01:05:10,290", "thread_id": "6164", "caller": "0x7fff585192b9", "parentcaller": "0x7fff584e8db3", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1101 }, { "timestamp": "2026-05-29 01:05:11,696", "thread_id": "6164", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 3, "id": 1102 }, { "timestamp": "2026-05-29 01:05:11,758", "thread_id": "4344", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 7, "id": 1103 }, { "timestamp": "2026-05-29 01:05:11,758", "thread_id": "4636", "caller": "0x7fff58c2c304", "parentcaller": "0x7fff44c012c7", "category": "windows", "api": "SendNotifyMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000100ac" }, { "name": "Message", "value": "0x00000403" } ], "repeated": 0, "id": 1104 }, { "timestamp": "2026-05-29 01:05:11,758", "thread_id": "4696", "caller": "0x7ff79bc7b46c", "parentcaller": "0x7ff79be49fd3", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 1105 }, { "timestamp": "2026-05-29 01:05:11,758", "thread_id": "4696", "caller": "0x7ff79bc7b46c", "parentcaller": "0x7ff79be49fd3", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "4234D49B-0245-4DF3-B780-3893943456E1" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "000214E6-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1106 }, { "timestamp": "2026-05-29 01:05:11,758", "thread_id": "4344", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1107 }, { "timestamp": "2026-05-29 01:05:11,774", "thread_id": "4344", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 1108 }, { "timestamp": "2026-05-29 01:05:11,774", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1109 }, { "timestamp": "2026-05-29 01:05:11,774", "thread_id": "4344", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 4, "id": 1110 }, { "timestamp": "2026-05-29 01:05:11,774", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1111 }, { "timestamp": "2026-05-29 01:05:11,774", "thread_id": "4620", "caller": "0x7fff428f25a2", "parentcaller": "0x7fff4260a36f", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "6B3B8D23-FA8D-40B9-8DBD-B950333E2C52" }, { "name": "ClsContext", "value": "0x00000004", "pretty_value": "CLSCTX_LOCAL_SERVER" }, { "name": "riid", "value": "6D5140C1-7436-11CE-8034-00AA006009FA" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1112 }, { "timestamp": "2026-05-29 01:05:11,774", "thread_id": "4636", "caller": "0x7fff58c2c304", "parentcaller": "0x7fff44c012c7", "category": "windows", "api": "SendNotifyMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000100ac" }, { "name": "Message", "value": "0x00000403" } ], "repeated": 0, "id": 1113 }, { "timestamp": "2026-05-29 01:05:11,774", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1114 }, { "timestamp": "2026-05-29 01:05:11,774", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 7, "id": 1115 }, { "timestamp": "2026-05-29 01:05:11,774", "thread_id": "4636", "caller": "0x7fff58c2c304", "parentcaller": "0x7fff44c012c7", "category": "windows", "api": "SendNotifyMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000100ac" }, { "name": "Message", "value": "0x00000403" } ], "repeated": 0, "id": 1116 }, { "timestamp": "2026-05-29 01:05:11,774", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1117 }, { "timestamp": "2026-05-29 01:05:11,774", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 7, "id": 1118 }, { "timestamp": "2026-05-29 01:05:11,774", "thread_id": "4636", "caller": "0x7fff58c2c304", "parentcaller": "0x7fff44c012c7", "category": "windows", "api": "SendNotifyMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000100ac" }, { "name": "Message", "value": "0x00000403" } ], "repeated": 0, "id": 1119 }, { "timestamp": "2026-05-29 01:05:11,774", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1120 }, { "timestamp": "2026-05-29 01:05:11,790", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 10, "id": 1121 }, { "timestamp": "2026-05-29 01:05:11,790", "thread_id": "4636", "caller": "0x7fff58c2c304", "parentcaller": "0x7fff44c012c7", "category": "windows", "api": "SendNotifyMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000100ac" }, { "name": "Message", "value": "0x00000403" } ], "repeated": 0, "id": 1122 }, { "timestamp": "2026-05-29 01:05:11,790", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1123 }, { "timestamp": "2026-05-29 01:05:11,790", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 7, "id": 1124 }, { "timestamp": "2026-05-29 01:05:11,790", "thread_id": "4636", "caller": "0x7fff58c2c304", "parentcaller": "0x7fff44c012c7", "category": "windows", "api": "SendNotifyMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000100ac" }, { "name": "Message", "value": "0x00000403" } ], "repeated": 0, "id": 1125 }, { "timestamp": "2026-05-29 01:05:11,790", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1126 }, { "timestamp": "2026-05-29 01:05:11,790", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 7, "id": 1127 }, { "timestamp": "2026-05-29 01:05:11,790", "thread_id": "4636", "caller": "0x7fff58c2c304", "parentcaller": "0x7fff44c012c7", "category": "windows", "api": "SendNotifyMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000100ac" }, { "name": "Message", "value": "0x00000403" } ], "repeated": 0, "id": 1128 }, { "timestamp": "2026-05-29 01:05:11,790", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1129 }, { "timestamp": "2026-05-29 01:05:11,805", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 3, "id": 1130 }, { "timestamp": "2026-05-29 01:05:11,805", "thread_id": "4620", "caller": "0x7fff44bc5d4a", "parentcaller": "0x7fff44bc618f", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "DBCE7E40-7345-439D-B12C-114A11819A09" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "130A2F65-2BE7-4309-9A58-A9052FF2B61C" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1131 }, { "timestamp": "2026-05-29 01:05:11,805", "thread_id": "4620", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002420" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\SystemApps\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\\resources.pri" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1132 }, { "timestamp": "2026-05-29 01:05:11,805", "thread_id": "4620", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000243c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x13160000" }, { "name": "SectionOffset", "value": "0x0320ebf0" }, { "name": "ViewSize", "value": "0x002a2000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1133 }, { "timestamp": "2026-05-29 01:05:11,805", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 4, "id": 1134 }, { "timestamp": "2026-05-29 01:05:11,805", "thread_id": "4636", "caller": "0x7fff58c2c304", "parentcaller": "0x7fff44c012c7", "category": "windows", "api": "SendNotifyMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000100ac" }, { "name": "Message", "value": "0x00000403" } ], "repeated": 0, "id": 1135 }, { "timestamp": "2026-05-29 01:05:11,805", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1136 }, { "timestamp": "2026-05-29 01:05:11,805", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 7, "id": 1137 }, { "timestamp": "2026-05-29 01:05:11,805", "thread_id": "4636", "caller": "0x7fff58c2c304", "parentcaller": "0x7fff44c012c7", "category": "windows", "api": "SendNotifyMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000100ac" }, { "name": "Message", "value": "0x00000403" } ], "repeated": 0, "id": 1138 }, { "timestamp": "2026-05-29 01:05:11,805", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1139 }, { "timestamp": "2026-05-29 01:05:11,821", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 3, "id": 1140 }, { "timestamp": "2026-05-29 01:05:11,821", "thread_id": "4620", "caller": "0x7fff44bc5d4a", "parentcaller": "0x7fff44bc618f", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "DBCE7E40-7345-439D-B12C-114A11819A09" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "130A2F65-2BE7-4309-9A58-A9052FF2B61C" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1141 }, { "timestamp": "2026-05-29 01:05:11,821", "thread_id": "4620", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002444" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\SystemApps\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\\resources.pri" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1142 }, { "timestamp": "2026-05-29 01:05:11,821", "thread_id": "4620", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000242c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x13160000" }, { "name": "SectionOffset", "value": "0x0320ebf0" }, { "name": "ViewSize", "value": "0x002a2000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1143 }, { "timestamp": "2026-05-29 01:05:11,821", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 6, "id": 1144 }, { "timestamp": "2026-05-29 01:05:11,821", "thread_id": "4636", "caller": "0x7fff58c2c304", "parentcaller": "0x7fff44c012c7", "category": "windows", "api": "SendNotifyMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000100ac" }, { "name": "Message", "value": "0x00000403" } ], "repeated": 0, "id": 1145 }, { "timestamp": "2026-05-29 01:05:11,993", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002444" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001f38" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1146 }, { "timestamp": "2026-05-29 01:05:11,993", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001f38" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0b2c0000" }, { "name": "SectionOffset", "value": "0x0779f1f0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1147 }, { "timestamp": "2026-05-29 01:05:11,993", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002444" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002444" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1148 }, { "timestamp": "2026-05-29 01:05:11,993", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000242c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002444" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1149 }, { "timestamp": "2026-05-29 01:05:11,993", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002444" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0b2c0000" }, { "name": "SectionOffset", "value": "0x0779f1f0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1150 }, { "timestamp": "2026-05-29 01:05:11,993", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000242c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000242c" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1151 }, { "timestamp": "2026-05-29 01:05:11,993", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000240c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000242c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1152 }, { "timestamp": "2026-05-29 01:05:11,993", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000242c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0b2c0000" }, { "name": "SectionOffset", "value": "0x0779f1f0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1153 }, { "timestamp": "2026-05-29 01:05:11,993", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000240c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000240c" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1154 }, { "timestamp": "2026-05-29 01:05:11,993", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002424" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002420" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1155 }, { "timestamp": "2026-05-29 01:05:11,993", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002420" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0b2c0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1156 }, { "timestamp": "2026-05-29 01:05:11,993", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002424" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002424" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1157 }, { "timestamp": "2026-05-29 01:05:11,993", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000243c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002424" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1158 }, { "timestamp": "2026-05-29 01:05:11,993", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002424" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0b2c0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1159 }, { "timestamp": "2026-05-29 01:05:11,993", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000243c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000243c" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1160 }, { "timestamp": "2026-05-29 01:05:11,993", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002428" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000243c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1161 }, { "timestamp": "2026-05-29 01:05:11,993", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000243c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0b2c0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1162 }, { "timestamp": "2026-05-29 01:05:11,993", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002428" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002428" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1163 }, { "timestamp": "2026-05-29 01:05:11,993", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002440" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002428" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1164 }, { "timestamp": "2026-05-29 01:05:11,993", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002428" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0b2c0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1165 }, { "timestamp": "2026-05-29 01:05:11,993", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002440" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002440" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1166 }, { "timestamp": "2026-05-29 01:05:11,993", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002448" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002440" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1167 }, { "timestamp": "2026-05-29 01:05:11,993", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002440" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0b2c0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1168 }, { "timestamp": "2026-05-29 01:05:11,993", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002448" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002448" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1169 }, { "timestamp": "2026-05-29 01:05:11,993", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000244c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002448" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1170 }, { "timestamp": "2026-05-29 01:05:11,993", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002448" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0b2c0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1171 }, { "timestamp": "2026-05-29 01:05:11,993", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000244c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000244c" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1172 }, { "timestamp": "2026-05-29 01:05:11,993", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000244c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002450" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1173 }, { "timestamp": "2026-05-29 01:05:11,993", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002450" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0b2c0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1174 }, { "timestamp": "2026-05-29 01:05:11,993", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000244c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000244c" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1175 }, { "timestamp": "2026-05-29 01:05:11,993", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002448" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000244c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1176 }, { "timestamp": "2026-05-29 01:05:11,993", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000244c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0b2c0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1177 }, { "timestamp": "2026-05-29 01:05:11,993", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002448" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002448" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1178 }, { "timestamp": "2026-05-29 01:05:11,993", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002440" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002448" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1179 }, { "timestamp": "2026-05-29 01:05:11,993", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002448" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0b2c0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1180 }, { "timestamp": "2026-05-29 01:05:11,993", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002440" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002440" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1181 }, { "timestamp": "2026-05-29 01:05:11,993", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002428" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002440" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1182 }, { "timestamp": "2026-05-29 01:05:11,993", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002440" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0b2c0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1183 }, { "timestamp": "2026-05-29 01:05:11,993", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002428" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002428" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1184 }, { "timestamp": "2026-05-29 01:05:11,993", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000243c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002428" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1185 }, { "timestamp": "2026-05-29 01:05:11,993", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002428" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0b2c0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1186 }, { "timestamp": "2026-05-29 01:05:11,993", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000243c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000243c" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1187 }, { "timestamp": "2026-05-29 01:05:11,993", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002424" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000243c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1188 }, { "timestamp": "2026-05-29 01:05:11,993", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000243c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0b2c0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1189 }, { "timestamp": "2026-05-29 01:05:11,993", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002424" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002424" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1190 }, { "timestamp": "2026-05-29 01:05:11,993", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002420" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002424" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1191 }, { "timestamp": "2026-05-29 01:05:11,993", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002424" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0b2c0000" }, { "name": "SectionOffset", "value": "0x0779f1f0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1192 }, { "timestamp": "2026-05-29 01:05:11,993", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002420" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002420" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1193 }, { "timestamp": "2026-05-29 01:05:11,993", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002420" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002424" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1194 }, { "timestamp": "2026-05-29 01:05:11,993", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002424" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0b2c0000" }, { "name": "SectionOffset", "value": "0x0779f1f0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1195 }, { "timestamp": "2026-05-29 01:05:11,993", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002420" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002420" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1196 }, { "timestamp": "2026-05-29 01:05:11,993", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002420" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002424" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1197 }, { "timestamp": "2026-05-29 01:05:11,993", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002424" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0b2c0000" }, { "name": "SectionOffset", "value": "0x0779f1f0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1198 }, { "timestamp": "2026-05-29 01:05:11,993", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002420" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002420" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1199 }, { "timestamp": "2026-05-29 01:05:12,008", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002454" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002420" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1200 }, { "timestamp": "2026-05-29 01:05:12,008", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002420" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0b2c0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1201 }, { "timestamp": "2026-05-29 01:05:12,008", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002454" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002454" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1202 }, { "timestamp": "2026-05-29 01:05:12,008", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002458" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002454" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1203 }, { "timestamp": "2026-05-29 01:05:12,008", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002454" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0b2c0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1204 }, { "timestamp": "2026-05-29 01:05:12,008", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002458" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002458" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1205 }, { "timestamp": "2026-05-29 01:05:13,602", "thread_id": "4696", "caller": "0x7ff79bc1590b", "parentcaller": "0x7ff79bc176b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\windows.internal.shell.broker" }, { "name": "DllBase", "value": "0x7fff3d6a0000" } ], "repeated": 0, "id": 1206 }, { "timestamp": "2026-05-29 01:05:13,602", "thread_id": "4696", "caller": "0x7ff79bc1590b", "parentcaller": "0x7ff79bc176b1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\windows.internal.shell.broker.dll" }, { "name": "BaseAddress", "value": "0x7fff3d6a0000" } ], "repeated": 0, "id": 1207 }, { "timestamp": "2026-05-29 01:05:13,602", "thread_id": "4696", "caller": "0x7ff79bc17547", "parentcaller": "0x7ff79be71679", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0000034B-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "0000015B-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1208 }, { "timestamp": "2026-05-29 01:05:13,602", "thread_id": "4344", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1209 }, { "timestamp": "2026-05-29 01:05:13,602", "thread_id": "4696", "caller": "0x7ff79bc89973", "parentcaller": "0x7ff79bc897dc", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1210 }, { "timestamp": "2026-05-29 01:05:13,602", "thread_id": "4696", "caller": "0x7ff79bc89973", "parentcaller": "0x7ff79bc897dc", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "C2F03A33-21F5-47FA-B4BB-156362A2F239" }, { "name": "ClsContext", "value": "0x00000004", "pretty_value": "CLSCTX_LOCAL_SERVER" }, { "name": "riid", "value": "6D5140C1-7436-11CE-8034-00AA006009FA" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1211 }, { "timestamp": "2026-05-29 01:05:14,008", "thread_id": "5000", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1212 }, { "timestamp": "2026-05-29 01:05:14,024", "thread_id": "4696", "caller": "0x7ff79bc7b354", "parentcaller": "0x7ff79bc7b12e", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 1213 }, { "timestamp": "2026-05-29 01:05:14,024", "thread_id": "5000", "caller": "0x7fff41dbd59f", "parentcaller": "0x7fff41dfc80c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000244c" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "\\Device\\Bam" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1214 }, { "timestamp": "2026-05-29 01:05:14,024", "thread_id": "5220", "caller": "0x7ff79bc799ca", "parentcaller": "0x7ff79bc7a869", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1215 }, { "timestamp": "2026-05-29 01:05:14,024", "thread_id": "4812", "caller": "0x7ff79bc3ca89", "parentcaller": "0x7ff79bc3c93f", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002448" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\apppatch\\sysmain.sdb" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1216 }, { "timestamp": "2026-05-29 01:05:14,024", "thread_id": "4812", "caller": "0x7ff79bc3c67f", "parentcaller": "0x7ff79bc3c407", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002464" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7df4add90000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x003e3000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1217 }, { "timestamp": "2026-05-29 01:05:14,024", "thread_id": "5220", "caller": "0x7ff79bc7bdd2", "parentcaller": "0x7ff79bc7a52a", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002458" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1218 }, { "timestamp": "2026-05-29 01:05:14,024", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 1219 }, { "timestamp": "2026-05-29 01:05:14,024", "thread_id": "4812", "caller": "0x7ff79bc3a878", "parentcaller": "0x7ff79bc3a7ba", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7df4add90000" }, { "name": "RegionSize", "value": "0x003e3000" } ], "repeated": 0, "id": 1220 }, { "timestamp": "2026-05-29 01:05:14,024", "thread_id": "4696", "caller": "0x7ff79bc7a06e", "parentcaller": "0x7ff79bc78f2b", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1221 }, { "timestamp": "2026-05-29 01:05:14,024", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc78f2b", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 1222 }, { "timestamp": "2026-05-29 01:05:14,040", "thread_id": "4696", "caller": "0x7ff79bc7a06e", "parentcaller": "0x7ff79bc66f8c", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1223 }, { "timestamp": "2026-05-29 01:05:14,040", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 1224 }, { "timestamp": "2026-05-29 01:05:14,040", "thread_id": "4636", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002424" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Edge.lnk" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1225 }, { "timestamp": "2026-05-29 01:05:14,040", "thread_id": "4636", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000243c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x0328d4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1226 }, { "timestamp": "2026-05-29 01:05:14,040", "thread_id": "4636", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002448" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\program files (x86)\\microsoft\\Edge\\application\\msedge.exe" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1227 }, { "timestamp": "2026-05-29 01:05:14,040", "thread_id": "4636", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x40000003", "arguments": [ { "name": "SectionHandle", "value": "0x0000243c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x13160000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00505000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1228 }, { "timestamp": "2026-05-29 01:05:14,040", "thread_id": "4636", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc000003a", "pretty_return": "OBJECT_PATH_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\program files (x86)\\microsoft\\Edge\\SystemResources\\msedge.exe.mun" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1229 }, { "timestamp": "2026-05-29 01:05:14,040", "thread_id": "4636", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x13160000" }, { "name": "RegionSize", "value": "0x00505000" } ], "repeated": 0, "id": 1230 }, { "timestamp": "2026-05-29 01:05:14,040", "thread_id": "4636", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000243c" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "ShareAccess", "value": "0" } ], "repeated": 0, "id": 1231 }, { "timestamp": "2026-05-29 01:05:14,040", "thread_id": "4636", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "317D06E8-5F24-433D-BDF7-79CE68D8ABC2" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EC5EC8A9-C395-4314-9C77-54D7A935FF70" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1232 }, { "timestamp": "2026-05-29 01:05:14,087", "thread_id": "5000", "caller": "0x7fff41dbd59f", "parentcaller": "0x7fff41dfc80c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000242c" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "\\Device\\Bam" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1233 }, { "timestamp": "2026-05-29 01:05:14,118", "thread_id": "4696", "caller": "0x7ff79bc7a06e", "parentcaller": "0x7ff79bc66f8c", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1234 }, { "timestamp": "2026-05-29 01:05:14,118", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 1235 }, { "timestamp": "2026-05-29 01:05:14,415", "thread_id": "4720", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000240c" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\Volume{528C102F-0000-0000-0000-300300000000}" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1236 }, { "timestamp": "2026-05-29 01:05:14,415", "thread_id": "4720", "caller": "0x7fff5781a1e7", "parentcaller": "0x7fff55ba7d5b", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002444" }, { "name": "DesiredAccess", "value": "0x00100180", "pretty_value": "FILE_READ_ATTRIBUTES|FILE_WRITE_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\Device\\HarddiskVolume2\\\\xe31\\x02" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1237 }, { "timestamp": "2026-05-29 01:05:14,415", "thread_id": "4720", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002458" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\MountPointManager" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1238 }, { "timestamp": "2026-05-29 01:05:14,430", "thread_id": "4720", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002458" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\services.exe" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1239 }, { "timestamp": "2026-05-29 01:05:14,430", "thread_id": "4720", "caller": "0x7fff577d7786", "parentcaller": "0x7fff577d5630", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x40000003", "arguments": [ { "name": "SectionHandle", "value": "0x00002444" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x13160000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x000b0000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1240 }, { "timestamp": "2026-05-29 01:05:14,430", "thread_id": "4720", "caller": "0x7fff59f9bb2a", "parentcaller": "0x7fff59f9b99e", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002458" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\en-US\\services.exe.mui" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1241 }, { "timestamp": "2026-05-29 01:05:14,430", "thread_id": "4720", "caller": "0x7fff59f9bbcc", "parentcaller": "0x7fff59f9b99e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002444" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x0779d7c0" }, { "name": "ViewSize", "value": "0x00005000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1242 }, { "timestamp": "2026-05-29 01:05:14,430", "thread_id": "4720", "caller": "0x7fff59fba871", "parentcaller": "0x7fff577cad69", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "RegionSize", "value": "0x00005000" } ], "repeated": 0, "id": 1243 }, { "timestamp": "2026-05-29 01:05:14,430", "thread_id": "4720", "caller": "0x7fff577cad9e", "parentcaller": "0x7fff577cbfbf", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x13160000" }, { "name": "RegionSize", "value": "0x000b0000" } ], "repeated": 0, "id": 1244 }, { "timestamp": "2026-05-29 01:05:14,430", "thread_id": "4720", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002458" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\services.exe" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1245 }, { "timestamp": "2026-05-29 01:05:14,430", "thread_id": "4720", "caller": "0x7fff577d7786", "parentcaller": "0x7fff577d5630", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x40000003", "arguments": [ { "name": "SectionHandle", "value": "0x00002444" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x13160000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x000b0000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1246 }, { "timestamp": "2026-05-29 01:05:14,430", "thread_id": "4720", "caller": "0x7fff59f9bb2a", "parentcaller": "0x7fff59f9b99e", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002458" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\en-US\\services.exe.mui" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1247 }, { "timestamp": "2026-05-29 01:05:14,430", "thread_id": "4720", "caller": "0x7fff59f9bbcc", "parentcaller": "0x7fff59f9b99e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002444" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x0779d7b0" }, { "name": "ViewSize", "value": "0x00005000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1248 }, { "timestamp": "2026-05-29 01:05:14,430", "thread_id": "4720", "caller": "0x7fff59fba871", "parentcaller": "0x7fff577cad69", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "RegionSize", "value": "0x00005000" } ], "repeated": 0, "id": 1249 }, { "timestamp": "2026-05-29 01:05:14,430", "thread_id": "4720", "caller": "0x7fff577cad9e", "parentcaller": "0x7fff577cb638", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x13160000" }, { "name": "RegionSize", "value": "0x000b0000" } ], "repeated": 0, "id": 1250 }, { "timestamp": "2026-05-29 01:05:14,430", "thread_id": "4720", "caller": "0x7fff55ba84d2", "parentcaller": "0x7fff55ba872e", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "F324E4F9-8496-40B2-A1FF-9617C1C9AFFE" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "387FDB83-DD33-4995-9D2D-1F647E846705" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1251 }, { "timestamp": "2026-05-29 01:05:14,430", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff474558b1", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002458" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002458" }, { "name": "Options", "value": "0x00000001" } ], "repeated": 0, "id": 1252 }, { "timestamp": "2026-05-29 01:05:14,430", "thread_id": "4720", "caller": "0x7fff55824fbc", "parentcaller": "0x7fff5581f4db", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000323-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000146-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1253 }, { "timestamp": "2026-05-29 01:05:14,430", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1254 }, { "timestamp": "2026-05-29 01:05:14,430", "thread_id": "4620", "caller": "0x7fff55bc1487", "parentcaller": "0x7fff55bbe840", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "B52D54BB-4818-4EB9-AA80-F9EACD371DF8" }, { "name": "ClsContext", "value": "0x00000004", "pretty_value": "CLSCTX_LOCAL_SERVER" }, { "name": "riid", "value": "993ECEB0-6F1B-49FE-8BA2-21B6A5317DE1" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1255 }, { "timestamp": "2026-05-29 01:05:14,446", "thread_id": "4720", "caller": "0x7fff584cf303", "parentcaller": "0x7fff584ce7f3", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1256 }, { "timestamp": "2026-05-29 01:05:14,774", "thread_id": "4812", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c232", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002468" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x0a16f040" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1257 }, { "timestamp": "2026-05-29 01:05:14,774", "thread_id": "4812", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0ca6e000" }, { "name": "RegionSize", "value": "0x00011000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1258 }, { "timestamp": "2026-05-29 01:05:14,774", "thread_id": "4812", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c232", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000246c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x0a16f040" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1259 }, { "timestamp": "2026-05-29 01:05:14,790", "thread_id": "5000", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c232", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002454" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x0819e510" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1260 }, { "timestamp": "2026-05-29 01:05:14,790", "thread_id": "5000", "caller": "0x7fff58519794", "parentcaller": "0x7fff517eb1dd", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "F6C29334-47DC-4397-9150-F549CF1D4861" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1261 }, { "timestamp": "2026-05-29 01:05:14,790", "thread_id": "8552", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c232", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002454" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x100cf510" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1262 }, { "timestamp": "2026-05-29 01:05:14,790", "thread_id": "5000", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c232", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002454" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09f80000" }, { "name": "SectionOffset", "value": "0x0819e510" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1263 }, { "timestamp": "2026-05-29 01:05:14,790", "thread_id": "5000", "caller": "0x7fff58519794", "parentcaller": "0x7fff517eb1dd", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "F6C29334-47DC-4397-9150-F549CF1D4861" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1264 }, { "timestamp": "2026-05-29 01:05:15,477", "thread_id": "4720", "caller": "0x7fff55824fbc", "parentcaller": "0x7fff5581f4db", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000323-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000146-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1265 }, { "timestamp": "2026-05-29 01:05:15,477", "thread_id": "5000", "caller": "0x7fff41dbd59f", "parentcaller": "0x7fff41dfc80c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000246c" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "\\Device\\Bam" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1266 }, { "timestamp": "2026-05-29 01:05:15,493", "thread_id": "4720", "caller": "0x7fff584cf303", "parentcaller": "0x7fff584ce7f3", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1267 }, { "timestamp": "2026-05-29 01:05:15,930", "thread_id": "4696", "caller": "0x7ff79bc7a06e", "parentcaller": "0x7ff79bc66f8c", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1268 }, { "timestamp": "2026-05-29 01:05:15,930", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 1269 }, { "timestamp": "2026-05-29 01:05:15,946", "thread_id": "4696", "caller": "0x7ff79bc7a06e", "parentcaller": "0x7ff79bc66f8c", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1270 }, { "timestamp": "2026-05-29 01:05:15,946", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 1271 }, { "timestamp": "2026-05-29 01:05:15,962", "thread_id": "4696", "caller": "0x7ff79bc7a06e", "parentcaller": "0x7ff79bc66f8c", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1272 }, { "timestamp": "2026-05-29 01:05:15,962", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 1273 }, { "timestamp": "2026-05-29 01:05:15,977", "thread_id": "4696", "caller": "0x7ff79bc7a06e", "parentcaller": "0x7ff79bc66f8c", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1274 }, { "timestamp": "2026-05-29 01:05:15,977", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 1275 }, { "timestamp": "2026-05-29 01:05:15,993", "thread_id": "4696", "caller": "0x7ff79bc7a06e", "parentcaller": "0x7ff79bc66f8c", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1276 }, { "timestamp": "2026-05-29 01:05:15,993", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 1277 }, { "timestamp": "2026-05-29 01:05:16,008", "thread_id": "4696", "caller": "0x7ff79bc7a06e", "parentcaller": "0x7ff79bc66f8c", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1278 }, { "timestamp": "2026-05-29 01:05:16,008", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 1279 }, { "timestamp": "2026-05-29 01:05:16,040", "thread_id": "4696", "caller": "0x7ff79bc7a06e", "parentcaller": "0x7ff79bc66f8c", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1280 }, { "timestamp": "2026-05-29 01:05:16,040", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 1281 }, { "timestamp": "2026-05-29 01:05:16,587", "thread_id": "5000", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1282 }, { "timestamp": "2026-05-29 01:05:16,587", "thread_id": "5000", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1283 }, { "timestamp": "2026-05-29 01:05:16,587", "thread_id": "5000", "caller": "0x7fff430a552f", "parentcaller": "0x7fff597db583", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "17541A17-F509-4CB6-8D08-651DC68D8227" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1284 }, { "timestamp": "2026-05-29 01:05:16,587", "thread_id": "5000", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1285 }, { "timestamp": "2026-05-29 01:05:16,587", "thread_id": "4636", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5850acd6", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1286 }, { "timestamp": "2026-05-29 01:05:16,587", "thread_id": "4344", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1287 }, { "timestamp": "2026-05-29 01:05:16,587", "thread_id": "4636", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1288 }, { "timestamp": "2026-05-29 01:05:16,587", "thread_id": "4636", "caller": "0x7fff44bd3ede", "parentcaller": "0x7fff580ad492", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "C2F03A33-21F5-47FA-B4BB-156362A2F239" }, { "name": "ClsContext", "value": "0x00000404", "pretty_value": "CLSCTX_LOCAL_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "6D5140C1-7436-11CE-8034-00AA006009FA" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1289 }, { "timestamp": "2026-05-29 01:05:16,602", "thread_id": "4636", "caller": "0x7fff58c3a7f7", "parentcaller": "0x7fff58c39037", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00021401-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "000214E4-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "lnkfile" } ], "repeated": 0, "id": 1290 }, { "timestamp": "2026-05-29 01:05:16,602", "thread_id": "4636", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001088" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1291 }, { "timestamp": "2026-05-29 01:05:16,602", "thread_id": "4636", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002260" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0d400000" }, { "name": "SectionOffset", "value": "0x0328d5b0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1292 }, { "timestamp": "2026-05-29 01:05:16,602", "thread_id": "4636", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002474" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1293 }, { "timestamp": "2026-05-29 01:05:16,602", "thread_id": "4636", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002474" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1294 }, { "timestamp": "2026-05-29 01:05:16,602", "thread_id": "4636", "caller": "0x7fff55824fbc", "parentcaller": "0x7fff5581f4db", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000323-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000146-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1295 }, { "timestamp": "2026-05-29 01:05:16,602", "thread_id": "4636", "caller": "0x7fff584cf303", "parentcaller": "0x7fff584ce7f3", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1296 }, { "timestamp": "2026-05-29 01:05:16,602", "thread_id": "4636", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002104" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1297 }, { "timestamp": "2026-05-29 01:05:16,602", "thread_id": "4636", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002104" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1298 }, { "timestamp": "2026-05-29 01:05:16,602", "thread_id": "4636", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002104" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1299 }, { "timestamp": "2026-05-29 01:05:16,602", "thread_id": "4636", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002104" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\WindowsPowerShell" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1300 }, { "timestamp": "2026-05-29 01:05:16,602", "thread_id": "4636", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002104" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1301 }, { "timestamp": "2026-05-29 01:05:16,602", "thread_id": "4636", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c0" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1302 }, { "timestamp": "2026-05-29 01:05:16,602", "thread_id": "4636", "caller": "0x7fff5588d4e4", "parentcaller": "0x7fff557c3285", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00f91281" }, { "name": "Buffer", "value": "\\x01" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1303 }, { "timestamp": "2026-05-29 01:05:16,602", "thread_id": "4636", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000001" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\desktop.ini" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1304 }, { "timestamp": "2026-05-29 01:05:16,602", "thread_id": "4636", "caller": "0x7fff5588d4e4", "parentcaller": "0x7fff557c348f", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00f91281" }, { "name": "Buffer", "value": "\\x00" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1305 }, { "timestamp": "2026-05-29 01:05:16,618", "thread_id": "4636", "caller": "0x7fff55824fbc", "parentcaller": "0x7fff5581f4db", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000323-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000146-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1306 }, { "timestamp": "2026-05-29 01:05:16,618", "thread_id": "4636", "caller": "0x7fff58ac7b67", "parentcaller": "0x7fff58ac7add", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "79EAC9EE-BAF9-11CE-8C82-00AA004BA90B" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1307 }, { "timestamp": "2026-05-29 01:05:16,618", "thread_id": "4636", "caller": "0x7fff577cfcb5", "parentcaller": "0x7fff57815984", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f38" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1308 }, { "timestamp": "2026-05-29 01:05:16,618", "thread_id": "4636", "caller": "0x7fff577cfcb5", "parentcaller": "0x7fff57815984", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f38" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1309 }, { "timestamp": "2026-05-29 01:05:16,618", "thread_id": "4636", "caller": "0x7fff577cfcb5", "parentcaller": "0x7fff57815984", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f38" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1310 }, { "timestamp": "2026-05-29 01:05:16,618", "thread_id": "4636", "caller": "0x7fff577d6579", "parentcaller": "0x7fff5781c32f", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001fa4" }, { "name": "DesiredAccess", "value": "0x00120080", "pretty_value": "FILE_READ_ATTRIBUTES|READ_CONTROL|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1311 }, { "timestamp": "2026-05-29 01:05:16,618", "thread_id": "4636", "caller": "0x7fff577d6bcf", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 2, "id": 1312 }, { "timestamp": "2026-05-29 01:05:16,618", "thread_id": "4636", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000033", "pretty_return": "OBJECT_NAME_INVALID", "arguments": [ { "name": "FileHandle", "value": "0x0002000f" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1313 }, { "timestamp": "2026-05-29 01:05:16,618", "thread_id": "4636", "caller": "0x7fff577d6bcf", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc00000ba", "pretty_return": "FILE_IS_A_DIRECTORY", "arguments": [ { "name": "FileHandle", "value": "0x7fff58c9207c" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 1314 }, { "timestamp": "2026-05-29 01:05:16,618", "thread_id": "4636", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1315 }, { "timestamp": "2026-05-29 01:05:16,618", "thread_id": "4636", "caller": "0x7fff577d6c28", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 1, "id": 1316 }, { "timestamp": "2026-05-29 01:05:16,618", "thread_id": "4636", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1317 }, { "timestamp": "2026-05-29 01:05:16,618", "thread_id": "4636", "caller": "0x7fff577d6bcf", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc00000ba", "pretty_return": "FILE_IS_A_DIRECTORY", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\WindowsPowerShell" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 1318 }, { "timestamp": "2026-05-29 01:05:16,618", "thread_id": "4636", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1319 }, { "timestamp": "2026-05-29 01:05:16,618", "thread_id": "4636", "caller": "0x7fff577d6c28", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\WindowsPowerShell" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 1, "id": 1320 }, { "timestamp": "2026-05-29 01:05:16,618", "thread_id": "4636", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1321 }, { "timestamp": "2026-05-29 01:05:16,618", "thread_id": "4636", "caller": "0x7fff577d6bcf", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc00000ba", "pretty_return": "FILE_IS_A_DIRECTORY", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 1322 }, { "timestamp": "2026-05-29 01:05:16,618", "thread_id": "4636", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1323 }, { "timestamp": "2026-05-29 01:05:16,618", "thread_id": "4636", "caller": "0x7fff577d6c28", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 1, "id": 1324 }, { "timestamp": "2026-05-29 01:05:16,618", "thread_id": "4636", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1325 }, { "timestamp": "2026-05-29 01:05:16,618", "thread_id": "4636", "caller": "0x7fff577d6bcf", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc00000ba", "pretty_return": "FILE_IS_A_DIRECTORY", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 1326 }, { "timestamp": "2026-05-29 01:05:16,618", "thread_id": "4636", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1327 }, { "timestamp": "2026-05-29 01:05:16,618", "thread_id": "4636", "caller": "0x7fff577d6c28", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 1, "id": 1328 }, { "timestamp": "2026-05-29 01:05:16,618", "thread_id": "4636", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1329 }, { "timestamp": "2026-05-29 01:05:16,618", "thread_id": "4636", "caller": "0x7fff577d4d82", "parentcaller": "0x7fff577d70c7", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 1330 }, { "timestamp": "2026-05-29 01:05:16,618", "thread_id": "4636", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d4f8e", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\MountPointManager" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1331 }, { "timestamp": "2026-05-29 01:05:16,618", "thread_id": "4636", "caller": "0x7fff577d4d82", "parentcaller": "0x7fff577d693c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 1332 }, { "timestamp": "2026-05-29 01:05:16,618", "thread_id": "4636", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d4f8e", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\MountPointManager" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1333 }, { "timestamp": "2026-05-29 01:05:16,618", "thread_id": "4636", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "DesiredAccess", "value": "0x00120080", "pretty_value": "FILE_READ_ATTRIBUTES|READ_CONTROL|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\Volume{528c102f-0000-0000-0000-300300000000}" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1334 }, { "timestamp": "2026-05-29 01:05:16,633", "thread_id": "4636", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff4c245ccf", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xffffffff" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000024cc" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1335 }, { "timestamp": "2026-05-29 01:05:16,633", "thread_id": "4636", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1336 }, { "timestamp": "2026-05-29 01:05:16,633", "thread_id": "4636", "caller": "0x7fff4c246ced", "parentcaller": "0x7fff4c24816c", "category": "com", "api": "CoGetClassObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "A463FCB9-6B1C-4E0D-A80B-A2CA7999E25D" }, { "name": "ClsContext", "value": "0x00100004", "pretty_value": "CLSCTX_LOCAL_SERVER|CLSCTX_ENABLE_CLOAKING" }, { "name": "riid", "value": "00000001-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1337 }, { "timestamp": "2026-05-29 01:05:16,633", "thread_id": "4636", "caller": "0x7fff58ac7b67", "parentcaller": "0x7fff58ac7add", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "79EAC9EE-BAF9-11CE-8C82-00AA004BA90B" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1338 }, { "timestamp": "2026-05-29 01:05:16,633", "thread_id": "4636", "caller": "0x7fff577cfcb5", "parentcaller": "0x7fff57815984", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f38" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1339 }, { "timestamp": "2026-05-29 01:05:16,633", "thread_id": "4636", "caller": "0x7fff577cfcb5", "parentcaller": "0x7fff57815984", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f38" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1340 }, { "timestamp": "2026-05-29 01:05:16,633", "thread_id": "4636", "caller": "0x7fff577cfcb5", "parentcaller": "0x7fff57815984", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f38" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1341 }, { "timestamp": "2026-05-29 01:05:16,633", "thread_id": "4636", "caller": "0x7fff577cfcb5", "parentcaller": "0x7fff57815984", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f38" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1342 }, { "timestamp": "2026-05-29 01:05:16,633", "thread_id": "4636", "caller": "0x7fff577cfcb5", "parentcaller": "0x7fff57815984", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f38" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1343 }, { "timestamp": "2026-05-29 01:05:16,633", "thread_id": "4636", "caller": "0x7fff577cfcb5", "parentcaller": "0x7fff57815984", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f38" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1344 }, { "timestamp": "2026-05-29 01:05:16,633", "thread_id": "4636", "caller": "0x7fff577d6579", "parentcaller": "0x7fff5781c32f", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f38" }, { "name": "DesiredAccess", "value": "0x00120080", "pretty_value": "FILE_READ_ATTRIBUTES|READ_CONTROL|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1345 }, { "timestamp": "2026-05-29 01:05:16,633", "thread_id": "4636", "caller": "0x7fff577d6bcf", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f38" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 2, "id": 1346 }, { "timestamp": "2026-05-29 01:05:16,633", "thread_id": "4636", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000033", "pretty_return": "OBJECT_NAME_INVALID", "arguments": [ { "name": "FileHandle", "value": "0x0005000f" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1347 }, { "timestamp": "2026-05-29 01:05:16,633", "thread_id": "4636", "caller": "0x7fff577d6bcf", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc00000ba", "pretty_return": "FILE_IS_A_DIRECTORY", "arguments": [ { "name": "FileHandle", "value": "0x7fff58c9207c" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 1348 }, { "timestamp": "2026-05-29 01:05:16,633", "thread_id": "4636", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f38" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1349 }, { "timestamp": "2026-05-29 01:05:16,633", "thread_id": "4636", "caller": "0x7fff577d6c28", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f38" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 1, "id": 1350 }, { "timestamp": "2026-05-29 01:05:16,633", "thread_id": "4636", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001fa4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1351 }, { "timestamp": "2026-05-29 01:05:16,633", "thread_id": "4636", "caller": "0x7fff577d6bcf", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc00000ba", "pretty_return": "FILE_IS_A_DIRECTORY", "arguments": [ { "name": "FileHandle", "value": "0x00001fa4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 1352 }, { "timestamp": "2026-05-29 01:05:16,633", "thread_id": "4636", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001fa4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1353 }, { "timestamp": "2026-05-29 01:05:16,633", "thread_id": "4636", "caller": "0x7fff577d6c28", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001fa4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 1, "id": 1354 }, { "timestamp": "2026-05-29 01:05:16,633", "thread_id": "4636", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001fa4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1355 }, { "timestamp": "2026-05-29 01:05:16,633", "thread_id": "4636", "caller": "0x7fff577d6bcf", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc00000ba", "pretty_return": "FILE_IS_A_DIRECTORY", "arguments": [ { "name": "FileHandle", "value": "0x00001fa4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 1356 }, { "timestamp": "2026-05-29 01:05:16,633", "thread_id": "4636", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001fa4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1357 }, { "timestamp": "2026-05-29 01:05:16,633", "thread_id": "4636", "caller": "0x7fff577d6c28", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001fa4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 1, "id": 1358 }, { "timestamp": "2026-05-29 01:05:16,633", "thread_id": "4636", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001fa4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1359 }, { "timestamp": "2026-05-29 01:05:16,633", "thread_id": "4636", "caller": "0x7fff577d6bcf", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc00000ba", "pretty_return": "FILE_IS_A_DIRECTORY", "arguments": [ { "name": "FileHandle", "value": "0x00001fa4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 1360 }, { "timestamp": "2026-05-29 01:05:16,633", "thread_id": "4636", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002410" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1361 }, { "timestamp": "2026-05-29 01:05:16,649", "thread_id": "4636", "caller": "0x7fff577d6c28", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002410" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 1362 }, { "timestamp": "2026-05-29 01:05:16,649", "thread_id": "4636", "caller": "0x7fff577d4d82", "parentcaller": "0x7fff577d6fe6", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001fa4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 1363 }, { "timestamp": "2026-05-29 01:05:16,649", "thread_id": "4636", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001fa4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1364 }, { "timestamp": "2026-05-29 01:05:16,649", "thread_id": "4636", "caller": "0x7fff577d6bcf", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc00000ba", "pretty_return": "FILE_IS_A_DIRECTORY", "arguments": [ { "name": "FileHandle", "value": "0x00001fa4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 1365 }, { "timestamp": "2026-05-29 01:05:16,649", "thread_id": "4636", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001fa4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1366 }, { "timestamp": "2026-05-29 01:05:16,649", "thread_id": "4636", "caller": "0x7fff577d6c28", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001fa4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 1, "id": 1367 }, { "timestamp": "2026-05-29 01:05:16,649", "thread_id": "4636", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001fa4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1368 }, { "timestamp": "2026-05-29 01:05:16,649", "thread_id": "4636", "caller": "0x7fff577d6bcf", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc00000ba", "pretty_return": "FILE_IS_A_DIRECTORY", "arguments": [ { "name": "FileHandle", "value": "0x00001fa4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 1369 }, { "timestamp": "2026-05-29 01:05:16,649", "thread_id": "4636", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001fa4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1370 }, { "timestamp": "2026-05-29 01:05:16,649", "thread_id": "4636", "caller": "0x7fff577d6c28", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001fa4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 1, "id": 1371 }, { "timestamp": "2026-05-29 01:05:16,649", "thread_id": "4636", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001fa4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1372 }, { "timestamp": "2026-05-29 01:05:16,649", "thread_id": "4636", "caller": "0x7fff577d6bcf", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc00000ba", "pretty_return": "FILE_IS_A_DIRECTORY", "arguments": [ { "name": "FileHandle", "value": "0x00001fa4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 1373 }, { "timestamp": "2026-05-29 01:05:16,649", "thread_id": "4636", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001fa4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1374 }, { "timestamp": "2026-05-29 01:05:16,649", "thread_id": "4636", "caller": "0x7fff577d6c28", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001fa4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 1, "id": 1375 }, { "timestamp": "2026-05-29 01:05:16,649", "thread_id": "4636", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001fa4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1376 }, { "timestamp": "2026-05-29 01:05:16,649", "thread_id": "4636", "caller": "0x7fff577d6bcf", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc00000ba", "pretty_return": "FILE_IS_A_DIRECTORY", "arguments": [ { "name": "FileHandle", "value": "0x00001fa4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 1377 }, { "timestamp": "2026-05-29 01:05:16,649", "thread_id": "4636", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001fa4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1378 }, { "timestamp": "2026-05-29 01:05:16,649", "thread_id": "4636", "caller": "0x7fff577d6c28", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001fa4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 1, "id": 1379 }, { "timestamp": "2026-05-29 01:05:16,649", "thread_id": "4636", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001fa4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1380 }, { "timestamp": "2026-05-29 01:05:16,649", "thread_id": "4636", "caller": "0x7fff577d6bcf", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc00000ba", "pretty_return": "FILE_IS_A_DIRECTORY", "arguments": [ { "name": "FileHandle", "value": "0x00001fa4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 1381 }, { "timestamp": "2026-05-29 01:05:16,649", "thread_id": "4636", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001190" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1382 }, { "timestamp": "2026-05-29 01:05:16,649", "thread_id": "4636", "caller": "0x7fff577d6c28", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001190" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 1, "id": 1383 }, { "timestamp": "2026-05-29 01:05:16,649", "thread_id": "4636", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001190" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1384 }, { "timestamp": "2026-05-29 01:05:16,649", "thread_id": "4636", "caller": "0x7fff577d4d82", "parentcaller": "0x7fff577d70c7", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001190" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 1385 }, { "timestamp": "2026-05-29 01:05:16,649", "thread_id": "4636", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d4f8e", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001190" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\MountPointManager" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1386 }, { "timestamp": "2026-05-29 01:05:16,649", "thread_id": "4636", "caller": "0x7fff577d4d82", "parentcaller": "0x7fff577d693c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001190" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 1387 }, { "timestamp": "2026-05-29 01:05:16,649", "thread_id": "4636", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d4f8e", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001190" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\MountPointManager" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1388 }, { "timestamp": "2026-05-29 01:05:16,649", "thread_id": "4636", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001190" }, { "name": "DesiredAccess", "value": "0x00120080", "pretty_value": "FILE_READ_ATTRIBUTES|READ_CONTROL|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\Volume{528c102f-0000-0000-0000-300300000000}" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1389 }, { "timestamp": "2026-05-29 01:05:16,649", "thread_id": "4636", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff4c245ccf", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xffffffff" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001190" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1390 }, { "timestamp": "2026-05-29 01:05:16,649", "thread_id": "4636", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1391 }, { "timestamp": "2026-05-29 01:05:16,649", "thread_id": "4636", "caller": "0x7fff4c246ced", "parentcaller": "0x7fff4c24816c", "category": "com", "api": "CoGetClassObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "A463FCB9-6B1C-4E0D-A80B-A2CA7999E25D" }, { "name": "ClsContext", "value": "0x00100004", "pretty_value": "CLSCTX_LOCAL_SERVER|CLSCTX_ENABLE_CLOAKING" }, { "name": "riid", "value": "00000001-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1392 }, { "timestamp": "2026-05-29 01:05:16,649", "thread_id": "4636", "caller": "0x7fff58c41e0e", "parentcaller": "0x7fff58c2992c", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "CDC82860-468D-4D4E-B7E7-C298FF23AB2C" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "5632B1A4-E38A-400A-928A-D4CD63230295" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1393 }, { "timestamp": "2026-05-29 01:05:16,649", "thread_id": "4636", "caller": "0x7fff557d574b", "parentcaller": "0x7fff557d50a2", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "F1C46D71-B791-4110-8D5C-7108F22C1010" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "8A43ED9F-F4E6-4421-ACF9-1DAB2986820C" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1394 }, { "timestamp": "2026-05-29 01:05:16,649", "thread_id": "4636", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1395 }, { "timestamp": "2026-05-29 01:05:16,649", "thread_id": "4636", "caller": "0x7fff55932c3e", "parentcaller": "0x7fff557d5105", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1396 }, { "timestamp": "2026-05-29 01:05:16,649", "thread_id": "4344", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1397 }, { "timestamp": "2026-05-29 01:05:16,649", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1398 }, { "timestamp": "2026-05-29 01:05:16,649", "thread_id": "4620", "caller": "0x7fff558e9aa2", "parentcaller": "0x7fff558eac92", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "C2F03A33-21F5-47FA-B4BB-156362A2F239" }, { "name": "ClsContext", "value": "0x00000004", "pretty_value": "CLSCTX_LOCAL_SERVER" }, { "name": "riid", "value": "6D5140C1-7436-11CE-8034-00AA006009FA" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1399 }, { "timestamp": "2026-05-29 01:05:16,665", "thread_id": "4636", "caller": "0x7fff5578764e", "parentcaller": "0x7fff55787552", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "DD313E04-FEFF-11D1-8ECD-0000F87A470C" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "49B36D57-5FD2-45A7-981B-06028D577A47" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1400 }, { "timestamp": "2026-05-29 01:05:16,665", "thread_id": "4636", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff58ac24ea", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 1401 }, { "timestamp": "2026-05-29 01:05:16,665", "thread_id": "4636", "caller": "0x7fff577fc5f2", "parentcaller": "0x7fff577f9666", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000024d0" }, { "name": "ThreadHandle", "value": "0x000024c8" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" }, { "name": "CommandLine", "value": "\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" " }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "11260" } ], "repeated": 0, "id": 1402 }, { "timestamp": "2026-05-29 01:05:16,665", "thread_id": "4344", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0ca7f000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1403 }, { "timestamp": "2026-05-29 01:05:16,993", "thread_id": "4636", "caller": "0x7fff577f9666", "parentcaller": "0x7fff57fccec4", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" }, { "name": "CommandLine", "value": "\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" " }, { "name": "CreationFlags", "value": "0x04080414", "pretty_value": "CREATE_SUSPENDED|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT|CREATE_DEFAULT_ERROR_MODE" }, { "name": "ProcessId", "value": "11260" }, { "name": "ThreadId", "value": "9696" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x000024d0" }, { "name": "ThreadHandle", "value": "0x000024c8" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1404 }, { "timestamp": "2026-05-29 01:05:16,993", "thread_id": "6164", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1405 }, { "timestamp": "2026-05-29 01:05:16,993", "thread_id": "4636", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1406 }, { "timestamp": "2026-05-29 01:05:16,993", "thread_id": "4636", "caller": "0x7fff5578e607", "parentcaller": "0x7fff5589a545", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "C2F03A33-21F5-47FA-B4BB-156362A2F239" }, { "name": "ClsContext", "value": "0x00000004", "pretty_value": "CLSCTX_LOCAL_SERVER" }, { "name": "riid", "value": "6D5140C1-7436-11CE-8034-00AA006009FA" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1407 }, { "timestamp": "2026-05-29 01:05:17,008", "thread_id": "5000", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000024cc" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0d400000" }, { "name": "SectionOffset", "value": "0x0819d490" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1408 }, { "timestamp": "2026-05-29 01:05:17,008", "thread_id": "4636", "caller": "0x7fff59fafc9c", "parentcaller": "0x7fff59fafa80", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024d4" }, { "name": "DesiredAccess", "value": "0x00100021", "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\pcacli.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1409 }, { "timestamp": "2026-05-29 01:05:17,008", "thread_id": "4636", "caller": "0x7fff59f64d42", "parentcaller": "0x7fff59f64aaa", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000024dc" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff3d4a0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00016000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1410 }, { "timestamp": "2026-05-29 01:05:17,008", "thread_id": "5000", "caller": "0x7fff41dbd59f", "parentcaller": "0x7fff41dfc80c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024e4" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "\\Device\\Bam" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1411 }, { "timestamp": "2026-05-29 01:05:17,008", "thread_id": "4636", "caller": "0x7fff59fafc9c", "parentcaller": "0x7fff59faf7b0", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024d4" }, { "name": "DesiredAccess", "value": "0x00100021", "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\mpr.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1412 }, { "timestamp": "2026-05-29 01:05:17,008", "thread_id": "4636", "caller": "0x7fff59f64d42", "parentcaller": "0x7fff59f64aaa", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000024dc" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff47720000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x0001d000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1413 }, { "timestamp": "2026-05-29 01:05:17,008", "thread_id": "4636", "caller": "0x7fff59f64d42", "parentcaller": "0x7fff59f64aaa", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\MPR" }, { "name": "DllBase", "value": "0x7fff47720000" } ], "repeated": 0, "id": 1414 }, { "timestamp": "2026-05-29 01:05:17,008", "thread_id": "5000", "caller": "0x7fff41dbe842", "parentcaller": "0x7fff41dbd62c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002504" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "\\Device\\Bam" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1415 }, { "timestamp": "2026-05-29 01:05:17,008", "thread_id": "4636", "caller": "0x7fff59f64d42", "parentcaller": "0x7fff59f64aaa", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\pcacli" }, { "name": "DllBase", "value": "0x7fff3d4a0000" } ], "repeated": 0, "id": 1416 }, { "timestamp": "2026-05-29 01:05:17,008", "thread_id": "4812", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c232", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000024dc" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0d400000" }, { "name": "SectionOffset", "value": "0x0a16f040" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1417 }, { "timestamp": "2026-05-29 01:05:17,008", "thread_id": "4812", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0ca82000" }, { "name": "RegionSize", "value": "0x00011000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1418 }, { "timestamp": "2026-05-29 01:05:17,008", "thread_id": "6160", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c232", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000024cc" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0fad0000" }, { "name": "SectionOffset", "value": "0x0d69f110" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1419 }, { "timestamp": "2026-05-29 01:05:17,008", "thread_id": "6160", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0ca93000" }, { "name": "RegionSize", "value": "0x00011000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1420 }, { "timestamp": "2026-05-29 01:05:17,008", "thread_id": "4636", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff3d4a264d", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 1421 }, { "timestamp": "2026-05-29 01:05:17,008", "thread_id": "4636", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff3d4a170e", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\sfc_os" }, { "name": "DllBase", "value": "0x7fff453f0000" } ], "repeated": 0, "id": 1422 }, { "timestamp": "2026-05-29 01:05:17,008", "thread_id": "4636", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff3d4a170e", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\sfc_os.dll" }, { "name": "BaseAddress", "value": "0x7fff453f0000" } ], "repeated": 0, "id": 1423 }, { "timestamp": "2026-05-29 01:05:17,024", "thread_id": "4636", "caller": "0x7fff453f1284", "parentcaller": "0x7fff453f113e", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002514" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "C:\\Windows\\WinSxS\\FileMaps\\$$_system32_windowspowershell_v1.0_3f102d555ee05d33.cdf-ms" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" } ], "repeated": 0, "id": 1424 }, { "timestamp": "2026-05-29 01:05:17,024", "thread_id": "4636", "caller": "0x7fff453f13fd", "parentcaller": "0x7fff453f12af", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002518" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7df4ae170000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1425 }, { "timestamp": "2026-05-29 01:05:17,024", "thread_id": "4636", "caller": "0x7fff453f14f9", "parentcaller": "0x7fff453f11ec", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7df4ae170000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1426 }, { "timestamp": "2026-05-29 01:05:17,024", "thread_id": "5000", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c232", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000251c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0d400000" }, { "name": "SectionOffset", "value": "0x0819e510" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1427 }, { "timestamp": "2026-05-29 01:05:17,024", "thread_id": "5000", "caller": "0x7fff58519794", "parentcaller": "0x7fff517eb1dd", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "F6C29334-47DC-4397-9150-F549CF1D4861" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1428 }, { "timestamp": "2026-05-29 01:05:17,024", "thread_id": "4812", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c232", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000250c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0d400000" }, { "name": "SectionOffset", "value": "0x0a16f040" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1429 }, { "timestamp": "2026-05-29 01:05:17,180", "thread_id": "4636", "caller": "0x7fff5781f430", "parentcaller": "0x7fff55882a9b", "category": "threading", "api": "NtResumeThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x000024c8" }, { "name": "SuspendCount", "value": "1" }, { "name": "ThreadId", "value": "9696" }, { "name": "ProcessId", "value": "11260" } ], "repeated": 0, "id": 1430 }, { "timestamp": "2026-05-29 01:05:17,180", "thread_id": "4636", "caller": "0x7fff58d603fa", "parentcaller": "0x7fff58c105cb", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1431 }, { "timestamp": "2026-05-29 01:05:17,180", "thread_id": "4812", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1432 }, { "timestamp": "2026-05-29 01:05:17,180", "thread_id": "4636", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c4" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Desktop" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1433 }, { "timestamp": "2026-05-29 01:05:17,180", "thread_id": "4636", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000004" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Desktop\\%1" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1434 }, { "timestamp": "2026-05-29 01:05:17,180", "thread_id": "4636", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c4" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1435 }, { "timestamp": "2026-05-29 01:05:17,180", "thread_id": "4636", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000004" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop\\%1" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1436 }, { "timestamp": "2026-05-29 01:05:17,180", "thread_id": "4636", "caller": "0x7fff584cf303", "parentcaller": "0x7fff584ce7f3", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 1437 }, { "timestamp": "2026-05-29 01:05:17,196", "thread_id": "4812", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002510" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1438 }, { "timestamp": "2026-05-29 01:05:17,196", "thread_id": "4812", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000250c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0d400000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00002000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1439 }, { "timestamp": "2026-05-29 01:05:17,196", "thread_id": "4812", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0d400000" }, { "name": "RegionSize", "value": "0x00002000" } ], "repeated": 0, "id": 1440 }, { "timestamp": "2026-05-29 01:05:17,196", "thread_id": "4812", "caller": "0x7fff57fc0571", "parentcaller": "0x7fff57fc0427", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000250c" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\apppatch\\sysmain.sdb" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1441 }, { "timestamp": "2026-05-29 01:05:17,196", "thread_id": "4812", "caller": "0x7fff57fc02b3", "parentcaller": "0x7fff57fc003b", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000024d0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7df4add90000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x003e3000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1442 }, { "timestamp": "2026-05-29 01:05:17,196", "thread_id": "4812", "caller": "0x7fff57fc1830", "parentcaller": "0x7fff57fc1772", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7df4add90000" }, { "name": "RegionSize", "value": "0x003e3000" } ], "repeated": 0, "id": 1443 }, { "timestamp": "2026-05-29 01:05:17,196", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1444 }, { "timestamp": "2026-05-29 01:05:17,196", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "99B29D3B-368A-4BE6-B675-805A69114497" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1445 }, { "timestamp": "2026-05-29 01:05:17,196", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1446 }, { "timestamp": "2026-05-29 01:05:17,196", "thread_id": "4620", "caller": "0x7fff471ff105", "parentcaller": "0x7fff471f5e39", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "A3662812-8138-4A1E-8FAF-49D06E7AED43" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "EFE84C27-AFA6-485D-A70A-AA2AB5CB6C67" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1447 }, { "timestamp": "2026-05-29 01:05:17,196", "thread_id": "6160", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 8, "id": 1448 }, { "timestamp": "2026-05-29 01:05:17,243", "thread_id": "6160", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0caa4000" }, { "name": "RegionSize", "value": "0x00009000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1449 }, { "timestamp": "2026-05-29 01:05:17,243", "thread_id": "6160", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0caad000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1450 }, { "timestamp": "2026-05-29 01:05:17,243", "thread_id": "6160", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0cab2000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1451 }, { "timestamp": "2026-05-29 01:05:17,243", "thread_id": "6160", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 1452 }, { "timestamp": "2026-05-29 01:05:17,274", "thread_id": "5108", "caller": "0x7fff577cfcb5", "parentcaller": "0x7fff57815984", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1453 }, { "timestamp": "2026-05-29 01:05:17,274", "thread_id": "5108", "caller": "0x7fff577cfcb5", "parentcaller": "0x7fff57815984", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022e0" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1454 }, { "timestamp": "2026-05-29 01:05:17,274", "thread_id": "5108", "caller": "0x7fff577cfcb5", "parentcaller": "0x7fff57815984", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022e0" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1455 }, { "timestamp": "2026-05-29 01:05:17,274", "thread_id": "5000", "caller": "0x7fff42a0e757", "parentcaller": "0x7fff426b686e", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1456 }, { "timestamp": "2026-05-29 01:05:17,274", "thread_id": "5000", "caller": "0x7fff57812a0c", "parentcaller": "0x7fff44c0f12b", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002278" }, { "name": "DesiredAccess", "value": "0x00020000", "pretty_value": "READ_CONTROL" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 1, "id": 1457 }, { "timestamp": "2026-05-29 01:05:17,290", "thread_id": "5000", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000230c" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1458 }, { "timestamp": "2026-05-29 01:05:17,290", "thread_id": "5000", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0cab7000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1459 }, { "timestamp": "2026-05-29 01:05:17,290", "thread_id": "5000", "caller": "0x7fff41dbd59f", "parentcaller": "0x7fff41dfc80c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022e0" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "\\Device\\Bam" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1460 }, { "timestamp": "2026-05-29 01:05:17,290", "thread_id": "4696", "caller": "0x7ff79bc7b354", "parentcaller": "0x7ff79bc7b12e", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 1461 }, { "timestamp": "2026-05-29 01:05:17,290", "thread_id": "4500", "caller": "0x7ff79bc3a297", "parentcaller": "0x7ff79bd394e9", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0caba000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1462 }, { "timestamp": "2026-05-29 01:05:17,290", "thread_id": "4500", "caller": "0x7ff79bc3ca89", "parentcaller": "0x7ff79bc3c93f", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002520" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\apppatch\\sysmain.sdb" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1463 }, { "timestamp": "2026-05-29 01:05:17,290", "thread_id": "5000", "caller": "0x7fff41dbd59f", "parentcaller": "0x7fff41dfc80c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001cc4" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "\\Device\\Bam" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1464 }, { "timestamp": "2026-05-29 01:05:17,290", "thread_id": "3424", "caller": "0x7ff79bc79d10", "parentcaller": "0x7ff79bc79c74", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1465 }, { "timestamp": "2026-05-29 01:05:17,290", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 1466 }, { "timestamp": "2026-05-29 01:05:17,290", "thread_id": "5220", "caller": "0x7ff79bc799ca", "parentcaller": "0x7ff79bc7a869", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1467 }, { "timestamp": "2026-05-29 01:05:17,290", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000252c" }, { "name": "DesiredAccess", "value": "0x00020000", "pretty_value": "READ_CONTROL" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1468 }, { "timestamp": "2026-05-29 01:05:17,290", "thread_id": "5000", "caller": "0x7fff41dbe842", "parentcaller": "0x7fff41dbd62c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001c54" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "\\Device\\Bam" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1469 }, { "timestamp": "2026-05-29 01:05:17,290", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000252c" }, { "name": "DesiredAccess", "value": "0x00020000", "pretty_value": "READ_CONTROL" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1470 }, { "timestamp": "2026-05-29 01:05:17,290", "thread_id": "5220", "caller": "0x7ff79bc7bdd2", "parentcaller": "0x7ff79bc7a52a", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001cc4" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1471 }, { "timestamp": "2026-05-29 01:05:17,290", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0cabf000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1472 }, { "timestamp": "2026-05-29 01:05:17,290", "thread_id": "5220", "caller": "0x7ff79bc7bdd2", "parentcaller": "0x7ff79bc7a52a", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002278" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1473 }, { "timestamp": "2026-05-29 01:05:17,290", "thread_id": "5220", "caller": "0x7ff79bc7bdd2", "parentcaller": "0x7ff79bc7a52a", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001cc4" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1474 }, { "timestamp": "2026-05-29 01:05:17,290", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 1475 }, { "timestamp": "2026-05-29 01:05:17,290", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000245c" }, { "name": "DesiredAccess", "value": "0x00020000", "pretty_value": "READ_CONTROL" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 1, "id": 1476 }, { "timestamp": "2026-05-29 01:05:17,290", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000021e4" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1477 }, { "timestamp": "2026-05-29 01:05:17,305", "thread_id": "6164", "caller": "0x7fff577f3013", "parentcaller": "0x7fff41e0672b", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001520" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\GameDVR\\KnownGameList.bin" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x727\\x05\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1478 }, { "timestamp": "2026-05-29 01:05:17,305", "thread_id": "4500", "caller": "0x7ff79bc3a878", "parentcaller": "0x7ff79bc3a7ba", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7df4add90000" }, { "name": "RegionSize", "value": "0x003e3000" } ], "repeated": 0, "id": 1479 }, { "timestamp": "2026-05-29 01:05:17,305", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0cac2000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1480 }, { "timestamp": "2026-05-29 01:05:17,305", "thread_id": "5220", "caller": "0x7ff79bdadb8b", "parentcaller": "0x7ff79bc79a4f", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000251c" }, { "name": "DesiredAccess", "value": "0x00020000", "pretty_value": "READ_CONTROL" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1481 }, { "timestamp": "2026-05-29 01:05:17,305", "thread_id": "6252", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1482 }, { "timestamp": "2026-05-29 01:05:17,305", "thread_id": "5220", "caller": "0x7ff79bdadb8b", "parentcaller": "0x7ff79bc79a4f", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002278" }, { "name": "DesiredAccess", "value": "0x00020000", "pretty_value": "READ_CONTROL" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1483 }, { "timestamp": "2026-05-29 01:05:17,305", "thread_id": "5220", "caller": "0x7ff79bdadb8b", "parentcaller": "0x7ff79bc79a4f", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002278" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1484 }, { "timestamp": "2026-05-29 01:05:17,305", "thread_id": "10916", "caller": "0x7fff40c74428", "parentcaller": "0x7fff40c73a03", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "F0AE1542-F497-484B-A175-A20DB09144BA" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "8DC24A1A-6314-4769-9D68-179786F4CED6" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1485 }, { "timestamp": "2026-05-29 01:05:17,305", "thread_id": "5220", "caller": "0x7ff79bdadb8b", "parentcaller": "0x7ff79bc79a4f", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002278" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1486 }, { "timestamp": "2026-05-29 01:05:17,305", "thread_id": "5220", "caller": "0x7ff79bdadb8b", "parentcaller": "0x7ff79bc79a4f", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002278" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1487 }, { "timestamp": "2026-05-29 01:05:17,305", "thread_id": "6252", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff557c9e99", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x4574f454d" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1488 }, { "timestamp": "2026-05-29 01:05:17,305", "thread_id": "5220", "caller": "0x7ff79bdadb8b", "parentcaller": "0x7ff79bc79a4f", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000247c" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1489 }, { "timestamp": "2026-05-29 01:05:17,305", "thread_id": "5220", "caller": "0x7ff79bdadb8b", "parentcaller": "0x7ff79bc79a4f", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000247c" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1490 }, { "timestamp": "2026-05-29 01:05:17,305", "thread_id": "10916", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 1491 }, { "timestamp": "2026-05-29 01:05:17,305", "thread_id": "5220", "caller": "0x7ff79bdadb8b", "parentcaller": "0x7ff79bc79a4f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0cac7000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1492 }, { "timestamp": "2026-05-29 01:05:17,305", "thread_id": "5220", "caller": "0x7ff79bdadb8b", "parentcaller": "0x7ff79bc79a4f", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000247c" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1493 }, { "timestamp": "2026-05-29 01:05:17,305", "thread_id": "10916", "caller": "0x7fff55825882", "parentcaller": "0x7fff55828f55", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "4234D49B-0245-4DF3-B780-3893943456E1" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "000214E6-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1494 }, { "timestamp": "2026-05-29 01:05:17,305", "thread_id": "5220", "caller": "0x7ff79bdadb8b", "parentcaller": "0x7ff79bc79a4f", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00fd7281" }, { "name": "Buffer", "value": "\\x01" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1495 }, { "timestamp": "2026-05-29 01:05:17,305", "thread_id": "5220", "caller": "0x7ff79bdadb8b", "parentcaller": "0x7ff79bc79a4f", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002528" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1496 }, { "timestamp": "2026-05-29 01:05:17,305", "thread_id": "5220", "caller": "0x7ff79bdadb8b", "parentcaller": "0x7ff79bc79a4f", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00fd7281" }, { "name": "Buffer", "value": "\\x00" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1497 }, { "timestamp": "2026-05-29 01:05:17,305", "thread_id": "5220", "caller": "0x7ff79bdadb8b", "parentcaller": "0x7ff79bc79a4f", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002528" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1498 }, { "timestamp": "2026-05-29 01:05:17,305", "thread_id": "5220", "caller": "0x7ff79bdadb8b", "parentcaller": "0x7ff79bc79a4f", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00fd7281" }, { "name": "Buffer", "value": "\\x01" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1499 }, { "timestamp": "2026-05-29 01:05:17,305", "thread_id": "5220", "caller": "0x7ff79bdadb8b", "parentcaller": "0x7ff79bc79a4f", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002528" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1500 }, { "timestamp": "2026-05-29 01:05:17,305", "thread_id": "5220", "caller": "0x7ff79bdadb8b", "parentcaller": "0x7ff79bc79a4f", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00fd7281" }, { "name": "Buffer", "value": "\\x00" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1501 }, { "timestamp": "2026-05-29 01:05:17,305", "thread_id": "5220", "caller": "0x7ff79bdadb8b", "parentcaller": "0x7ff79bc79a4f", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002528" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1502 }, { "timestamp": "2026-05-29 01:05:17,305", "thread_id": "5220", "caller": "0x7ff79bdadb8b", "parentcaller": "0x7ff79bc79a4f", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002528" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1503 }, { "timestamp": "2026-05-29 01:05:17,305", "thread_id": "4696", "caller": "0x7ff79bc7a06e", "parentcaller": "0x7ff79bc78f2b", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1504 }, { "timestamp": "2026-05-29 01:05:17,305", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc78f2b", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 1505 }, { "timestamp": "2026-05-29 01:05:17,305", "thread_id": "10916", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff584c6d2f", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002528" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1506 }, { "timestamp": "2026-05-29 01:05:17,321", "thread_id": "4696", "caller": "0x7ff79bc7a06e", "parentcaller": "0x7ff79bc66f8c", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1507 }, { "timestamp": "2026-05-29 01:05:17,321", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 1508 }, { "timestamp": "2026-05-29 01:05:17,321", "thread_id": "4696", "caller": "0x7ff79bc7a06e", "parentcaller": "0x7ff79bc78f2b", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1509 }, { "timestamp": "2026-05-29 01:05:17,321", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc78f2b", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 1510 }, { "timestamp": "2026-05-29 01:05:17,321", "thread_id": "6160", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0cacc000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1511 }, { "timestamp": "2026-05-29 01:05:17,321", "thread_id": "4696", "caller": "0x7ff79bc4ebcc", "parentcaller": "0x7ff79bc512d4", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0cace000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1512 }, { "timestamp": "2026-05-29 01:05:17,321", "thread_id": "4636", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002544" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1513 }, { "timestamp": "2026-05-29 01:05:17,321", "thread_id": "4636", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002548" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0d400000" }, { "name": "SectionOffset", "value": "0x0328d4c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1514 }, { "timestamp": "2026-05-29 01:05:17,321", "thread_id": "4636", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0cad1000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1515 }, { "timestamp": "2026-05-29 01:05:17,321", "thread_id": "4636", "caller": "0x7fff557d6fb6", "parentcaller": "0x7fff557d6ef4", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "79EAC9EE-BAF9-11CE-8C82-00AA004BA90B" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1516 }, { "timestamp": "2026-05-29 01:05:17,321", "thread_id": "4636", "caller": "0x7fff577cfcb5", "parentcaller": "0x7fff57815984", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002518" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1517 }, { "timestamp": "2026-05-29 01:05:17,321", "thread_id": "4636", "caller": "0x7fff577cfcb5", "parentcaller": "0x7fff57815984", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002518" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1518 }, { "timestamp": "2026-05-29 01:05:17,321", "thread_id": "4636", "caller": "0x7fff577cfcb5", "parentcaller": "0x7fff57815984", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002518" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1519 }, { "timestamp": "2026-05-29 01:05:17,321", "thread_id": "4636", "caller": "0x7fff577d6579", "parentcaller": "0x7fff5781c32f", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002518" }, { "name": "DesiredAccess", "value": "0x00120080", "pretty_value": "FILE_READ_ATTRIBUTES|READ_CONTROL|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1520 }, { "timestamp": "2026-05-29 01:05:17,321", "thread_id": "4636", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001cc4" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\windowspowershell\\v1.0\\powershell.exe" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1521 }, { "timestamp": "2026-05-29 01:05:17,321", "thread_id": "4636", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x40000003", "arguments": [ { "name": "SectionHandle", "value": "0x0000251c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dc20000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x0007d000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1522 }, { "timestamp": "2026-05-29 01:05:17,321", "thread_id": "4636", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc000003a", "pretty_return": "OBJECT_PATH_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\windowspowershell\\SystemResources\\powershell.exe.mun" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1523 }, { "timestamp": "2026-05-29 01:05:17,321", "thread_id": "4636", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dc20000" }, { "name": "RegionSize", "value": "0x0007d000" } ], "repeated": 0, "id": 1524 }, { "timestamp": "2026-05-29 01:05:17,321", "thread_id": "4636", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001cc4" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "ShareAccess", "value": "0" } ], "repeated": 0, "id": 1525 }, { "timestamp": "2026-05-29 01:05:17,321", "thread_id": "4636", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "317D06E8-5F24-433D-BDF7-79CE68D8ABC2" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EC5EC8A9-C395-4314-9C77-54D7A935FF70" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1526 }, { "timestamp": "2026-05-29 01:05:17,337", "thread_id": "4636", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0cad4000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1527 }, { "timestamp": "2026-05-29 01:05:17,337", "thread_id": "6160", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 1528 }, { "timestamp": "2026-05-29 01:05:17,337", "thread_id": "6160", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0cad6000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1529 }, { "timestamp": "2026-05-29 01:05:17,352", "thread_id": "6160", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0cad8000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1530 }, { "timestamp": "2026-05-29 01:05:17,368", "thread_id": "6160", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0cada000" }, { "name": "RegionSize", "value": "0x00009000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1531 }, { "timestamp": "2026-05-29 01:05:17,383", "thread_id": "6160", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0cae3000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1532 }, { "timestamp": "2026-05-29 01:05:17,383", "thread_id": "6160", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0cae8000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1533 }, { "timestamp": "2026-05-29 01:05:17,383", "thread_id": "6160", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0caed000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1534 }, { "timestamp": "2026-05-29 01:05:17,383", "thread_id": "6160", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0caf0000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1535 }, { "timestamp": "2026-05-29 01:05:17,399", "thread_id": "6160", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 1536 }, { "timestamp": "2026-05-29 01:05:17,399", "thread_id": "6160", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0caf3000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1537 }, { "timestamp": "2026-05-29 01:05:17,399", "thread_id": "6160", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0caf6000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1538 }, { "timestamp": "2026-05-29 01:05:17,399", "thread_id": "6160", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0cafb000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1539 }, { "timestamp": "2026-05-29 01:05:17,399", "thread_id": "6160", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 1540 }, { "timestamp": "2026-05-29 01:05:17,430", "thread_id": "6160", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0cb00000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1541 }, { "timestamp": "2026-05-29 01:05:17,446", "thread_id": "6160", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0cb03000" }, { "name": "RegionSize", "value": "0x00009000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1542 }, { "timestamp": "2026-05-29 01:05:17,446", "thread_id": "6160", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 1543 }, { "timestamp": "2026-05-29 01:05:17,446", "thread_id": "6160", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0cb0c000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1544 }, { "timestamp": "2026-05-29 01:05:17,462", "thread_id": "6160", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0cb0f000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1545 }, { "timestamp": "2026-05-29 01:05:17,462", "thread_id": "6160", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 3, "id": 1546 }, { "timestamp": "2026-05-29 01:05:17,462", "thread_id": "6160", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0cb14000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1547 }, { "timestamp": "2026-05-29 01:05:17,462", "thread_id": "6160", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 5, "id": 1548 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "6160", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0cb17000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1549 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "6160", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0cb1a000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1550 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "6160", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0cb1d000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1551 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "6160", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0cb20000" }, { "name": "RegionSize", "value": "0x00009000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1552 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "6160", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0cb29000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1553 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "6160", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 1554 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "4812", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\execmodelclient" }, { "name": "DllBase", "value": "0x7fff46d30000" } ], "repeated": 0, "id": 1555 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "4812", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\execmodelclient.dll" }, { "name": "BaseAddress", "value": "0x7fff46d30000" } ], "repeated": 0, "id": 1556 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "4812", "caller": "0x7fff41dd7741", "parentcaller": "0x7fff41dd8661", "category": "com", "api": "CoGetClassObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "38142214-ED63-4965-9214-1BBC06E130E9" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "8E1BBBB9-B3D5-430D-B276-D0E7454CAAB2" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1557 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "4812", "caller": "0x7fff46d3907d", "parentcaller": "0x7fff41dd778e", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "D648FEA1-EA00-4FF4-B8BD-034BD2B25A23" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "1D868537-EEA2-4C03-BB99-8A58862F7A59" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1558 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "4812", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1559 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "4812", "caller": "0x7fff5181c45c", "parentcaller": "0x7fff46d390c9", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "6B3B8D23-FA8D-40B9-8DBD-B950333E2C52" }, { "name": "ClsContext", "value": "0x00000004", "pretty_value": "CLSCTX_LOCAL_SERVER" }, { "name": "riid", "value": "6D5140C1-7436-11CE-8034-00AA006009FA" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1560 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "4812", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 1561 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "4812", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff41dd8695", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\ploptin" }, { "name": "DllBase", "value": "0x7fff435d0000" } ], "repeated": 0, "id": 1562 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "4812", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff41dd8695", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00800000" }, { "name": "FileName", "value": "ploptin.dll" }, { "name": "BaseAddress", "value": "0x7fff435d0000" } ], "repeated": 0, "id": 1563 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "4812", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff41dd86fd", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\ploptin" }, { "name": "DllBase", "value": "0x7fff435d0000" } ], "repeated": 0, "id": 1564 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "4812", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff435d0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1565 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "4812", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001e68" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1566 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "4812", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002548" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0d430000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1567 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "4812", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0d430000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1568 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "4812", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000230c" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.StartMenuExperienceHost_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1569 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "4812", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000237c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0d430000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1570 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "4812", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0d430000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1571 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "4812", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000230c" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ShellExperienceHost_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1572 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "4812", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000237c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0d430000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1573 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "4812", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0d430000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1574 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "4812", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000230c" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.SecHealthUI_10.0.19041.3636_neutral__cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1575 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "4812", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002290" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0d430000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1576 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "4812", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0d430000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1577 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "4812", "caller": "0x7fff41dd7741", "parentcaller": "0x7fff41dd8661", "category": "com", "api": "CoGetClassObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "38142214-ED63-4965-9214-1BBC06E130E9" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "8E1BBBB9-B3D5-430D-B276-D0E7454CAAB2" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1578 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "4812", "caller": "0x7fff46d3907d", "parentcaller": "0x7fff41dd778e", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "D648FEA1-EA00-4FF4-B8BD-034BD2B25A23" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "1D868537-EEA2-4C03-BB99-8A58862F7A59" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1579 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "4812", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1580 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "4812", "caller": "0x7fff5181c45c", "parentcaller": "0x7fff46d390c9", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "6B3B8D23-FA8D-40B9-8DBD-B950333E2C52" }, { "name": "ClsContext", "value": "0x00000004", "pretty_value": "CLSCTX_LOCAL_SERVER" }, { "name": "riid", "value": "6D5140C1-7436-11CE-8034-00AA006009FA" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1581 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "4812", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 1582 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "4812", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff41dd8695", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\ploptin" }, { "name": "DllBase", "value": "0x7fff435d0000" } ], "repeated": 0, "id": 1583 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "4812", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff41dd8695", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00800000" }, { "name": "FileName", "value": "ploptin.dll" }, { "name": "BaseAddress", "value": "0x7fff435d0000" } ], "repeated": 0, "id": 1584 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "4812", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff41dd86fd", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\ploptin" }, { "name": "DllBase", "value": "0x7fff435d0000" } ], "repeated": 0, "id": 1585 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "4812", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff435d0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1586 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "4812", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002290" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\windows.immersivecontrolpanel_10.0.2.1000_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1587 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "4812", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000230c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0d430000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1588 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "4812", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0d430000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1589 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "4812", "caller": "0x7fff57fc0571", "parentcaller": "0x7fff57fc0427", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000230c" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\apppatch\\sysmain.sdb" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1590 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "4812", "caller": "0x7fff57fc02b3", "parentcaller": "0x7fff57fc003b", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001e68" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7df4add90000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x003e3000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1591 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "4812", "caller": "0x7fff57fc1830", "parentcaller": "0x7fff57fc1772", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7df4add90000" }, { "name": "RegionSize", "value": "0x003e3000" } ], "repeated": 0, "id": 1592 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "4812", "caller": "0x7fff41dd7741", "parentcaller": "0x7fff41dd8661", "category": "com", "api": "CoGetClassObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "38142214-ED63-4965-9214-1BBC06E130E9" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "8E1BBBB9-B3D5-430D-B276-D0E7454CAAB2" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1593 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "4812", "caller": "0x7fff46d3907d", "parentcaller": "0x7fff41dd778e", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "D648FEA1-EA00-4FF4-B8BD-034BD2B25A23" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "1D868537-EEA2-4C03-BB99-8A58862F7A59" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1594 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "4812", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1595 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "4812", "caller": "0x7fff5181c45c", "parentcaller": "0x7fff46d390c9", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "6B3B8D23-FA8D-40B9-8DBD-B950333E2C52" }, { "name": "ClsContext", "value": "0x00000004", "pretty_value": "CLSCTX_LOCAL_SERVER" }, { "name": "riid", "value": "6D5140C1-7436-11CE-8034-00AA006009FA" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1596 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "4812", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 1597 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "4812", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff41dd8695", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\ploptin" }, { "name": "DllBase", "value": "0x7fff435d0000" } ], "repeated": 0, "id": 1598 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "4812", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff41dd8695", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00800000" }, { "name": "FileName", "value": "ploptin.dll" }, { "name": "BaseAddress", "value": "0x7fff435d0000" } ], "repeated": 0, "id": 1599 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "4812", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff41dd86fd", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\ploptin" }, { "name": "DllBase", "value": "0x7fff435d0000" } ], "repeated": 0, "id": 1600 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "4812", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff435d0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1601 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "4812", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002290" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1602 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "4812", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000019d4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0d430000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00003000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1603 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "4812", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0d430000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 1604 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "5108", "caller": "0x7fff577cfcb5", "parentcaller": "0x7fff57815984", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001aa8" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files (x86)\\Microsoft\\" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1605 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "5108", "caller": "0x7fff577cfcb5", "parentcaller": "0x7fff57815984", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001aa8" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1606 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "3424", "caller": "0x7ff79bc79d10", "parentcaller": "0x7ff79bc79c74", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1607 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 1608 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "5000", "caller": "0x7fff41dbd59f", "parentcaller": "0x7fff41dfc80c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001190" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "\\Device\\Bam" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1609 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "5000", "caller": "0x7fff41dbe842", "parentcaller": "0x7fff41dbd62c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000020f8" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "\\Device\\Bam" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1610 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "6252", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1611 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "6160", "caller": "0x7fff577f3013", "parentcaller": "0x7fff41e0672b", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001520" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\GameDVR\\KnownGameList.bin" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x0c\\xaf\\x04\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1612 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1613 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "4620", "caller": "0x7fff40c74428", "parentcaller": "0x7fff40c73a03", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "F0AE1542-F497-484B-A175-A20DB09144BA" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "8DC24A1A-6314-4769-9D68-179786F4CED6" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1614 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "6252", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff557c9e99", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x4574f454d" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1615 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "4620", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 1616 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "4620", "caller": "0x7fff55825882", "parentcaller": "0x7fff55828f55", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "4234D49B-0245-4DF3-B780-3893943456E1" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "000214E6-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1617 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "4620", "caller": "0x7fff44bb58e1", "parentcaller": "0x7fff44bb5ef1", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "02C5CCF3-805F-4654-A7B7-340A74335365" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1618 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "5000", "caller": "0x7fff41dbe842", "parentcaller": "0x7fff41dbd88a", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c0" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "\\Device\\Bam" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1619 }, { "timestamp": "2026-05-29 01:05:17,899", "thread_id": "5108", "caller": "0x7fff577cfcb5", "parentcaller": "0x7fff57815984", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001e68" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1620 }, { "timestamp": "2026-05-29 01:05:17,899", "thread_id": "5108", "caller": "0x7fff577cfcb5", "parentcaller": "0x7fff57815984", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001e68" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1621 }, { "timestamp": "2026-05-29 01:05:17,899", "thread_id": "5108", "caller": "0x7fff577cfcb5", "parentcaller": "0x7fff57815984", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001e68" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1622 }, { "timestamp": "2026-05-29 01:05:17,899", "thread_id": "3424", "caller": "0x7ff79bc79d10", "parentcaller": "0x7ff79bc79c74", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1623 }, { "timestamp": "2026-05-29 01:05:17,899", "thread_id": "5000", "caller": "0x7fff41dbd59f", "parentcaller": "0x7fff41dfc80c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000230c" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "\\Device\\Bam" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1624 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 1625 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000237c" }, { "name": "DesiredAccess", "value": "0x00020000", "pretty_value": "READ_CONTROL" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 1, "id": 1626 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002488" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1627 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "6252", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 1628 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "4500", "caller": "0x7fff40c74428", "parentcaller": "0x7fff40c73a03", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "F0AE1542-F497-484B-A175-A20DB09144BA" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "8DC24A1A-6314-4769-9D68-179786F4CED6" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1629 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "6252", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff557c9e99", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x4574f454d" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1630 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "4500", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 1631 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "4500", "caller": "0x7fff55825882", "parentcaller": "0x7fff55828f55", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "4234D49B-0245-4DF3-B780-3893943456E1" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "000214E6-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1632 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "4500", "caller": "0x7fff44bb58e1", "parentcaller": "0x7fff44bb5ef1", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "02C5CCF3-805F-4654-A7B7-340A74335365" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1633 }, { "timestamp": "2026-05-29 01:05:17,946", "thread_id": "4696", "caller": "0x7ff79bc7a06e", "parentcaller": "0x7ff79bc66f8c", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1634 }, { "timestamp": "2026-05-29 01:05:17,946", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 1635 }, { "timestamp": "2026-05-29 01:05:17,962", "thread_id": "4696", "caller": "0x7ff79bc7a06e", "parentcaller": "0x7ff79bc66f8c", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1636 }, { "timestamp": "2026-05-29 01:05:17,962", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 1637 }, { "timestamp": "2026-05-29 01:05:17,977", "thread_id": "4696", "caller": "0x7ff79bc7a06e", "parentcaller": "0x7ff79bc66f8c", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1638 }, { "timestamp": "2026-05-29 01:05:17,977", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 1639 }, { "timestamp": "2026-05-29 01:05:18,008", "thread_id": "4696", "caller": "0x7ff79bc7a06e", "parentcaller": "0x7ff79bc66f8c", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1640 }, { "timestamp": "2026-05-29 01:05:18,008", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 1641 }, { "timestamp": "2026-05-29 01:05:18,024", "thread_id": "4812", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1642 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "4696", "caller": "0x7ff79bc7a06e", "parentcaller": "0x7ff79bc66f8c", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1643 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 1644 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "6252", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 1645 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "4620", "caller": "0x7fff40c74428", "parentcaller": "0x7fff40c73a03", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "F0AE1542-F497-484B-A175-A20DB09144BA" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "8DC24A1A-6314-4769-9D68-179786F4CED6" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1646 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "6252", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff557c9e99", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x4574f454d" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1647 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002058" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000230c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1648 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000230c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0d430000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1649 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002058" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002058" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1650 }, { "timestamp": "2026-05-29 01:05:18,071", "thread_id": "4696", "caller": "0x7ff79bc7a06e", "parentcaller": "0x7ff79bc66f8c", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1651 }, { "timestamp": "2026-05-29 01:05:18,071", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 1652 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bcbc401", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "Handle", "value": "0x00002574" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 1653 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bcbc434", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002574" }, { "name": "ValueName", "value": "IsFeedsAvailable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\IsFeedsAvailable" } ], "repeated": 0, "id": 1654 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bcbc458", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002574" } ], "repeated": 0, "id": 1655 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 1656 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1657 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002574" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 1658 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002574" }, { "name": "ValueName", "value": "HeadlinesOnboardingComplete" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\HeadlinesOnboardingComplete" } ], "repeated": 0, "id": 1659 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002574" } ], "repeated": 0, "id": 1660 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 1661 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1662 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002574" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 1663 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002574" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 1664 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002574" } ], "repeated": 0, "id": 1665 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bcbc401", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "Handle", "value": "0x00002574" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 1666 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bcbc434", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002574" }, { "name": "ValueName", "value": "IsFeedsAvailable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\IsFeedsAvailable" } ], "repeated": 0, "id": 1667 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bcbc458", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002574" } ], "repeated": 0, "id": 1668 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 1669 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1670 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002574" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 1671 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002574" }, { "name": "ValueName", "value": "HeadlinesOnboardingComplete" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\HeadlinesOnboardingComplete" } ], "repeated": 0, "id": 1672 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002574" } ], "repeated": 0, "id": 1673 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 1674 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1675 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002574" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 1676 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002574" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 1677 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002574" } ], "repeated": 0, "id": 1678 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bcbc401", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "Handle", "value": "0x00002574" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 1679 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bcbc434", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002574" }, { "name": "ValueName", "value": "IsFeedsAvailable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\IsFeedsAvailable" } ], "repeated": 0, "id": 1680 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bcbc458", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002574" } ], "repeated": 0, "id": 1681 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 1682 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1683 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002574" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 1684 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002574" }, { "name": "ValueName", "value": "HeadlinesOnboardingComplete" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\HeadlinesOnboardingComplete" } ], "repeated": 0, "id": 1685 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002574" } ], "repeated": 0, "id": 1686 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 1687 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1688 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002574" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 1689 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002574" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 1690 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002574" } ], "repeated": 0, "id": 1691 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bcbc401", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "Handle", "value": "0x00002574" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 1692 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bcbc434", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002574" }, { "name": "ValueName", "value": "IsFeedsAvailable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\IsFeedsAvailable" } ], "repeated": 0, "id": 1693 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bcbc458", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002574" } ], "repeated": 0, "id": 1694 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 1695 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1696 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002574" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 1697 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002574" }, { "name": "ValueName", "value": "HeadlinesOnboardingComplete" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\HeadlinesOnboardingComplete" } ], "repeated": 0, "id": 1698 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002574" } ], "repeated": 0, "id": 1699 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 1700 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1701 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002574" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 1702 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002574" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 1703 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002574" } ], "repeated": 0, "id": 1704 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 1705 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1706 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002574" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 1707 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002574" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 1708 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002574" } ], "repeated": 0, "id": 1709 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc557d2", "parentcaller": "0x7ff79bd1630d", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "TaskbarMonitor" }, { "name": "Atom", "value": "0x0000c045" } ], "repeated": 0, "id": 1710 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 1711 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1712 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002574" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 1713 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002574" }, { "name": "ValueName", "value": "ShellFeedsTaskbarContentUpdateMode" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarContentUpdateMode" } ], "repeated": 0, "id": 1714 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002574" } ], "repeated": 0, "id": 1715 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bcbc401", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "Handle", "value": "0x00002574" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 1716 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bcbc434", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002574" }, { "name": "ValueName", "value": "IsFeedsAvailable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\IsFeedsAvailable" } ], "repeated": 0, "id": 1717 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bcbc458", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002574" } ], "repeated": 0, "id": 1718 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 1719 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1720 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002574" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 1721 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002574" }, { "name": "ValueName", "value": "HeadlinesOnboardingComplete" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\HeadlinesOnboardingComplete" } ], "repeated": 0, "id": 1722 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002574" } ], "repeated": 0, "id": 1723 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 1724 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1725 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002574" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 1726 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002574" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 1727 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002574" } ], "repeated": 0, "id": 1728 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bcbc401", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "Handle", "value": "0x00002574" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 1729 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bcbc434", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002574" }, { "name": "ValueName", "value": "IsFeedsAvailable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\IsFeedsAvailable" } ], "repeated": 0, "id": 1730 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bcbc458", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002574" } ], "repeated": 0, "id": 1731 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 1732 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1733 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002574" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 1734 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002574" }, { "name": "ValueName", "value": "HeadlinesOnboardingComplete" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\HeadlinesOnboardingComplete" } ], "repeated": 0, "id": 1735 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002574" } ], "repeated": 0, "id": 1736 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 1737 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1738 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002574" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 1739 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002574" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 1740 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002574" } ], "repeated": 0, "id": 1741 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bcbc401", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "Handle", "value": "0x00002574" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 1742 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bcbc434", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002574" }, { "name": "ValueName", "value": "IsFeedsAvailable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\IsFeedsAvailable" } ], "repeated": 0, "id": 1743 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bcbc458", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002574" } ], "repeated": 0, "id": 1744 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 1745 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1746 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002574" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 1747 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002574" }, { "name": "ValueName", "value": "HeadlinesOnboardingComplete" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\HeadlinesOnboardingComplete" } ], "repeated": 0, "id": 1748 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002574" } ], "repeated": 0, "id": 1749 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 1750 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1751 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002574" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 1752 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002574" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 1753 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002574" } ], "repeated": 0, "id": 1754 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bcbc401", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "Handle", "value": "0x00002574" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 1755 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bcbc434", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002574" }, { "name": "ValueName", "value": "IsFeedsAvailable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\IsFeedsAvailable" } ], "repeated": 0, "id": 1756 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bcbc458", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002574" } ], "repeated": 0, "id": 1757 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 1758 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1759 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002574" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 1760 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002574" }, { "name": "ValueName", "value": "HeadlinesOnboardingComplete" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\HeadlinesOnboardingComplete" } ], "repeated": 0, "id": 1761 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002574" } ], "repeated": 0, "id": 1762 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 1763 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1764 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002574" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 1765 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002574" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 1766 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002574" } ], "repeated": 0, "id": 1767 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 1768 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1769 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002574" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 1770 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002574" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 1771 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002574" } ], "repeated": 0, "id": 1772 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc557d2", "parentcaller": "0x7ff79bd1630d", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "TaskbarMonitor" }, { "name": "Atom", "value": "0x0000c045" } ], "repeated": 0, "id": 1773 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 1774 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1775 }, { "timestamp": "2026-05-29 01:05:18,227", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002574" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 1776 }, { "timestamp": "2026-05-29 01:05:18,243", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002574" }, { "name": "ValueName", "value": "ShellFeedsTaskbarContentUpdateMode" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarContentUpdateMode" } ], "repeated": 0, "id": 1777 }, { "timestamp": "2026-05-29 01:05:18,243", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002574" } ], "repeated": 0, "id": 1778 }, { "timestamp": "2026-05-29 01:05:18,243", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc686b4", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 1779 }, { "timestamp": "2026-05-29 01:05:18,243", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xe2\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x005\\x18\\xff\\x7f\\x00\\x00(\\xe3\\\\x03\\x00\\x00\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1780 }, { "timestamp": "2026-05-29 01:05:18,243", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002574" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 1781 }, { "timestamp": "2026-05-29 01:05:18,243", "thread_id": "4696", "caller": "0x7ff79bc8a418", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002574" } ], "repeated": 0, "id": 1782 }, { "timestamp": "2026-05-29 01:05:18,243", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc686b4", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 1783 }, { "timestamp": "2026-05-29 01:05:18,243", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xe2\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x005\\x18\\xff\\x7f\\x00\\x00(\\xe3\\\\x03\\x00\\x00\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1784 }, { "timestamp": "2026-05-29 01:05:18,243", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002574" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 1785 }, { "timestamp": "2026-05-29 01:05:18,243", "thread_id": "4696", "caller": "0x7ff79bc8a418", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002574" } ], "repeated": 0, "id": 1786 }, { "timestamp": "2026-05-29 01:05:18,243", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc686b4", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 1787 }, { "timestamp": "2026-05-29 01:05:18,243", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xe2\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x005\\x18\\xff\\x7f\\x00\\x00(\\xe3\\\\x03\\x00\\x00\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1788 }, { "timestamp": "2026-05-29 01:05:18,243", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002574" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 1789 }, { "timestamp": "2026-05-29 01:05:18,243", "thread_id": "4696", "caller": "0x7ff79bc8a418", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002574" } ], "repeated": 0, "id": 1790 }, { "timestamp": "2026-05-29 01:05:18,243", "thread_id": "4696", "caller": "0x7ff79bc7a06e", "parentcaller": "0x7ff79bc66f8c", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1791 }, { "timestamp": "2026-05-29 01:05:18,243", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "CLSID\\{56AD4C5D-B908-4F85-8FF1-7940C29B3BCF}\\Instance" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\CLSID\\{56AD4C5D-B908-4F85-8FF1-7940C29B3BCF}\\Instance" } ], "repeated": 0, "id": 1792 }, { "timestamp": "2026-05-29 01:05:18,243", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 1793 }, { "timestamp": "2026-05-29 01:05:18,243", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff58be0000", "arguments": [ { "name": "lpLibFileName", "value": "shell32.dll" }, { "name": "dwFlags", "value": "0x00004000" } ], "repeated": 0, "id": 1794 }, { "timestamp": "2026-05-29 01:05:18,243", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "SHELL32.dll" }, { "name": "ModuleHandle", "value": "0x7fff58be0000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff58c378f0" } ], "repeated": 0, "id": 1795 }, { "timestamp": "2026-05-29 01:05:18,243", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "synchronization", "api": "NtFindAtom", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "AtomName", "value": "{9F4C2855-9F79-4B39-A8D0-E1D42DE1D5F3} 3" }, { "name": "Atom", "value": "0x00000000" } ], "repeated": 0, "id": 1796 }, { "timestamp": "2026-05-29 01:05:18,243", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc68e6a", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 2, "id": 1797 }, { "timestamp": "2026-05-29 01:05:18,243", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xe2\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x005\\x18\\xff\\x7f\\x00\\x00(\\xe3\\\\x03\\x00\\x00\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1798 }, { "timestamp": "2026-05-29 01:05:18,243", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002574" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 1799 }, { "timestamp": "2026-05-29 01:05:18,243", "thread_id": "4696", "caller": "0x7ff79bc8a418", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002574" } ], "repeated": 0, "id": 1800 }, { "timestamp": "2026-05-29 01:05:18,352", "thread_id": "11660", "caller": "0x0d430043", "parentcaller": "0x0d43001c", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "93" }, { "name": "ProcessInformation", "value": "\\x7f7\\x9e}" } ], "repeated": 0, "id": 1801 }, { "timestamp": "2026-05-29 01:05:18,352", "thread_id": "11660", "caller": "0x0d430043", "parentcaller": "0x0d43001c", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\rl4cuydm\\dll\\ELAodRE.dll" } ], "repeated": 0, "id": 1802 }, { "timestamp": "2026-05-29 01:05:18,352", "thread_id": "11660", "caller": "0x7fff59fa467e", "parentcaller": "0x7fff57fc734d", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "12" }, { "name": "ThreadInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "11660" } ], "repeated": 0, "id": 1803 }, { "timestamp": "2026-05-29 01:05:18,368", "thread_id": "11660", "caller": "0x7fff59fa469e", "parentcaller": "0x7fff57fc734d", "category": "threading", "api": "NtTerminateThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00000000" }, { "name": "ExitStatus", "value": "0x00000005" }, { "name": "ThreadId", "value": "0" }, { "name": "ProcessId", "value": "0" } ], "repeated": 0, "id": 1804 }, { "timestamp": "2026-05-29 01:05:18,571", "thread_id": "4696", "caller": "0x7ff79bc76bd8", "parentcaller": "0x7ff79bc8a0c8", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00010110" }, { "name": "Message", "value": "0x0000c028" } ], "repeated": 1, "id": 1805 }, { "timestamp": "2026-05-29 01:05:18,571", "thread_id": "4696", "caller": "0x7ff79bc521d5", "parentcaller": "0x7ff79bc5203a", "category": "system", "api": "GetLastInputInfo", "status": true, "return": "0x00000001", "arguments": [], "repeated": 0, "id": 1806 }, { "timestamp": "2026-05-29 01:05:18,571", "thread_id": "4696", "caller": "0x7ff79bc521fe", "parentcaller": "0x7ff79bc5203a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002568" } ], "repeated": 0, "id": 1807 }, { "timestamp": "2026-05-29 01:05:18,571", "thread_id": "4696", "caller": "0x7ff79bc521fe", "parentcaller": "0x7ff79bc5203a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 1808 }, { "timestamp": "2026-05-29 01:05:18,571", "thread_id": "4696", "caller": "0x7ff79bc521fe", "parentcaller": "0x7ff79bc5203a", "category": "device", "api": "NtPowerInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "InformationLevel", "value": "16" }, { "name": "InputBuffer", "value": "" }, { "name": "OutputBuffer", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1809 }, { "timestamp": "2026-05-29 01:05:18,571", "thread_id": "4696", "caller": "0x7ff79bc521fe", "parentcaller": "0x7ff79bc5203a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 1810 }, { "timestamp": "2026-05-29 01:05:18,571", "thread_id": "4696", "caller": "0x7ff79bc76bd8", "parentcaller": "0x7ff79bc8a0c8", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00010110" }, { "name": "Message", "value": "0x0000c028" } ], "repeated": 1, "id": 1811 }, { "timestamp": "2026-05-29 01:05:18,571", "thread_id": "6156", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5978ef53", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000257c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1812 }, { "timestamp": "2026-05-29 01:05:18,571", "thread_id": "6156", "caller": "0x7fff597abf07", "parentcaller": "0x7fff597abe66", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1813 }, { "timestamp": "2026-05-29 01:05:18,571", "thread_id": "6156", "caller": "0x7fff59765bc1", "parentcaller": "0x7fff59765b34", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002440" } ], "repeated": 0, "id": 1814 }, { "timestamp": "2026-05-29 01:05:18,587", "thread_id": "4696", "caller": "0x7ff79bc76bd8", "parentcaller": "0x7ff79bc8a0c8", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00010110" }, { "name": "Message", "value": "0x0000c028" } ], "repeated": 2, "id": 1815 }, { "timestamp": "2026-05-29 01:05:18,587", "thread_id": "5000", "caller": "0x7fff57fc2eeb", "parentcaller": "0x7fff581ba00f", "category": "synchronization", "api": "NtFindAtom", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "AtomName", "value": "Windows.Internal.Shell.Holographic.Win32PortedView" }, { "name": "Atom", "value": "0x00000000" } ], "repeated": 1, "id": 1816 }, { "timestamp": "2026-05-29 01:05:18,602", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff455848a6", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000256c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "11916" }, { "name": "ProcessName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" } ], "repeated": 0, "id": 1817 }, { "timestamp": "2026-05-29 01:05:18,602", "thread_id": "5000", "caller": "0x7fff5781026b", "parentcaller": "0x7fff45584920", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000256c" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002568" } ], "repeated": 0, "id": 1818 }, { "timestamp": "2026-05-29 01:05:18,602", "thread_id": "5000", "caller": "0x7fff45584c45", "parentcaller": "0x7fff45584941", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1819 }, { "timestamp": "2026-05-29 01:05:18,602", "thread_id": "5000", "caller": "0x7fff45584ce5", "parentcaller": "0x7fff45584941", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00@\\x93\\xc6\\x0b\\x00\\x00\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00h\\x93\\xc6\\x0b\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x93\\xc6\\x0b\\x00\\x00\\x00\\x00T\\x00S\\x00A\\x00:\\x00/\\x00/\\x00P\\x00r\\x00o\\x00c\\x00U\\x00n\\x00i\\x00q\\x00u\\x00e\\x00\\xb0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe2\\x1a\\x0b\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1820 }, { "timestamp": "2026-05-29 01:05:18,602", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff45584956", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002568" } ], "repeated": 0, "id": 1821 }, { "timestamp": "2026-05-29 01:05:18,602", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff455a1181", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 1822 }, { "timestamp": "2026-05-29 01:05:18,602", "thread_id": "5000", "caller": "0x7fff57fc2eeb", "parentcaller": "0x7fff581ba00f", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "MultimonitorActivationException" }, { "name": "Atom", "value": "0x0000c049" } ], "repeated": 0, "id": 1823 }, { "timestamp": "2026-05-29 01:05:18,602", "thread_id": "5000", "caller": "0x7fff57fc2eeb", "parentcaller": "0x7fff581ba00f", "category": "synchronization", "api": "NtFindAtom", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "AtomName", "value": "Windows.Internal.Shell.Holographic.Win32PortedView" }, { "name": "Atom", "value": "0x00000000" } ], "repeated": 1, "id": 1824 }, { "timestamp": "2026-05-29 01:05:18,602", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff455848a6", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002570" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "11916" }, { "name": "ProcessName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" } ], "repeated": 0, "id": 1825 }, { "timestamp": "2026-05-29 01:05:18,602", "thread_id": "5000", "caller": "0x7fff5781026b", "parentcaller": "0x7fff45584920", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002570" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002564" } ], "repeated": 0, "id": 1826 }, { "timestamp": "2026-05-29 01:05:18,602", "thread_id": "5000", "caller": "0x7fff45584c45", "parentcaller": "0x7fff45584941", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1827 }, { "timestamp": "2026-05-29 01:05:18,602", "thread_id": "5000", "caller": "0x7fff45584ce5", "parentcaller": "0x7fff45584941", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00pr\\xc6\\x0b\\x00\\x00\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00\\x98r\\xc6\\x0b\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb8r\\xc6\\x0b\\x00\\x00\\x00\\x00T\\x00S\\x00A\\x00:\\x00/\\x00/\\x00P\\x00r\\x00o\\x00c\\x00U\\x00n\\x00i\\x00q\\x00u\\x00e\\x00\\xb0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe2\\x1a\\x0b\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1828 }, { "timestamp": "2026-05-29 01:05:18,602", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff45584956", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002564" } ], "repeated": 0, "id": 1829 }, { "timestamp": "2026-05-29 01:05:18,602", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff455a1181", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002570" } ], "repeated": 0, "id": 1830 }, { "timestamp": "2026-05-29 01:05:18,602", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 1831 }, { "timestamp": "2026-05-29 01:05:18,602", "thread_id": "5000", "caller": "0x7fff57fc2eeb", "parentcaller": "0x7fff581ba00f", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "MultimonitorActivationException" }, { "name": "Atom", "value": "0x0000c049" } ], "repeated": 0, "id": 1832 }, { "timestamp": "2026-05-29 01:05:18,602", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 1, "id": 1833 }, { "timestamp": "2026-05-29 01:05:18,602", "thread_id": "4696", "caller": "0x7ff79bc76bd8", "parentcaller": "0x7ff79bc8a0c8", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00010110" }, { "name": "Message", "value": "0x0000c028" } ], "repeated": 0, "id": 1834 }, { "timestamp": "2026-05-29 01:05:18,602", "thread_id": "5000", "caller": "0x7fff57fc2eeb", "parentcaller": "0x7fff581ba00f", "category": "synchronization", "api": "NtFindAtom", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "AtomName", "value": "Windows.Internal.Shell.Holographic.Win32PortedView" }, { "name": "Atom", "value": "0x00000000" } ], "repeated": 1, "id": 1835 }, { "timestamp": "2026-05-29 01:05:18,602", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff455848a6", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002568" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "11768" }, { "name": "ProcessName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" } ], "repeated": 0, "id": 1836 }, { "timestamp": "2026-05-29 01:05:18,602", "thread_id": "5000", "caller": "0x7fff5781026b", "parentcaller": "0x7fff45584920", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002568" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002440" } ], "repeated": 0, "id": 1837 }, { "timestamp": "2026-05-29 01:05:18,602", "thread_id": "5000", "caller": "0x7fff45584c45", "parentcaller": "0x7fff45584941", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1838 }, { "timestamp": "2026-05-29 01:05:18,602", "thread_id": "5000", "caller": "0x7fff45584ce5", "parentcaller": "0x7fff45584941", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00pr\\xc6\\x0b\\x00\\x00\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00\\x98r\\xc6\\x0b\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb8r\\xc6\\x0b\\x00\\x00\\x00\\x00T\\x00S\\x00A\\x00:\\x00/\\x00/\\x00P\\x00r\\x00o\\x00c\\x00U\\x00n\\x00i\\x00q\\x00u\\x00e\\x00\\xaf\\x00\\x00\\x00\\x00\\x00\\x00\\x004\\x17\\x0b\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1839 }, { "timestamp": "2026-05-29 01:05:18,602", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff45584956", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002440" } ], "repeated": 0, "id": 1840 }, { "timestamp": "2026-05-29 01:05:18,602", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff455a1181", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002568" } ], "repeated": 0, "id": 1841 }, { "timestamp": "2026-05-29 01:05:18,602", "thread_id": "5000", "caller": "0x7fff57fc2eeb", "parentcaller": "0x7fff581ba00f", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "MultimonitorActivationException" }, { "name": "Atom", "value": "0x0000c049" } ], "repeated": 0, "id": 1842 }, { "timestamp": "2026-05-29 01:05:18,633", "thread_id": "4696", "caller": "0x7ff79bc76bd8", "parentcaller": "0x7ff79bc8a0c8", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00010110" }, { "name": "Message", "value": "0x0000c028" } ], "repeated": 1, "id": 1843 }, { "timestamp": "2026-05-29 01:05:18,633", "thread_id": "5000", "caller": "0x7fff57fc2eeb", "parentcaller": "0x7fff581ba00f", "category": "synchronization", "api": "NtFindAtom", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "AtomName", "value": "Windows.Internal.Shell.Holographic.Win32PortedView" }, { "name": "Atom", "value": "0x00000000" } ], "repeated": 1, "id": 1844 }, { "timestamp": "2026-05-29 01:05:18,633", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff455848a6", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000256c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "11768" }, { "name": "ProcessName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" } ], "repeated": 0, "id": 1845 }, { "timestamp": "2026-05-29 01:05:18,633", "thread_id": "5000", "caller": "0x7fff5781026b", "parentcaller": "0x7fff45584920", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000256c" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002570" } ], "repeated": 0, "id": 1846 }, { "timestamp": "2026-05-29 01:05:18,633", "thread_id": "5000", "caller": "0x7fff45584c45", "parentcaller": "0x7fff45584941", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1847 }, { "timestamp": "2026-05-29 01:05:18,633", "thread_id": "5000", "caller": "0x7fff45584ce5", "parentcaller": "0x7fff45584941", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xb0\\x8c\\xc6\\x0b\\x00\\x00\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00\\xd8\\x8c\\xc6\\x0b\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\\x8c\\xc6\\x0b\\x00\\x00\\x00\\x00T\\x00S\\x00A\\x00:\\x00/\\x00/\\x00P\\x00r\\x00o\\x00c\\x00U\\x00n\\x00i\\x00q\\x00u\\x00e\\x00\\xaf\\x00\\x00\\x00\\x00\\x00\\x00\\x004\\x17\\x0b\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1848 }, { "timestamp": "2026-05-29 01:05:18,633", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff45584956", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002570" } ], "repeated": 0, "id": 1849 }, { "timestamp": "2026-05-29 01:05:18,633", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff455a1181", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 1850 }, { "timestamp": "2026-05-29 01:05:18,633", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 1851 }, { "timestamp": "2026-05-29 01:05:18,633", "thread_id": "5000", "caller": "0x7fff57fc2eeb", "parentcaller": "0x7fff581ba00f", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "MultimonitorActivationException" }, { "name": "Atom", "value": "0x0000c049" } ], "repeated": 0, "id": 1852 }, { "timestamp": "2026-05-29 01:05:18,633", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 1, "id": 1853 }, { "timestamp": "2026-05-29 01:05:18,649", "thread_id": "5000", "caller": "0x7fff57fc2755", "parentcaller": "0x7fff57fc2699", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "{\\x00C\\x006\\x003\\x006\\x005\\x007\\x00F\\x006\\x00-\\x008\\x008\\x005\\x000\\x00-\\x004\\x007\\x000\\x00D\\x00-\\x008\\x008\\x00F\\x008\\x00-\\x004\\x005\\x005\\x00E\\x001\\x006\\x00E\\x00A\\x002\\x00C\\x002\\x006\\x00}\\x00" }, { "name": "Size", "value": "76" }, { "name": "Atom", "value": "0x0000c059" } ], "repeated": 0, "id": 1854 }, { "timestamp": "2026-05-29 01:05:18,649", "thread_id": "4696", "caller": "0x7ff79bc521d5", "parentcaller": "0x7ff79bc5203a", "category": "system", "api": "GetLastInputInfo", "status": true, "return": "0x00000001", "arguments": [], "repeated": 0, "id": 1855 }, { "timestamp": "2026-05-29 01:05:18,649", "thread_id": "4696", "caller": "0x7ff79bc521fe", "parentcaller": "0x7ff79bc5203a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 1856 }, { "timestamp": "2026-05-29 01:05:18,649", "thread_id": "4696", "caller": "0x7ff79bc521fe", "parentcaller": "0x7ff79bc5203a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002574" } ], "repeated": 0, "id": 1857 }, { "timestamp": "2026-05-29 01:05:18,649", "thread_id": "4696", "caller": "0x7ff79bc521fe", "parentcaller": "0x7ff79bc5203a", "category": "device", "api": "NtPowerInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "InformationLevel", "value": "16" }, { "name": "InputBuffer", "value": "" }, { "name": "OutputBuffer", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1858 }, { "timestamp": "2026-05-29 01:05:18,649", "thread_id": "4696", "caller": "0x7ff79bc521fe", "parentcaller": "0x7ff79bc5203a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002574" } ], "repeated": 0, "id": 1859 }, { "timestamp": "2026-05-29 01:05:18,649", "thread_id": "4696", "caller": "0x7ff79bc76bd8", "parentcaller": "0x7ff79bc8a0c8", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00010110" }, { "name": "Message", "value": "0x0000c028" } ], "repeated": 2, "id": 1860 }, { "timestamp": "2026-05-29 01:05:18,727", "thread_id": "4720", "caller": "0x7fff57fc2755", "parentcaller": "0x7fff57fc2699", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "-\\x00%\\x00D\\x004\\x00#\\x00!\\x00`\\x00`\\x00`\\x00`\\x00`\\x00=\\x00E\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x000\\x008\\x00$\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00" }, { "name": "Size", "value": "64" }, { "name": "Atom", "value": "0x0000c07d" } ], "repeated": 0, "id": 1861 }, { "timestamp": "2026-05-29 01:05:18,727", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002574" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002568" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1862 }, { "timestamp": "2026-05-29 01:05:18,727", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002568" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dc20000" }, { "name": "SectionOffset", "value": "0x0779f190" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1863 }, { "timestamp": "2026-05-29 01:05:18,727", "thread_id": "4720", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff5807d567", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dc20000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 1864 }, { "timestamp": "2026-05-29 01:05:18,727", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002568" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dc20000" }, { "name": "SectionOffset", "value": "0x0779f190" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1865 }, { "timestamp": "2026-05-29 01:05:18,727", "thread_id": "4720", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5807d5a3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002568" } ], "repeated": 0, "id": 1866 }, { "timestamp": "2026-05-29 01:05:18,727", "thread_id": "4720", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 1867 }, { "timestamp": "2026-05-29 01:05:18,727", "thread_id": "4720", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1868 }, { "timestamp": "2026-05-29 01:05:18,727", "thread_id": "4720", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002568" }, { "name": "DesiredAccess", "value": "0x00000101", "pretty_value": "KEY_QUERY_VALUE|KEY_WOW64_64KEY" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer" } ], "repeated": 0, "id": 1869 }, { "timestamp": "2026-05-29 01:05:18,727", "thread_id": "4720", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002568" }, { "name": "ValueName", "value": "HubMode" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\HubMode" } ], "repeated": 0, "id": 1870 }, { "timestamp": "2026-05-29 01:05:18,727", "thread_id": "4720", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002568" } ], "repeated": 0, "id": 1871 }, { "timestamp": "2026-05-29 01:05:18,727", "thread_id": "4720", "caller": "0x7fff557b4361", "parentcaller": "0x7fff557b3e47", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 2, "id": 1872 }, { "timestamp": "2026-05-29 01:05:18,727", "thread_id": "4720", "caller": "0x7fff577d07f5", "parentcaller": "0x7fff557b7085", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Users\\admin\\Desktop" } ], "repeated": 0, "id": 1873 }, { "timestamp": "2026-05-29 01:05:18,727", "thread_id": "4720", "caller": "0x7fff557b6e6d", "parentcaller": "0x7fff557b4414", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 1874 }, { "timestamp": "2026-05-29 01:05:18,727", "thread_id": "4720", "caller": "0x7fff5588f616", "parentcaller": "0x7fff5588bf43", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "Handle", "value": "0x00002568" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 1875 }, { "timestamp": "2026-05-29 01:05:18,727", "thread_id": "4720", "caller": "0x7fff5588bf7f", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002568" }, { "name": "SubKey", "value": "{528c102f-0000-0000-0000-300300000000}\\" }, { "name": "Handle", "value": "0x00002440" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\" } ], "repeated": 0, "id": 1876 }, { "timestamp": "2026-05-29 01:05:18,727", "thread_id": "4720", "caller": "0x7fff5588bfa7", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002568" } ], "repeated": 0, "id": 1877 }, { "timestamp": "2026-05-29 01:05:18,727", "thread_id": "4720", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002440" }, { "name": "ValueName", "value": "Generation" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation" } ], "repeated": 0, "id": 1878 }, { "timestamp": "2026-05-29 01:05:18,727", "thread_id": "4720", "caller": "0x7fff5588bfeb", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002440" } ], "repeated": 0, "id": 1879 }, { "timestamp": "2026-05-29 01:05:18,727", "thread_id": "4720", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002440" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1880 }, { "timestamp": "2026-05-29 01:05:18,727", "thread_id": "4720", "caller": "0x7fff5780b767", "parentcaller": "0x7fff558567b1", "category": "filesystem", "api": "NtQueryInformationFile", "status": false, "return": "0xffffffffc000000d", "pretty_return": "INVALID_PARAMETER", "arguments": [ { "name": "FileHandle", "value": "0x00002440" }, { "name": "HandleName", "value": "C:\\" }, { "name": "FileInformationClass", "value": "55", "pretty_value": "FileReplaceCompletionInformation" }, { "name": "FileInformation", "value": "" } ], "repeated": 0, "id": 1881 }, { "timestamp": "2026-05-29 01:05:18,727", "thread_id": "4720", "caller": "0x7fff55856858", "parentcaller": "0x7fff5583c7a3", "category": "filesystem", "api": "NtQueryDirectoryFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002440" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x006\\xean:\\xdd\\xac\\xd5\\x01B\\xd8<0\\x04\\xef\\xdc\\x01\\x9d\\xa9\\xd1\\xc9\\xb8\\xee\\xdc\\x01\\x9d\\xa9\\xd1\\xc9\\xb8\\xee\\xdc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x11\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xee\\x05\\x00\\x00\\x00\\x00\\x01\\x00U\\x00s\\x00e\\x00r\\x00s\\x00" }, { "name": "FileName", "value": "C:\\Users" }, { "name": "FileInformationClass", "value": "37", "pretty_value": "FileIdBothDirectoryInformation" } ], "repeated": 0, "id": 1882 }, { "timestamp": "2026-05-29 01:05:18,727", "thread_id": "4720", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5583c7e2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002440" } ], "repeated": 0, "id": 1883 }, { "timestamp": "2026-05-29 01:05:18,727", "thread_id": "4720", "caller": "0x7fff558416a9", "parentcaller": "0x7fff5583ed1c", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 1884 }, { "timestamp": "2026-05-29 01:05:18,727", "thread_id": "4720", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002440" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1885 }, { "timestamp": "2026-05-29 01:05:18,727", "thread_id": "4720", "caller": "0x7fff5780b767", "parentcaller": "0x7fff558567b1", "category": "filesystem", "api": "NtQueryInformationFile", "status": false, "return": "0xffffffffc000000d", "pretty_return": "INVALID_PARAMETER", "arguments": [ { "name": "FileHandle", "value": "0x00002440" }, { "name": "HandleName", "value": "C:\\Users" }, { "name": "FileInformationClass", "value": "55", "pretty_value": "FileReplaceCompletionInformation" }, { "name": "FileInformation", "value": "" } ], "repeated": 0, "id": 1886 }, { "timestamp": "2026-05-29 01:05:18,727", "thread_id": "4720", "caller": "0x7fff55856858", "parentcaller": "0x7fff5583c7a3", "category": "filesystem", "api": "NtQueryDirectoryFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002440" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf4a\\xd0\\x9c\\xb6\\xee\\xdc\\x01\\xfa\\xea\\x96k\\x05\\xef\\xdc\\x01\\xfa\\xea\\x96k\\x05\\xef\\xdc\\x01\\xfa\\xea\\x96k\\x05\\xef\\xdc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x004\\x9a\\x01\\x00\\x00\\x00\\x04\\x00a\\x00d\\x00m\\x00i\\x00n\\x00" }, { "name": "FileName", "value": "C:\\Users\\admin" }, { "name": "FileInformationClass", "value": "37", "pretty_value": "FileIdBothDirectoryInformation" } ], "repeated": 0, "id": 1887 }, { "timestamp": "2026-05-29 01:05:18,727", "thread_id": "4720", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5583c7e2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002440" } ], "repeated": 0, "id": 1888 }, { "timestamp": "2026-05-29 01:05:18,727", "thread_id": "4720", "caller": "0x7fff558416a9", "parentcaller": "0x7fff557d9d5a", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1889 }, { "timestamp": "2026-05-29 01:05:18,727", "thread_id": "4720", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002440" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1890 }, { "timestamp": "2026-05-29 01:05:18,727", "thread_id": "4720", "caller": "0x7fff5780b767", "parentcaller": "0x7fff558567b1", "category": "filesystem", "api": "NtQueryInformationFile", "status": false, "return": "0xffffffffc000000d", "pretty_return": "INVALID_PARAMETER", "arguments": [ { "name": "FileHandle", "value": "0x00002440" }, { "name": "HandleName", "value": "C:\\Users\\admin" }, { "name": "FileInformationClass", "value": "55", "pretty_value": "FileReplaceCompletionInformation" }, { "name": "FileInformation", "value": "" } ], "repeated": 0, "id": 1891 }, { "timestamp": "2026-05-29 01:05:18,727", "thread_id": "4720", "caller": "0x7fff55856858", "parentcaller": "0x7fff5583c7a3", "category": "filesystem", "api": "NtQueryDirectoryFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002440" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00R \\xd6\\x9c\\xb6\\xee\\xdc\\x01\\xeea\\xb2:\\x04\\xef\\xdc\\x012);0\\x00\\xef\\xdc\\x012);0\\x00\\xef\\xdc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x11\\x00\\x00\\x00\\x0e\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1b\\xa5\\x01\\x00\\x00\\x00\\x04\\x00D\\x00e\\x00s\\x00k\\x00t\\x00o\\x00p\\x00" }, { "name": "FileName", "value": "C:\\Users\\admin\\Desktop" }, { "name": "FileInformationClass", "value": "37", "pretty_value": "FileIdBothDirectoryInformation" } ], "repeated": 0, "id": 1892 }, { "timestamp": "2026-05-29 01:05:18,727", "thread_id": "4720", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5583c7e2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002440" } ], "repeated": 0, "id": 1893 }, { "timestamp": "2026-05-29 01:05:18,727", "thread_id": "4720", "caller": "0x7fff558416a9", "parentcaller": "0x7fff5583ed1c", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 5, "id": 1894 }, { "timestamp": "2026-05-29 01:05:18,727", "thread_id": "4720", "caller": "0x7fff577d07f5", "parentcaller": "0x7fff557b7085", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Users\\admin\\Desktop" } ], "repeated": 0, "id": 1895 }, { "timestamp": "2026-05-29 01:05:18,727", "thread_id": "4720", "caller": "0x7fff557b6e6d", "parentcaller": "0x7fff557b4414", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 1896 }, { "timestamp": "2026-05-29 01:05:18,727", "thread_id": "4720", "caller": "0x7fff5584a889", "parentcaller": "0x7fff55854528", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "CLSID\\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}" }, { "name": "Handle", "value": "0x00002442" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\CLSID\\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}" } ], "repeated": 0, "id": 1897 }, { "timestamp": "2026-05-29 01:05:18,727", "thread_id": "4720", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002442" }, { "name": "ValueName", "value": "SortOrderIndex" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\\SortOrderIndex" } ], "repeated": 0, "id": 1898 }, { "timestamp": "2026-05-29 01:05:18,727", "thread_id": "4720", "caller": "0x7fff5585457e", "parentcaller": "0x7fff55853dab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002442" } ], "repeated": 0, "id": 1899 }, { "timestamp": "2026-05-29 01:05:18,727", "thread_id": "4720", "caller": "0x7fff577d1e5c", "parentcaller": "0x7fff55854775", "category": "filesystem", "api": "NtQueryFullAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Users\\admin\\Desktop" } ], "repeated": 0, "id": 1900 }, { "timestamp": "2026-05-29 01:05:18,727", "thread_id": "4720", "caller": "0x7fff558548a0", "parentcaller": "0x7fff558545a7", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}" }, { "name": "Handle", "value": "0x00002440" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}" } ], "repeated": 0, "id": 1901 }, { "timestamp": "2026-05-29 01:05:18,727", "thread_id": "4720", "caller": "0x7fff558548be", "parentcaller": "0x7fff558545a7", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002440" } ], "repeated": 0, "id": 1902 }, { "timestamp": "2026-05-29 01:05:18,727", "thread_id": "4720", "caller": "0x7fff558a2104", "parentcaller": "0x7fff557b45b9", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 2, "id": 1903 }, { "timestamp": "2026-05-29 01:05:18,727", "thread_id": "4720", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff58c2dfe4", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dc20000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 1904 }, { "timestamp": "2026-05-29 01:05:18,868", "thread_id": "6156", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbddbb", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002570" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "6136" }, { "name": "ProcessName", "value": "Error obtaining target process name" } ], "repeated": 0, "id": 1905 }, { "timestamp": "2026-05-29 01:05:18,868", "thread_id": "6156", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbddbb", "category": "process", "api": "NtOpenProcess", "status": false, "return": "0xffffffffc0000022", "pretty_return": "ACCESS_DENIED", "arguments": [ { "name": "ProcessHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "1180" } ], "repeated": 0, "id": 1906 }, { "timestamp": "2026-05-29 01:05:18,868", "thread_id": "6156", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbddbb", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002564" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "5624" }, { "name": "ProcessName", "value": "Error obtaining target process name" } ], "repeated": 0, "id": 1907 }, { "timestamp": "2026-05-29 01:05:18,868", "thread_id": "6156", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbddbb", "category": "process", "api": "NtOpenProcess", "status": false, "return": "0xffffffffc0000022", "pretty_return": "ACCESS_DENIED", "arguments": [ { "name": "ProcessHandle", "value": "0x00002564" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "1048" } ], "repeated": 0, "id": 1908 }, { "timestamp": "2026-05-29 01:05:18,868", "thread_id": "6156", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbddbb", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002440" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 1909 }, { "timestamp": "2026-05-29 01:05:18,868", "thread_id": "6156", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbddbb", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002568" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "11260" }, { "name": "ProcessName", "value": "Error obtaining target process name" } ], "repeated": 0, "id": 1910 }, { "timestamp": "2026-05-29 01:05:18,868", "thread_id": "6156", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbddbb", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002560" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "6400" }, { "name": "ProcessName", "value": "Error obtaining target process name" } ], "repeated": 0, "id": 1911 }, { "timestamp": "2026-05-29 01:05:18,868", "thread_id": "6156", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbddbb", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000255c" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "5128" }, { "name": "ProcessName", "value": "Error obtaining target process name" } ], "repeated": 0, "id": 1912 }, { "timestamp": "2026-05-29 01:05:18,868", "thread_id": "6156", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x18\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6156" } ], "repeated": 2, "id": 1913 }, { "timestamp": "2026-05-29 01:05:18,868", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 1914 }, { "timestamp": "2026-05-29 01:05:18,868", "thread_id": "6156", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x18\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6156" } ], "repeated": 2, "id": 1915 }, { "timestamp": "2026-05-29 01:05:18,868", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 1916 }, { "timestamp": "2026-05-29 01:05:18,868", "thread_id": "6156", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x18\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6156" } ], "repeated": 2, "id": 1917 }, { "timestamp": "2026-05-29 01:05:18,868", "thread_id": "4620", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 1918 }, { "timestamp": "2026-05-29 01:05:18,868", "thread_id": "6156", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x18\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6156" } ], "repeated": 2, "id": 1919 }, { "timestamp": "2026-05-29 01:05:18,868", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 1920 }, { "timestamp": "2026-05-29 01:05:18,868", "thread_id": "6156", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x18\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6156" } ], "repeated": 3, "id": 1921 }, { "timestamp": "2026-05-29 01:05:18,868", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 1922 }, { "timestamp": "2026-05-29 01:05:18,868", "thread_id": "6156", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x18\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6156" } ], "repeated": 1, "id": 1923 }, { "timestamp": "2026-05-29 01:05:18,868", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 1924 }, { "timestamp": "2026-05-29 01:05:18,868", "thread_id": "6156", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x18\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6156" } ], "repeated": 2, "id": 1925 }, { "timestamp": "2026-05-29 01:05:18,868", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 1926 }, { "timestamp": "2026-05-29 01:05:18,868", "thread_id": "6156", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x18\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6156" } ], "repeated": 1, "id": 1927 }, { "timestamp": "2026-05-29 01:05:18,868", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 2, "id": 1928 }, { "timestamp": "2026-05-29 01:05:18,868", "thread_id": "6156", "caller": "0x7fff41dbe842", "parentcaller": "0x7fff59fc16e9", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002558" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "\\Device\\Bam" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1929 }, { "timestamp": "2026-05-29 01:05:18,868", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 4, "id": 1930 }, { "timestamp": "2026-05-29 01:05:18,868", "thread_id": "6156", "caller": "0x7fff41dbe8a3", "parentcaller": "0x7fff59fc16e9", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002558" }, { "name": "HandleName", "value": "\\Device\\Bam" }, { "name": "IoControlCode", "value": "0x00220004" }, { "name": "InputBuffer", "value": "\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00p%\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9c\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00d%\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00@$\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00h%\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00`%\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\%\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 1931 }, { "timestamp": "2026-05-29 01:05:18,868", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 1932 }, { "timestamp": "2026-05-29 01:05:18,868", "thread_id": "6156", "caller": "0x7fff577d6785", "parentcaller": "0x7fff41dbe9a9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002570" } ], "repeated": 0, "id": 1933 }, { "timestamp": "2026-05-29 01:05:18,868", "thread_id": "6156", "caller": "0x7fff577d6785", "parentcaller": "0x7fff41dbe9a9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002564" } ], "repeated": 0, "id": 1934 }, { "timestamp": "2026-05-29 01:05:18,868", "thread_id": "6156", "caller": "0x7fff577d6785", "parentcaller": "0x7fff41dbe9a9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002440" } ], "repeated": 0, "id": 1935 }, { "timestamp": "2026-05-29 01:05:18,868", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 1936 }, { "timestamp": "2026-05-29 01:05:18,868", "thread_id": "6156", "caller": "0x7fff577d6785", "parentcaller": "0x7fff41dbe9a9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002568" } ], "repeated": 0, "id": 1937 }, { "timestamp": "2026-05-29 01:05:18,868", "thread_id": "6156", "caller": "0x7fff577d6785", "parentcaller": "0x7fff41dbe9a9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000255c" } ], "repeated": 0, "id": 1938 }, { "timestamp": "2026-05-29 01:05:18,868", "thread_id": "6156", "caller": "0x7fff41dbe9d8", "parentcaller": "0x7fff59fc16e9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002558" } ], "repeated": 0, "id": 1939 }, { "timestamp": "2026-05-29 01:05:18,868", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 27, "id": 1940 }, { "timestamp": "2026-05-29 01:05:18,977", "thread_id": "6156", "caller": "0x7fff597abf07", "parentcaller": "0x7fff597abe66", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1941 }, { "timestamp": "2026-05-29 01:05:18,977", "thread_id": "6156", "caller": "0x7fff59765bc1", "parentcaller": "0x7fff59765b34", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000252c" } ], "repeated": 0, "id": 1942 }, { "timestamp": "2026-05-29 01:05:18,977", "thread_id": "5108", "caller": "0x7fff426da250", "parentcaller": "0x7fff57fc7344", "category": "system", "api": "GetSystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1943 }, { "timestamp": "2026-05-29 01:05:18,977", "thread_id": "4696", "caller": "0x7ff79bc76bd8", "parentcaller": "0x7ff79bc8a0c8", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00010110" }, { "name": "Message", "value": "0x0000c028" } ], "repeated": 2, "id": 1944 }, { "timestamp": "2026-05-29 01:05:18,977", "thread_id": "4696", "caller": "0x7ff79bc1fa2e", "parentcaller": "0x7ff79bc7fc27", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000072" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 1945 }, { "timestamp": "2026-05-29 01:05:18,977", "thread_id": "4696", "caller": "0x7ff79bca5b09", "parentcaller": "0x7ff79bc1fa68", "category": "synchronization", "api": "NtOpenEvent", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "Handle", "value": "0x7ff79bc7fc22" }, { "name": "EventName", "value": "{A1965210-3A9D-4bca-822B-433645B3F5A2}" } ], "repeated": 0, "id": 1946 }, { "timestamp": "2026-05-29 01:05:18,977", "thread_id": "4696", "caller": "0x7ff79bc1faf5", "parentcaller": "0x7ff79bc1fa75", "category": "synchronization", "api": "NtOpenMutant", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "Handle", "value": "0x7ff79bc7fc22" }, { "name": "MutexName", "value": "Local\\__DDrawCheckExclMode__" } ], "repeated": 0, "id": 1947 }, { "timestamp": "2026-05-29 01:05:18,977", "thread_id": "4696", "caller": "0x7ff79bc19217", "parentcaller": "0x7ff79bc1fa94", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 1948 }, { "timestamp": "2026-05-29 01:05:18,977", "thread_id": "4696", "caller": "0x7ff79bc19217", "parentcaller": "0x7ff79bc1fa94", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1949 }, { "timestamp": "2026-05-29 01:05:18,977", "thread_id": "4696", "caller": "0x7ff79bc19217", "parentcaller": "0x7ff79bc1fa94", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000255c" }, { "name": "DesiredAccess", "value": "0x00000101", "pretty_value": "KEY_QUERY_VALUE|KEY_WOW64_64KEY" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\RetailDemo\\OobeWrite" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\RetailDemo\\OobeWrite" } ], "repeated": 0, "id": 1950 }, { "timestamp": "2026-05-29 01:05:18,977", "thread_id": "4696", "caller": "0x7ff79bc19217", "parentcaller": "0x7ff79bc1fa94", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000255c" }, { "name": "ValueName", "value": "Enabled" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RetailDemo\\OobeWrite\\Enabled" } ], "repeated": 0, "id": 1951 }, { "timestamp": "2026-05-29 01:05:18,977", "thread_id": "4696", "caller": "0x7ff79bc19217", "parentcaller": "0x7ff79bc1fa94", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000255c" } ], "repeated": 0, "id": 1952 }, { "timestamp": "2026-05-29 01:05:18,977", "thread_id": "4696", "caller": "0x7ff79bc19232", "parentcaller": "0x7ff79bc1fa94", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1953 }, { "timestamp": "2026-05-29 01:05:18,977", "thread_id": "4696", "caller": "0x7ff79bc521d5", "parentcaller": "0x7ff79bc5203a", "category": "system", "api": "GetLastInputInfo", "status": true, "return": "0x00000001", "arguments": [], "repeated": 0, "id": 1954 }, { "timestamp": "2026-05-29 01:05:18,977", "thread_id": "4696", "caller": "0x7ff79bc521fe", "parentcaller": "0x7ff79bc5203a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000255c" } ], "repeated": 0, "id": 1955 }, { "timestamp": "2026-05-29 01:05:18,977", "thread_id": "4696", "caller": "0x7ff79bc521fe", "parentcaller": "0x7ff79bc5203a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 1956 }, { "timestamp": "2026-05-29 01:05:18,977", "thread_id": "4696", "caller": "0x7ff79bc521fe", "parentcaller": "0x7ff79bc5203a", "category": "device", "api": "NtPowerInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "InformationLevel", "value": "16" }, { "name": "InputBuffer", "value": "" }, { "name": "OutputBuffer", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1957 }, { "timestamp": "2026-05-29 01:05:18,977", "thread_id": "4696", "caller": "0x7ff79bc521fe", "parentcaller": "0x7ff79bc5203a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 1958 }, { "timestamp": "2026-05-29 01:05:18,977", "thread_id": "4696", "caller": "0x7ff79bc7a2d6", "parentcaller": "0x7ff79bc5233a", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1959 }, { "timestamp": "2026-05-29 01:05:18,977", "thread_id": "4696", "caller": "0x7ff79bc7a2d6", "parentcaller": "0x7ff79bc5233a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000016d8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1960 }, { "timestamp": "2026-05-29 01:05:18,977", "thread_id": "4696", "caller": "0x7ff79bc7a2d6", "parentcaller": "0x7ff79bc5233a", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000177c" }, { "name": "ValueName", "value": "{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\\JvaqbjfCbjreFuryy\\i1.0\\cbjrefuryy.rkr" }, { "name": "Data", "value": "\\x00\\x00\\x00\\x00\\x05\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\xf03\n\\x00\\x00\\x00\\x80\\xbf\\x00\\x00\\x80\\xbf\\x00\\x00\\x80\\xbf\\x00\\x00\\x80\\xbf\\x00\\x00\\x80\\xbf\\x00\\x00\\x80\\xbf\\x00\\x00\\x80\\xbf\\x00\\x00\\x80\\xbf\\x00\\x00\\x80\\xbf\\x00\\x00\\x80\\xbf\\xff\\xff\\xff\\xff@\\xe3&6\\x07\\xef\\xdc\\x01\\x00\\x00\\x00\\x00" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\\JvaqbjfCbjreFuryy\\i1.0\\cbjrefuryy.rkr" } ], "repeated": 0, "id": 1961 }, { "timestamp": "2026-05-29 01:05:18,977", "thread_id": "4696", "caller": "0x7ff79bc7a2d6", "parentcaller": "0x7ff79bc5233a", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000177c" }, { "name": "ValueName", "value": "{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\\JvaqbjfCbjreFuryy\\i1.0\\cbjrefuryy.rkr" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Buffer", "value": "\\x00\\x00\\x00\\x00\\x05\\x00\\x00\\x00\\x0b\\x00\\x00\\x00&8\n\\x00\\x00\\x00\\x80\\xbf\\x00\\x00\\x80\\xbf\\x00\\x00\\x80\\xbf\\x00\\x00\\x80\\xbf\\x00\\x00\\x80\\xbf\\x00\\x00\\x80\\xbf\\x00\\x00\\x80\\xbf\\x00\\x00\\x80\\xbf\\x00\\x00\\x80\\xbf\\x00\\x00\\x80\\xbf\\xff\\xff\\xff\\xff@\\xe3&6\\x07\\xef\\xdc\\x01\\x00\\x00\\x00\\x00" }, { "name": "BufferLength", "value": "72" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\\JvaqbjfCbjreFuryy\\i1.0\\cbjrefuryy.rkr" } ], "repeated": 0, "id": 1962 }, { "timestamp": "2026-05-29 01:05:18,977", "thread_id": "4696", "caller": "0x7ff79bc7a2d6", "parentcaller": "0x7ff79bc5233a", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000177c" }, { "name": "ValueName", "value": "HRZR_PGYFRFFVBA" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Buffer", "value": "\\x00\\x00\\x00\\x00\\x83\\x00\\x00\\x00\\xfe\\x00\\x00\\x00M\\xdeL\\x00\\x19\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x10i\\x02\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00.\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00E\\x00x\\x00p\\x00l\\x00o\\x00r\\x00e\\x00r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "BufferLength", "value": "1612" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\HRZR_PGYFRFFVBA" } ], "repeated": 0, "id": 1963 }, { "timestamp": "2026-05-29 01:05:18,977", "thread_id": "4696", "caller": "0x7ff79bc7a2d6", "parentcaller": "0x7ff79bc5233a", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000016d8" } ], "repeated": 0, "id": 1964 }, { "timestamp": "2026-05-29 01:05:18,977", "thread_id": "4696", "caller": "0x7ff79bc76bd8", "parentcaller": "0x7ff79bc8a0c8", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00010110" }, { "name": "Message", "value": "0x0000c028" } ], "repeated": 0, "id": 1965 }, { "timestamp": "2026-05-29 01:05:18,977", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 1966 }, { "timestamp": "2026-05-29 01:05:18,977", "thread_id": "4696", "caller": "0x7ff79bc76bd8", "parentcaller": "0x7ff79bc8a0c8", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00010110" }, { "name": "Message", "value": "0x0000c028" } ], "repeated": 0, "id": 1967 }, { "timestamp": "2026-05-29 01:05:18,977", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 1968 }, { "timestamp": "2026-05-29 01:05:18,977", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xd0\\xf1\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xa7=\n\\x00\\x00\\x00\\x00\\x12\\x00\\x00\\x00\\x00\\x00\\x00\\x00(\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\xaa\\x01\\x03I\\xff\\x7f\\x00\\x00\\xb0\\xef\\x08I\\xff\\x7f\\x00\\x00" } ], "repeated": 0, "id": 1969 }, { "timestamp": "2026-05-29 01:05:18,977", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000256c" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 1970 }, { "timestamp": "2026-05-29 01:05:18,977", "thread_id": "5220", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff557c3a98", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xfd\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00d\\x14\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5220" } ], "repeated": 0, "id": 1971 }, { "timestamp": "2026-05-29 01:05:18,977", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 1972 }, { "timestamp": "2026-05-29 01:05:18,977", "thread_id": "5220", "caller": "0x7ff79bca842b", "parentcaller": "0x7ff79bc90c00", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000100ec" }, { "name": "Message", "value": "0x00000454" } ], "repeated": 0, "id": 1973 }, { "timestamp": "2026-05-29 01:05:18,977", "thread_id": "5220", "caller": "0x7fff577d6785", "parentcaller": "0x7fff557c403a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002574" } ], "repeated": 0, "id": 1974 }, { "timestamp": "2026-05-29 01:05:18,977", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 1975 }, { "timestamp": "2026-05-29 01:05:18,977", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\default\\TextInput\\ConfigureJapaneseIMEVersion" }, { "name": "Handle", "value": "0x0000256c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\TextInput\\ConfigureJapaneseIMEVersion" } ], "repeated": 0, "id": 1976 }, { "timestamp": "2026-05-29 01:05:18,977", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 1977 }, { "timestamp": "2026-05-29 01:05:18,977", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "ValueName", "value": "Behavior" }, { "name": "Data", "value": "73760" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\TextInput\\ConfigureJapaneseIMEVersion\\Behavior" } ], "repeated": 0, "id": 1978 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "ValueName", "value": "MergeAlgorithm" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\TextInput\\ConfigureJapaneseIMEVersion\\MergeAlgorithm" } ], "repeated": 0, "id": 1979 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "ValueName", "value": "RegKeyPathRedirectMapped" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\TextInput\\ConfigureJapaneseIMEVersion\\RegKeyPathRedirectMapped" } ], "repeated": 0, "id": 1980 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "ValueName", "value": "RegKeyPathRedirect" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\TextInput\\ConfigureJapaneseIMEVersion\\RegKeyPathRedirect" } ], "repeated": 0, "id": 1981 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "ValueName", "value": "grouppolicyname" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\TextInput\\ConfigureJapaneseIMEVersion\\grouppolicyname" } ], "repeated": 0, "id": 1982 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4620", "caller": "0x7fff4272f20e", "parentcaller": "0x7fff427311c6", "category": "registry", "api": "RegDeleteKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000b04" }, { "name": "SubKey", "value": "W32:0000000000010432" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1\\ApplicationViewManagement\\W32:0000000000010432" } ], "repeated": 0, "id": 1983 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "ValueName", "value": "ADMXMetadataBoth" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\TextInput\\ConfigureJapaneseIMEVersion\\ADMXMetadataBoth" } ], "repeated": 0, "id": 1984 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "5000", "caller": "0x7fff5489080f", "parentcaller": "0x7fff5486709a", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00010128" }, { "name": "Message", "value": "0x00000060" } ], "repeated": 0, "id": 1985 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "ValueName", "value": "30Value" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\TextInput\\ConfigureJapaneseIMEVersion\\30Value" } ], "repeated": 0, "id": 1986 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 1987 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "5000", "caller": "0x7fff4257b9c6", "parentcaller": "0x7fff4257e0b8", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1988 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "5000", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 1989 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 1990 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "ValueName", "value": "Value" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\TextInput\\ConfigureJapaneseIMEVersion\\Value" } ], "repeated": 0, "id": 1991 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 1992 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 1993 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\TextInput" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\TextInput" } ], "repeated": 0, "id": 1994 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "6160", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x18\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6160" } ], "repeated": 0, "id": 1995 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\TextInput" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\TextInput" } ], "repeated": 0, "id": 1996 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4500", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xfe\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x94\\x11\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4500" } ], "repeated": 0, "id": 1997 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 1998 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1999 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Input\\TSF\\Tsf3Override\\{03b5835f-f03c-411b-9ce2-aa23e1171e36}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Input\\TSF\\Tsf3Override\\{03b5835f-f03c-411b-9ce2-aa23e1171e36}" } ], "repeated": 0, "id": 2000 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "misc", "api": "GetKeyboardLayout", "status": true, "return": "0x04090409", "arguments": [ { "name": "KeyboardLayout", "value": "0x00000409" }, { "name": "LanguageName", "value": "English (United States)" } ], "repeated": 0, "id": 2001 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "5000", "caller": "0x7fff425b28af", "parentcaller": "0x7fff425b26d7", "category": "system", "api": "IsDebuggerPresent", "status": false, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2002 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2003 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002554" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2004 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002554" } ], "repeated": 0, "id": 2005 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xd0\\xf1\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xf0\\xa7=\n\\x00\\x00\\x00\\x00\\x00\\x1f\\x00\\x00\\xff\\xff\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xaa\\x01\\x03I\\xff\\x7f\\x00\\x00\\xb0\\xef\\x08I\\xff\\x7f\\x00\\x00" } ], "repeated": 0, "id": 2006 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000256c" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 2007 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x0000256c" }, { "name": "SubKey", "value": "Software\\Policies\\Microsoft\\InputMethod\\Settings\\JPN" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\InputMethod\\Settings\\JPN" } ], "repeated": 0, "id": 2008 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 2009 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4620", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 2010 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\default\\TextInput\\ConfigureJapaneseIMEVersion" }, { "name": "Handle", "value": "0x0000256c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\TextInput\\ConfigureJapaneseIMEVersion" } ], "repeated": 0, "id": 2011 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "ValueName", "value": "PolicyType" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\TextInput\\ConfigureJapaneseIMEVersion\\PolicyType" } ], "repeated": 0, "id": 2012 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "ValueName", "value": "Behavior" }, { "name": "Data", "value": "73760" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\TextInput\\ConfigureJapaneseIMEVersion\\Behavior" } ], "repeated": 0, "id": 2013 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "ValueName", "value": "MergeAlgorithm" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\TextInput\\ConfigureJapaneseIMEVersion\\MergeAlgorithm" } ], "repeated": 0, "id": 2014 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "ValueName", "value": "RegKeyPathRedirectMapped" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\TextInput\\ConfigureJapaneseIMEVersion\\RegKeyPathRedirectMapped" } ], "repeated": 0, "id": 2015 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "ValueName", "value": "RegKeyPathRedirect" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\TextInput\\ConfigureJapaneseIMEVersion\\RegKeyPathRedirect" } ], "repeated": 0, "id": 2016 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4620", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 2017 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "ValueName", "value": "grouppolicyname" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\TextInput\\ConfigureJapaneseIMEVersion\\grouppolicyname" } ], "repeated": 0, "id": 2018 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "ValueName", "value": "ADMXMetadataUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\TextInput\\ConfigureJapaneseIMEVersion\\ADMXMetadataUser" } ], "repeated": 0, "id": 2019 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "ValueName", "value": "ADMXMetadataDevice" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\TextInput\\ConfigureJapaneseIMEVersion\\ADMXMetadataDevice" } ], "repeated": 0, "id": 2020 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4620", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 2021 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "ValueName", "value": "30Value" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\TextInput\\ConfigureJapaneseIMEVersion\\30Value" } ], "repeated": 0, "id": 2022 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "ValueName", "value": "Value" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\TextInput\\ConfigureJapaneseIMEVersion\\Value" } ], "repeated": 0, "id": 2023 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 2024 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\TextInput" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\TextInput" } ], "repeated": 1, "id": 2025 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 2026 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "5108", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff42570a3f", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000252c" }, { "name": "DesiredAccess", "value": "0x00000410", "pretty_value": "PROCESS_VM_READ|PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "5128" }, { "name": "ProcessName", "value": "Error obtaining target process name" } ], "repeated": 0, "id": 2027 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "5108", "caller": "0x7fff5781026b", "parentcaller": "0x7fff42570dc8", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000252c" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002558" } ], "repeated": 0, "id": 2028 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "5108", "caller": "0x7fff42570e03", "parentcaller": "0x7fff42570a6b", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2029 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 2030 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "5108", "caller": "0x7fff42570e77", "parentcaller": "0x7fff42570a6b", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xe0k\\xc6\\x0b\\x00\\x00\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00\\x08l\\xc6\\x0b\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00(l\\xc6\\x0b\\x00\\x00\\x00\\x00T\\x00S\\x00A\\x00:\\x00/\\x00/\\x00P\\x00r\\x00o\\x00c\\x00U\\x00n\\x00i\\x00q\\x00u\\x00e\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1e1\\x07\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2031 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "5108", "caller": "0x7fff577d6785", "parentcaller": "0x7fff42570eff", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002558" } ], "repeated": 0, "id": 2032 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2033 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "5108", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff44bd4f06", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002558" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "5128" }, { "name": "ProcessName", "value": "Error obtaining target process name" } ], "repeated": 0, "id": 2034 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "5108", "caller": "0x7fff5781026b", "parentcaller": "0x7fff44c0f8f9", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002558" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002550" } ], "repeated": 0, "id": 2035 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "5108", "caller": "0x7fff44c0f5ac", "parentcaller": "0x7fff44c0f931", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2036 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Input\\TSF\\Tsf3Override\\{03b5835f-f03c-411b-9ce2-aa23e1171e36}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Input\\TSF\\Tsf3Override\\{03b5835f-f03c-411b-9ce2-aa23e1171e36}" } ], "repeated": 0, "id": 2037 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "5108", "caller": "0x7fff577d6785", "parentcaller": "0x7fff44bd525c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002558" } ], "repeated": 0, "id": 2038 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "5108", "caller": "0x7fff577d6785", "parentcaller": "0x7fff42570a7d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000252c" } ], "repeated": 0, "id": 2039 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "5108", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff426da18b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000ea0" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 2040 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xd0\\xf1\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xa7=\n\\x00\\x00\\x00\\x00\\xf02\\xdc\\x08\\x00\\x00\\x00\\x00 \\xf3\\\\x03\\x00\\x00\\x00\\x00\\xaa\\x01\\x03I\\xff\\x7f\\x00\\x00\\xb0\\xef\\x08I\\xff\\x7f\\x00\\x00" } ], "repeated": 0, "id": 2041 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000256c" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 2042 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x0000256c" }, { "name": "SubKey", "value": "Software\\Policies\\Microsoft\\InputMethod\\Settings\\JPN" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\InputMethod\\Settings\\JPN" } ], "repeated": 0, "id": 2043 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 2044 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4620", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 2045 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\default\\TextInput\\ConfigureJapaneseIMEVersion" }, { "name": "Handle", "value": "0x0000256c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\TextInput\\ConfigureJapaneseIMEVersion" } ], "repeated": 0, "id": 2046 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4620", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 2047 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "ValueName", "value": "PolicyType" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\TextInput\\ConfigureJapaneseIMEVersion\\PolicyType" } ], "repeated": 0, "id": 2048 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4620", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 1, "id": 2049 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "ValueName", "value": "Behavior" }, { "name": "Data", "value": "73760" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\TextInput\\ConfigureJapaneseIMEVersion\\Behavior" } ], "repeated": 0, "id": 2050 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "ValueName", "value": "MergeAlgorithm" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\TextInput\\ConfigureJapaneseIMEVersion\\MergeAlgorithm" } ], "repeated": 0, "id": 2051 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 2052 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000256c" }, { "name": "ValueName", "value": "RegKeyPathRedirectMapped" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\TextInput\\ConfigureJapaneseIMEVersion\\RegKeyPathRedirectMapped" } ], "repeated": 0, "id": 2053 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "ValueName", "value": "RegKeyPathRedirect" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\TextInput\\ConfigureJapaneseIMEVersion\\RegKeyPathRedirect" } ], "repeated": 0, "id": 2054 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "ValueName", "value": "grouppolicyname" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\TextInput\\ConfigureJapaneseIMEVersion\\grouppolicyname" } ], "repeated": 0, "id": 2055 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "ValueName", "value": "ADMXMetadataUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\TextInput\\ConfigureJapaneseIMEVersion\\ADMXMetadataUser" } ], "repeated": 0, "id": 2056 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "ValueName", "value": "ADMXMetadataDevice" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\TextInput\\ConfigureJapaneseIMEVersion\\ADMXMetadataDevice" } ], "repeated": 0, "id": 2057 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "ValueName", "value": "ADMXMetadataBoth" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\TextInput\\ConfigureJapaneseIMEVersion\\ADMXMetadataBoth" } ], "repeated": 0, "id": 2058 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "ValueName", "value": "30Value" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\TextInput\\ConfigureJapaneseIMEVersion\\30Value" } ], "repeated": 0, "id": 2059 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "ValueName", "value": "Value" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\TextInput\\ConfigureJapaneseIMEVersion\\Value" } ], "repeated": 0, "id": 2060 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 2061 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\TextInput" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\TextInput" } ], "repeated": 1, "id": 2062 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2063 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2064 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Input\\TSF\\Tsf3Override\\{03b5835f-f03c-411b-9ce2-aa23e1171e36}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Input\\TSF\\Tsf3Override\\{03b5835f-f03c-411b-9ce2-aa23e1171e36}" } ], "repeated": 0, "id": 2065 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc91360", "parentcaller": "0x7ff79bc5d2c3", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2066 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc570bf", "parentcaller": "0x7ff79bc5736c", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\ContentDeliveryManager\\SuggestedAppEvents" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\ContentDeliveryManager\\SuggestedAppEvents" } ], "repeated": 0, "id": 2067 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc9f5b4", "parentcaller": "0x7ff79bc57219", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2068 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc9f5fd", "parentcaller": "0x7ff79bc57219", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2069 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc9f5fd", "parentcaller": "0x7ff79bc57219", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2070 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc9f5fd", "parentcaller": "0x7ff79bc57219", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000252c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Mobility" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Mobility" } ], "repeated": 0, "id": 2071 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc9f5fd", "parentcaller": "0x7ff79bc57219", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000252c" }, { "name": "ValueName", "value": "LastResumeOnPCTime" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Mobility\\LastResumeOnPCTime" } ], "repeated": 0, "id": 2072 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc9f5fd", "parentcaller": "0x7ff79bc57219", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000252c" } ], "repeated": 0, "id": 2073 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc9f646", "parentcaller": "0x7ff79bc57219", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2074 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc9f646", "parentcaller": "0x7ff79bc57219", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2075 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc9f646", "parentcaller": "0x7ff79bc57219", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000252c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Mobility" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Mobility" } ], "repeated": 0, "id": 2076 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc9f646", "parentcaller": "0x7ff79bc57219", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000252c" }, { "name": "ValueName", "value": "LastResumeOnPCInteractionTime" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Mobility\\LastResumeOnPCInteractionTime" } ], "repeated": 0, "id": 2077 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc9f646", "parentcaller": "0x7ff79bc57219", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000252c" } ], "repeated": 0, "id": 2078 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc570bf", "parentcaller": "0x7ff79bc5736c", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\ContentDeliveryManager\\SuggestedAppEvents" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\ContentDeliveryManager\\SuggestedAppEvents" } ], "repeated": 0, "id": 2079 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc77de2", "parentcaller": "0x7ff79bc773fa", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "ITaskList_Deleted" }, { "name": "Atom", "value": "0x0000c086" } ], "repeated": 0, "id": 2080 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc9cc23", "parentcaller": "0x7ff79bc70f02", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2081 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc521d5", "parentcaller": "0x7ff79bc4fce7", "category": "system", "api": "GetLastInputInfo", "status": true, "return": "0x00000001", "arguments": [], "repeated": 0, "id": 2082 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc521fe", "parentcaller": "0x7ff79bc4fce7", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002558" } ], "repeated": 0, "id": 2083 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc521fe", "parentcaller": "0x7ff79bc4fce7", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000252c" } ], "repeated": 0, "id": 2084 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc521fe", "parentcaller": "0x7ff79bc4fce7", "category": "device", "api": "NtPowerInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "InformationLevel", "value": "16" }, { "name": "InputBuffer", "value": "" }, { "name": "OutputBuffer", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2085 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc521fe", "parentcaller": "0x7ff79bc4fce7", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000252c" } ], "repeated": 0, "id": 2086 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc77e17", "parentcaller": "0x7ff79bc773fa", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00010094" }, { "name": "Message", "value": "0x000004f3" } ], "repeated": 0, "id": 2087 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc521d5", "parentcaller": "0x7ff79bc51a67", "category": "system", "api": "GetLastInputInfo", "status": true, "return": "0x00000001", "arguments": [], "repeated": 0, "id": 2088 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc521fe", "parentcaller": "0x7ff79bc51a67", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002558" } ], "repeated": 0, "id": 2089 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc521fe", "parentcaller": "0x7ff79bc51a67", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000252c" } ], "repeated": 0, "id": 2090 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc521fe", "parentcaller": "0x7ff79bc51a67", "category": "device", "api": "NtPowerInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "InformationLevel", "value": "16" }, { "name": "InputBuffer", "value": "" }, { "name": "OutputBuffer", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2091 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc521fe", "parentcaller": "0x7ff79bc51a67", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000252c" } ], "repeated": 0, "id": 2092 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc76bd8", "parentcaller": "0x7ff79bc8a0c8", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00010110" }, { "name": "Message", "value": "0x0000c028" } ], "repeated": 1, "id": 2093 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "5000", "caller": "0x7fff57fc2eeb", "parentcaller": "0x7fff581ba00f", "category": "synchronization", "api": "NtFindAtom", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "AtomName", "value": "Windows.Internal.Shell.Holographic.Win32PortedView" }, { "name": "Atom", "value": "0x00000000" } ], "repeated": 0, "id": 2094 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc76bd8", "parentcaller": "0x7ff79bc8a0c8", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00010110" }, { "name": "Message", "value": "0x0000c028" } ], "repeated": 0, "id": 2095 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "5000", "caller": "0x7fff57fc2eeb", "parentcaller": "0x7fff581ba00f", "category": "synchronization", "api": "NtFindAtom", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "AtomName", "value": "Windows.Internal.Shell.Holographic.Win32PortedView" }, { "name": "Atom", "value": "0x00000000" } ], "repeated": 0, "id": 2096 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "3424", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff557c3a98", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xfe\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00`\r\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "3424" } ], "repeated": 0, "id": 2097 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "5000", "caller": "0x7fff5781026b", "parentcaller": "0x7fff45584920", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000256c" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000255c" } ], "repeated": 0, "id": 2098 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "5000", "caller": "0x7fff45584c45", "parentcaller": "0x7fff45584941", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2099 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "5000", "caller": "0x7fff45584ce5", "parentcaller": "0x7fff45584941", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00 \\x86\\xc6\\x0b\\x00\\x00\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00H\\x86\\xc6\\x0b\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x86\\xc6\\x0b\\x00\\x00\\x00\\x00T\\x00S\\x00A\\x00:\\x00/\\x00/\\x00P\\x00r\\x00o\\x00c\\x00U\\x00n\\x00i\\x00q\\x00u\\x00e\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1e1\\x07\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2100 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff45584956", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000255c" } ], "repeated": 0, "id": 2101 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff455a1181", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 2102 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "5000", "caller": "0x7fff425a9007", "parentcaller": "0x7fff425a8c10", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 2103 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "5000", "caller": "0x7fff57fc2eeb", "parentcaller": "0x7fff581ba00f", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "MultimonitorActivationException" }, { "name": "Atom", "value": "0x0000c049" } ], "repeated": 0, "id": 2104 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 2105 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbd423", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000256c" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "5128" }, { "name": "ProcessName", "value": "Error obtaining target process name" } ], "repeated": 0, "id": 2106 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "5000", "caller": "0x7fff41dbd59f", "parentcaller": "0x7fff41dfc80c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000255c" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "\\Device\\Bam" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 2107 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc686b4", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 2108 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "5000", "caller": "0x7fff41dbd603", "parentcaller": "0x7fff41dfc80c", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000255c" }, { "name": "HandleName", "value": "\\Device\\Bam" }, { "name": "IoControlCode", "value": "0x00220004" }, { "name": "InputBuffer", "value": "\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00l%\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 2109 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xe2\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x005\\x18\\xff\\x7f\\x00\\x00(\\xe3\\\\x03\\x00\\x00\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2110 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002554" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 2111 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc8a418", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002554" } ], "repeated": 0, "id": 2112 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc686b4", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 2113 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xe2\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x005\\x18\\xff\\x7f\\x00\\x00(\\xe3\\\\x03\\x00\\x00\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2114 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002554" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 2115 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc8a418", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002554" } ], "repeated": 0, "id": 2116 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "3424", "caller": "0x7ff79bc79d10", "parentcaller": "0x7ff79bc79c74", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2117 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "CLSID\\{56AD4C5D-B908-4F85-8FF1-7940C29B3BCF}\\Instance" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\CLSID\\{56AD4C5D-B908-4F85-8FF1-7940C29B3BCF}\\Instance" } ], "repeated": 0, "id": 2118 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 2119 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff58be0000", "arguments": [ { "name": "lpLibFileName", "value": "shell32.dll" }, { "name": "dwFlags", "value": "0x00004000" } ], "repeated": 0, "id": 2120 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "3424", "caller": "0x7fff577dac31", "parentcaller": "0x7fff558258ff", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "SHELL32.dll" }, { "name": "ModuleHandle", "value": "0x7fff58be0000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff58c378f0" } ], "repeated": 0, "id": 2121 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc7a06e", "parentcaller": "0x7ff79bc66f8c", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2122 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "CLSID\\{56AD4C5D-B908-4F85-8FF1-7940C29B3BCF}\\Instance" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\CLSID\\{56AD4C5D-B908-4F85-8FF1-7940C29B3BCF}\\Instance" } ], "repeated": 0, "id": 2123 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "{9F4C2855-9F79-4B39-A8D0-E1D42DE1D5F3} 5" }, { "name": "Atom", "value": "0x0000c067" } ], "repeated": 0, "id": 2124 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 2125 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff58be0000", "arguments": [ { "name": "lpLibFileName", "value": "shell32.dll" }, { "name": "dwFlags", "value": "0x00004000" } ], "repeated": 0, "id": 2126 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbddbb", "category": "process", "api": "NtOpenProcess", "status": false, "return": "0xffffffffc0000022", "pretty_return": "ACCESS_DENIED", "arguments": [ { "name": "ProcessHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "1180" } ], "repeated": 0, "id": 2127 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002560" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "5128" }, { "name": "ProcessName", "value": "Error obtaining target process name" } ], "repeated": 0, "id": 2128 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbddbb", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002574" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "5624" }, { "name": "ProcessName", "value": "Error obtaining target process name" } ], "repeated": 0, "id": 2129 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbddbb", "category": "process", "api": "NtOpenProcess", "status": false, "return": "0xffffffffc0000022", "pretty_return": "ACCESS_DENIED", "arguments": [ { "name": "ProcessHandle", "value": "0x00002574" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "1048" } ], "repeated": 0, "id": 2130 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "SHELL32.dll" }, { "name": "ModuleHandle", "value": "0x7fff58be0000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff58c378f0" } ], "repeated": 0, "id": 2131 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbddbb", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002568" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 2132 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002560" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002440" } ], "repeated": 0, "id": 2133 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbddbb", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002564" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "5128" }, { "name": "ProcessName", "value": "Error obtaining target process name" } ], "repeated": 0, "id": 2134 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbddbb", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002570" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "6400" }, { "name": "ProcessName", "value": "Error obtaining target process name" } ], "repeated": 0, "id": 2135 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2136 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "synchronization", "api": "NtFindAtom", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "AtomName", "value": "{9F4C2855-9F79-4B39-A8D0-E1D42DE1D5F3} 3" }, { "name": "Atom", "value": "0x00000000" } ], "repeated": 0, "id": 2137 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00y\\xc6\\x0b\\x00\\x00\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00(y\\xc6\\x0b\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00Hy\\xc6\\x0b\\x00\\x00\\x00\\x00T\\x00S\\x00A\\x00:\\x00/\\x00/\\x00P\\x00r\\x00o\\x00c\\x00U\\x00n\\x00i\\x00q\\x00u\\x00e\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1e1\\x07\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2138 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 2139 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002440" } ], "repeated": 0, "id": 2140 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc68e6a", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 2141 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002560" } ], "repeated": 0, "id": 2142 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41e113f9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002560" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "11260" }, { "name": "ProcessName", "value": "Error obtaining target process name" } ], "repeated": 0, "id": 2143 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc690f2", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 2144 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "3424", "caller": "0x7ff79bc79e89", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "CreateTimerQueueTimer", "status": true, "return": "0x00000001", "arguments": [ { "name": "phNewTimer", "value": "0x0c8013f0" }, { "name": "TimerQueue", "value": "0x00000000" }, { "name": "Callback", "value": "0x9bc79ab0" }, { "name": "Parameter", "value": "0x07622ee0" }, { "name": "DueTime", "value": "3000" }, { "name": "Period", "value": "0" }, { "name": "Flags", "value": "8" } ], "repeated": 0, "id": 2145 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 3, "id": 2146 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc686b4", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 2147 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 2, "id": 2148 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002558" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 2149 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 1, "id": 2150 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4696", "caller": "0x7ff79bc8a418", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002558" } ], "repeated": 0, "id": 2151 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 11, "id": 2152 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "5000", "caller": "0x7fff41dbe842", "parentcaller": "0x7fff41dbd62c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002440" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "\\Device\\Bam" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 2153 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4500", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xfe\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x94\\x11\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4500" } ], "repeated": 0, "id": 2154 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4620", "caller": "0x7fff42568962", "parentcaller": "0x7fff42567e38", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001011a" }, { "name": "Message", "value": "0x00000401" } ], "repeated": 0, "id": 2155 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "5000", "caller": "0x7fff41dbe8a3", "parentcaller": "0x7fff41dbd62c", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002440" }, { "name": "HandleName", "value": "\\Device\\Bam" }, { "name": "IoControlCode", "value": "0x00220004" }, { "name": "InputBuffer", "value": "\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00T%\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9c\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00t%\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00h%\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00d%\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00p%\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00`%\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 2156 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 2157 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff41dbe9a9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002574" } ], "repeated": 0, "id": 2158 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff41dbe9a9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002568" } ], "repeated": 0, "id": 2159 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff41dbe9a9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002564" } ], "repeated": 0, "id": 2160 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff41dbe9a9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002570" } ], "repeated": 0, "id": 2161 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff41dbe9a9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002560" } ], "repeated": 0, "id": 2162 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4500", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xfe\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x94\\x11\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4500" } ], "repeated": 0, "id": 2163 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "5000", "caller": "0x7fff41dbe9d8", "parentcaller": "0x7fff41dbd62c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002440" } ], "repeated": 0, "id": 2164 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "5000", "caller": "0x7fff41dbd63b", "parentcaller": "0x7fff41dfc80c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000255c" } ], "repeated": 0, "id": 2165 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff41dbd64f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 2166 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4500", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xfe\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x94\\x11\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4500" } ], "repeated": 1, "id": 2167 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 2168 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4500", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xfe\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x94\\x11\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4500" } ], "repeated": 0, "id": 2169 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "5000", "caller": "0x7fff425b28af", "parentcaller": "0x7fff425b26d7", "category": "system", "api": "IsDebuggerPresent", "status": false, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2170 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4500", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xfe\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x94\\x11\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4500" } ], "repeated": 0, "id": 2171 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "5000", "caller": "0x7fff425b28af", "parentcaller": "0x7fff425b26d7", "category": "system", "api": "IsDebuggerPresent", "status": false, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2172 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 2173 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4500", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xfe\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x94\\x11\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4500" } ], "repeated": 0, "id": 2174 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 2175 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4500", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xfe\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x94\\x11\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4500" } ], "repeated": 0, "id": 2176 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "5000", "caller": "0x7fff4257b9c6", "parentcaller": "0x7fff4257e0b8", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2177 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4500", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xfe\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x94\\x11\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4500" } ], "repeated": 0, "id": 2178 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 2179 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4500", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xfe\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x94\\x11\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4500" } ], "repeated": 0, "id": 2180 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 2181 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4500", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xfe\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x94\\x11\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4500" } ], "repeated": 0, "id": 2182 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 2183 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4500", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xfe\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x94\\x11\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4500" } ], "repeated": 0, "id": 2184 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 1, "id": 2185 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4500", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xfe\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x94\\x11\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4500" } ], "repeated": 3, "id": 2186 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4344", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xfc\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\\x10\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4344" } ], "repeated": 0, "id": 2187 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4500", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xfe\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x94\\x11\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4500" } ], "repeated": 29, "id": 2188 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "6164", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 6, "id": 2189 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "4344", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xfc\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\\x10\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4344" } ], "repeated": 0, "id": 2190 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "6164", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 3, "id": 2191 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "6164", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x18\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6164" } ], "repeated": 0, "id": 2192 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "6160", "caller": "0x7fff584ccd6e", "parentcaller": "0x7fff584cc76f", "category": "system", "api": "IsDebuggerPresent", "status": false, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2193 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "6160", "caller": "0x7fff577ffa4e", "parentcaller": "0x7fff577fe97c", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "102" } ], "repeated": 0, "id": 2194 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "6160", "caller": "0x7fff584ccd6e", "parentcaller": "0x7fff584cdb75", "category": "system", "api": "IsDebuggerPresent", "status": false, "return": "0x00000000", "arguments": [], "repeated": 4, "id": 2195 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "6160", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x18\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6160" } ], "repeated": 1, "id": 2196 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "6160", "caller": "0x7fff577d6785", "parentcaller": "0x7fff40c784bd", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0xfffffffc" } ], "repeated": 0, "id": 2197 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "6160", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff40c61423", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000252c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "5128" }, { "name": "ProcessName", "value": "Error obtaining target process name" } ], "repeated": 0, "id": 2198 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "6160", "caller": "0x7fff577d6785", "parentcaller": "0x7fff40c6148a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000252c" } ], "repeated": 0, "id": 2199 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "6160", "caller": "0x7fff577d07f5", "parentcaller": "0x7fff577cc03b", "category": "filesystem", "api": "NtQueryAttributesFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\com.squirrel.Discord.Discord" } ], "repeated": 0, "id": 2200 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "6252", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 2201 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "6160", "caller": "0x7fff40c74428", "parentcaller": "0x7fff40c73a03", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "F0AE1542-F497-484B-A175-A20DB09144BA" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "8DC24A1A-6314-4769-9D68-179786F4CED6" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2202 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "6160", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00020072" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 1, "id": 2203 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "6252", "caller": "0x7fff557c9e99", "parentcaller": "0x7fff557c779f", "category": "filesystem", "api": "CreateDirectoryW", "status": false, "return": "0x00000000", "arguments": [ { "name": "DirectoryName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations" } ], "repeated": 0, "id": 2204 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "6252", "caller": "0x7fff577d07f5", "parentcaller": "0x7fff577cc03b", "category": "filesystem", "api": "NtQueryAttributesFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\a622d0c5f59316dd.automaticDestinations-ms" } ], "repeated": 0, "id": 2205 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "6160", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00020072" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 2, "id": 2206 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "6160", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2207 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "6160", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2208 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "6160", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002550" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 2209 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "6160", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 2210 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "6160", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 0, "id": 2211 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "6160", "caller": "0x7fff5587d014", "parentcaller": "0x7fff558252c1", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "CLSID\\{4234D49B-0245-4DF3-B780-3893943456E1}\\Instance" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\CLSID\\{4234D49B-0245-4DF3-B780-3893943456E1}\\Instance" } ], "repeated": 0, "id": 2212 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "6160", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 2213 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "6160", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff58be0000", "arguments": [ { "name": "lpLibFileName", "value": "shell32.dll" }, { "name": "dwFlags", "value": "0x00004000" } ], "repeated": 0, "id": 2214 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "6160", "caller": "0x7fff577dac31", "parentcaller": "0x7fff558258ff", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "SHELL32.dll" }, { "name": "ModuleHandle", "value": "0x7fff58be0000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff58c378f0" } ], "repeated": 0, "id": 2215 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "6160", "caller": "0x7fff58c37b42", "parentcaller": "0x7fff5582592e", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "CLSID\\{4234D49B-0245-4DF3-B780-3893943456E1}\\Instance" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\CLSID\\{4234D49B-0245-4DF3-B780-3893943456E1}\\Instance" } ], "repeated": 0, "id": 2216 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "6160", "caller": "0x7fff558635fc", "parentcaller": "0x7fff55825399", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000252c" } ], "repeated": 0, "id": 2217 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "6160", "caller": "0x7fff55863669", "parentcaller": "0x7fff55825399", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "18" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 2218 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "6160", "caller": "0x7fff558636a1", "parentcaller": "0x7fff55825399", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "20" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 2219 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "6160", "caller": "0x7fff558636e3", "parentcaller": "0x7fff55825399", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000252c" } ], "repeated": 0, "id": 2220 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "6160", "caller": "0x7fff558638e8", "parentcaller": "0x7fff55825399", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Classes\\CLSID\\{4234D49B-0245-4DF3-B780-3893943456E1}\\InProcServer32" }, { "name": "Handle", "value": "0x0000252c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{4234D49B-0245-4DF3-B780-3893943456E1}\\InProcServer32" } ], "repeated": 0, "id": 2221 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "6160", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000252c" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "C:\\Windows\\System32\\appresolver.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{4234d49b-0245-4df3-b780-3893943456e1}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 2222 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "6160", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000252c" }, { "name": "ValueName", "value": "LoadWithoutCOM" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{4234d49b-0245-4df3-b780-3893943456e1}\\InProcServer32\\LoadWithoutCOM" } ], "repeated": 0, "id": 2223 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "6160", "caller": "0x7fff5586397c", "parentcaller": "0x7fff55825399", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000252c" } ], "repeated": 0, "id": 2224 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "6160", "caller": "0x7fff55825882", "parentcaller": "0x7fff55828f55", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "4234D49B-0245-4DF3-B780-3893943456E1" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "000214E6-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2225 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "6160", "caller": "0x7fff5808b3e7", "parentcaller": "0x7fff558258a5", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ShellCompatibility\\Objects\\{4234D49B-0245-4DF3-B780-3893943456E1}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ShellCompatibility\\Objects\\{4234D49B-0245-4DF3-B780-3893943456E1}" } ], "repeated": 0, "id": 2226 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "6160", "caller": "0x7fff44bb58e1", "parentcaller": "0x7fff44bb5ef1", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "02C5CCF3-805F-4654-A7B7-340A74335365" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2227 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "6160", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5287472a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0xfffffffc" } ], "repeated": 0, "id": 2228 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "6160", "caller": "0x7fff5781026b", "parentcaller": "0x7fff5585204d", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000256c" } ], "repeated": 0, "id": 2229 }, { "timestamp": "2026-05-29 01:05:18,993", "thread_id": "6160", "caller": "0x7fff558520a2", "parentcaller": "0x7fff55851f69", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "18" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 2230 }, { "timestamp": "2026-05-29 01:05:19,008", "thread_id": "6160", "caller": "0x7fff55852301", "parentcaller": "0x7fff55851f69", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "20" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 2231 }, { "timestamp": "2026-05-29 01:05:19,008", "thread_id": "6160", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5585211d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 2232 }, { "timestamp": "2026-05-29 01:05:19,008", "thread_id": "6160", "caller": "0x7fff58081596", "parentcaller": "0x7fff58ac668d", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": ".exe" }, { "name": "Handle", "value": "0x0000255a" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\.exe" } ], "repeated": 0, "id": 2233 }, { "timestamp": "2026-05-29 01:05:19,008", "thread_id": "6160", "caller": "0x7fff5808ab55", "parentcaller": "0x7fff5585290f", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000255a" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "exefile" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.exe\\(Default)" } ], "repeated": 0, "id": 2234 }, { "timestamp": "2026-05-29 01:05:19,008", "thread_id": "6160", "caller": "0x7fff55853405", "parentcaller": "0x7fff55852415", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "exefile" }, { "name": "Handle", "value": "0x0000256e" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\exefile" } ], "repeated": 0, "id": 2235 }, { "timestamp": "2026-05-29 01:05:19,008", "thread_id": "6160", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000256e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\exefile" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 2236 }, { "timestamp": "2026-05-29 01:05:19,008", "thread_id": "6160", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000256e" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2237 }, { "timestamp": "2026-05-29 01:05:19,008", "thread_id": "6160", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xcei\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00n%\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xcfi\r\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2238 }, { "timestamp": "2026-05-29 01:05:19,008", "thread_id": "6160", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\exefile\\CurVer" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\exefile\\CurVer" } ], "repeated": 0, "id": 2239 }, { "timestamp": "2026-05-29 01:05:19,008", "thread_id": "6160", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000256e" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2240 }, { "timestamp": "2026-05-29 01:05:19,008", "thread_id": "6160", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000256e" }, { "name": "ObjectAttributesName", "value": "CurVer" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\CurVer" } ], "repeated": 0, "id": 2241 }, { "timestamp": "2026-05-29 01:05:19,008", "thread_id": "6160", "caller": "0x7fff58081596", "parentcaller": "0x7fff58ac668d", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000256e" }, { "name": "SubKey", "value": "" }, { "name": "Handle", "value": "0x0000252e" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\" } ], "repeated": 0, "id": 2242 }, { "timestamp": "2026-05-29 01:05:19,008", "thread_id": "6160", "caller": "0x7fff55852456", "parentcaller": "0x7fff5585298d", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256e" } ], "repeated": 0, "id": 2243 }, { "timestamp": "2026-05-29 01:05:19,008", "thread_id": "6160", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b51c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000252e" }, { "name": "ValueName", "value": "IsShortcut" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\IsShortcut" } ], "repeated": 0, "id": 2244 }, { "timestamp": "2026-05-29 01:05:19,008", "thread_id": "6160", "caller": "0x7fff58081596", "parentcaller": "0x7fff580a2f64", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000252e" }, { "name": "SubKey", "value": "shell\\runas" }, { "name": "Handle", "value": "0x0000256e" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\shell\\runas" } ], "repeated": 0, "id": 2245 }, { "timestamp": "2026-05-29 01:05:19,008", "thread_id": "6160", "caller": "0x7fff58095eff", "parentcaller": "0x7fff580969fb", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000255a" } ], "repeated": 0, "id": 2246 }, { "timestamp": "2026-05-29 01:05:19,008", "thread_id": "6160", "caller": "0x7fff58095eff", "parentcaller": "0x7fff580969fb", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000252e" } ], "repeated": 0, "id": 2247 }, { "timestamp": "2026-05-29 01:05:19,008", "thread_id": "6160", "caller": "0x7fff58095eff", "parentcaller": "0x7fff580969fb", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256e" } ], "repeated": 0, "id": 2248 }, { "timestamp": "2026-05-29 01:05:19,008", "thread_id": "6160", "caller": "0x7fff577f4f76", "parentcaller": "0x7fff56174710", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 2249 }, { "timestamp": "2026-05-29 01:05:19,008", "thread_id": "6160", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5617478c", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "NtQuerySystemInformation" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fed690" } ], "repeated": 0, "id": 2250 }, { "timestamp": "2026-05-29 01:05:19,008", "thread_id": "6160", "caller": "0x7fff561747c7", "parentcaller": "0x7fff44bead16", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "134" } ], "repeated": 0, "id": 2251 }, { "timestamp": "2026-05-29 01:05:19,008", "thread_id": "6160", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff5854f801", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x0000033a" }, { "name": "SubKey", "value": "com.squirrel.Discord.Discord" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\com.squirrel.Discord.Discord" } ], "repeated": 3, "id": 2252 }, { "timestamp": "2026-05-29 01:05:19,008", "thread_id": "6160", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x18\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6160" } ], "repeated": 0, "id": 2253 }, { "timestamp": "2026-05-29 01:05:19,024", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc68e6a", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 2, "id": 2254 }, { "timestamp": "2026-05-29 01:05:19,024", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xdf\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x005\\x18\\xff\\x7f\\x00\\x00X\\xe0\\\\x03\\x00\\x00\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2255 }, { "timestamp": "2026-05-29 01:05:19,024", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000255c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 2256 }, { "timestamp": "2026-05-29 01:05:19,024", "thread_id": "4696", "caller": "0x7ff79bc8a418", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000255c" } ], "repeated": 0, "id": 2257 }, { "timestamp": "2026-05-29 01:05:19,024", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc686b4", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 2258 }, { "timestamp": "2026-05-29 01:05:19,024", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xdf\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x005\\x18\\xff\\x7f\\x00\\x00X\\xe0\\\\x03\\x00\\x00\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2259 }, { "timestamp": "2026-05-29 01:05:19,024", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000255c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 2260 }, { "timestamp": "2026-05-29 01:05:19,024", "thread_id": "4696", "caller": "0x7ff79bc8a418", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000255c" } ], "repeated": 0, "id": 2261 }, { "timestamp": "2026-05-29 01:05:19,024", "thread_id": "4696", "caller": "0x7ff79bc7a06e", "parentcaller": "0x7ff79bc66f8c", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2262 }, { "timestamp": "2026-05-29 01:05:19,024", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "CLSID\\{56AD4C5D-B908-4F85-8FF1-7940C29B3BCF}\\Instance" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\CLSID\\{56AD4C5D-B908-4F85-8FF1-7940C29B3BCF}\\Instance" } ], "repeated": 0, "id": 2263 }, { "timestamp": "2026-05-29 01:05:19,024", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 2264 }, { "timestamp": "2026-05-29 01:05:19,024", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff58be0000", "arguments": [ { "name": "lpLibFileName", "value": "shell32.dll" }, { "name": "dwFlags", "value": "0x00004000" } ], "repeated": 0, "id": 2265 }, { "timestamp": "2026-05-29 01:05:19,024", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "SHELL32.dll" }, { "name": "ModuleHandle", "value": "0x7fff58be0000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff58c378f0" } ], "repeated": 0, "id": 2266 }, { "timestamp": "2026-05-29 01:05:19,024", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "synchronization", "api": "NtFindAtom", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "AtomName", "value": "{9F4C2855-9F79-4B39-A8D0-E1D42DE1D5F3} 3" }, { "name": "Atom", "value": "0x00000000" } ], "repeated": 0, "id": 2267 }, { "timestamp": "2026-05-29 01:05:19,024", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc68e6a", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 2, "id": 2268 }, { "timestamp": "2026-05-29 01:05:19,024", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xdf\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x005\\x18\\xff\\x7f\\x00\\x00X\\xe0\\\\x03\\x00\\x00\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2269 }, { "timestamp": "2026-05-29 01:05:19,024", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000255c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 2270 }, { "timestamp": "2026-05-29 01:05:19,024", "thread_id": "4696", "caller": "0x7ff79bc8a418", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000255c" } ], "repeated": 0, "id": 2271 }, { "timestamp": "2026-05-29 01:05:19,024", "thread_id": "4696", "caller": "0x7ff79bc76bd8", "parentcaller": "0x7ff79bc8a0c8", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00010110" }, { "name": "Message", "value": "0x0000c028" } ], "repeated": 0, "id": 2272 }, { "timestamp": "2026-05-29 01:05:19,040", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 2273 }, { "timestamp": "2026-05-29 01:05:19,040", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc68e6a", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 2274 }, { "timestamp": "2026-05-29 01:05:19,040", "thread_id": "4620", "caller": "0x7fff42568962", "parentcaller": "0x7fff42733c0d", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00010118" }, { "name": "Message", "value": "0x00000401" } ], "repeated": 0, "id": 2275 }, { "timestamp": "2026-05-29 01:05:19,040", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 2276 }, { "timestamp": "2026-05-29 01:05:19,040", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc690f2", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 1, "id": 2277 }, { "timestamp": "2026-05-29 01:05:19,040", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xdf\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x005\\x18\\xff\\x7f\\x00\\x00X\\xe0\\\\x03\\x00\\x00\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2278 }, { "timestamp": "2026-05-29 01:05:19,040", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 2279 }, { "timestamp": "2026-05-29 01:05:19,040", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000255c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 2280 }, { "timestamp": "2026-05-29 01:05:19,055", "thread_id": "4696", "caller": "0x7ff79bc8a418", "parentcaller": "0x7ff79bc686b4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000255c" } ], "repeated": 0, "id": 2281 }, { "timestamp": "2026-05-29 01:05:19,055", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc686b4", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 2282 }, { "timestamp": "2026-05-29 01:05:19,055", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xdf\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x005\\x18\\xff\\x7f\\x00\\x00X\\xe0\\\\x03\\x00\\x00\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2283 }, { "timestamp": "2026-05-29 01:05:19,055", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000255c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 2284 }, { "timestamp": "2026-05-29 01:05:19,055", "thread_id": "4696", "caller": "0x7ff79bc8a418", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000255c" } ], "repeated": 0, "id": 2285 }, { "timestamp": "2026-05-29 01:05:19,055", "thread_id": "4696", "caller": "0x7ff79bc7a06e", "parentcaller": "0x7ff79bc66f8c", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2286 }, { "timestamp": "2026-05-29 01:05:19,055", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "CLSID\\{56AD4C5D-B908-4F85-8FF1-7940C29B3BCF}\\Instance" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\CLSID\\{56AD4C5D-B908-4F85-8FF1-7940C29B3BCF}\\Instance" } ], "repeated": 0, "id": 2287 }, { "timestamp": "2026-05-29 01:05:19,055", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 2288 }, { "timestamp": "2026-05-29 01:05:19,055", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff58be0000", "arguments": [ { "name": "lpLibFileName", "value": "shell32.dll" }, { "name": "dwFlags", "value": "0x00004000" } ], "repeated": 0, "id": 2289 }, { "timestamp": "2026-05-29 01:05:19,055", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "SHELL32.dll" }, { "name": "ModuleHandle", "value": "0x7fff58be0000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff58c378f0" } ], "repeated": 0, "id": 2290 }, { "timestamp": "2026-05-29 01:05:19,055", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "synchronization", "api": "NtFindAtom", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "AtomName", "value": "{9F4C2855-9F79-4B39-A8D0-E1D42DE1D5F3} 3" }, { "name": "Atom", "value": "0x00000000" } ], "repeated": 0, "id": 2291 }, { "timestamp": "2026-05-29 01:05:19,055", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc68e6a", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 2, "id": 2292 }, { "timestamp": "2026-05-29 01:05:19,055", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xdf\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x005\\x18\\xff\\x7f\\x00\\x00X\\xe0\\\\x03\\x00\\x00\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2293 }, { "timestamp": "2026-05-29 01:05:19,055", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000255c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 2294 }, { "timestamp": "2026-05-29 01:05:19,055", "thread_id": "4696", "caller": "0x7ff79bc8a418", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000255c" } ], "repeated": 0, "id": 2295 }, { "timestamp": "2026-05-29 01:05:19,055", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 2296 }, { "timestamp": "2026-05-29 01:05:19,055", "thread_id": "4620", "caller": "0x7fff42568962", "parentcaller": "0x7fff42733c0d", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00010118" }, { "name": "Message", "value": "0x00000401" } ], "repeated": 0, "id": 2297 }, { "timestamp": "2026-05-29 01:05:19,055", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 2298 }, { "timestamp": "2026-05-29 01:05:19,055", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc68e6a", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 2, "id": 2299 }, { "timestamp": "2026-05-29 01:05:19,055", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xdf\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x005\\x18\\xff\\x7f\\x00\\x00X\\xe0\\\\x03\\x00\\x00\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2300 }, { "timestamp": "2026-05-29 01:05:19,055", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002550" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 2301 }, { "timestamp": "2026-05-29 01:05:19,055", "thread_id": "4696", "caller": "0x7ff79bc8a418", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 0, "id": 2302 }, { "timestamp": "2026-05-29 01:05:19,071", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc686b4", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 2303 }, { "timestamp": "2026-05-29 01:05:19,071", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xdf\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x005\\x18\\xff\\x7f\\x00\\x00X\\xe0\\\\x03\\x00\\x00\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2304 }, { "timestamp": "2026-05-29 01:05:19,071", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002550" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 2305 }, { "timestamp": "2026-05-29 01:05:19,071", "thread_id": "4696", "caller": "0x7ff79bc8a418", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 0, "id": 2306 }, { "timestamp": "2026-05-29 01:05:19,071", "thread_id": "4696", "caller": "0x7ff79bc7a06e", "parentcaller": "0x7ff79bc66f8c", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2307 }, { "timestamp": "2026-05-29 01:05:19,071", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "CLSID\\{56AD4C5D-B908-4F85-8FF1-7940C29B3BCF}\\Instance" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\CLSID\\{56AD4C5D-B908-4F85-8FF1-7940C29B3BCF}\\Instance" } ], "repeated": 0, "id": 2308 }, { "timestamp": "2026-05-29 01:05:19,071", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 2309 }, { "timestamp": "2026-05-29 01:05:19,071", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff58be0000", "arguments": [ { "name": "lpLibFileName", "value": "shell32.dll" }, { "name": "dwFlags", "value": "0x00004000" } ], "repeated": 0, "id": 2310 }, { "timestamp": "2026-05-29 01:05:19,071", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "SHELL32.dll" }, { "name": "ModuleHandle", "value": "0x7fff58be0000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff58c378f0" } ], "repeated": 0, "id": 2311 }, { "timestamp": "2026-05-29 01:05:19,071", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "synchronization", "api": "NtFindAtom", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "AtomName", "value": "{9F4C2855-9F79-4B39-A8D0-E1D42DE1D5F3} 3" }, { "name": "Atom", "value": "0x00000000" } ], "repeated": 0, "id": 2312 }, { "timestamp": "2026-05-29 01:05:19,071", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc68e6a", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 2, "id": 2313 }, { "timestamp": "2026-05-29 01:05:19,071", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xdf\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x005\\x18\\xff\\x7f\\x00\\x00X\\xe0\\\\x03\\x00\\x00\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2314 }, { "timestamp": "2026-05-29 01:05:19,071", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000256c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 2315 }, { "timestamp": "2026-05-29 01:05:19,071", "thread_id": "4696", "caller": "0x7ff79bc8a418", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 2316 }, { "timestamp": "2026-05-29 01:05:19,071", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 2317 }, { "timestamp": "2026-05-29 01:05:19,071", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 2318 }, { "timestamp": "2026-05-29 01:05:19,071", "thread_id": "4620", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 3, "id": 2319 }, { "timestamp": "2026-05-29 01:05:19,071", "thread_id": "4620", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000100c4" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 1, "id": 2320 }, { "timestamp": "2026-05-29 01:05:19,071", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 2321 }, { "timestamp": "2026-05-29 01:05:19,071", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc68e6a", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 2, "id": 2322 }, { "timestamp": "2026-05-29 01:05:19,071", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xdf\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x005\\x18\\xff\\x7f\\x00\\x00X\\xe0\\\\x03\\x00\\x00\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2323 }, { "timestamp": "2026-05-29 01:05:19,071", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002550" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 2324 }, { "timestamp": "2026-05-29 01:05:19,071", "thread_id": "4696", "caller": "0x7ff79bc8a418", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 0, "id": 2325 }, { "timestamp": "2026-05-29 01:05:19,071", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc686b4", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 2326 }, { "timestamp": "2026-05-29 01:05:19,071", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xdf\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x005\\x18\\xff\\x7f\\x00\\x00X\\xe0\\\\x03\\x00\\x00\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2327 }, { "timestamp": "2026-05-29 01:05:19,071", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002550" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 2328 }, { "timestamp": "2026-05-29 01:05:19,071", "thread_id": "4696", "caller": "0x7ff79bc8a418", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 0, "id": 2329 }, { "timestamp": "2026-05-29 01:05:19,071", "thread_id": "4696", "caller": "0x7ff79bc7a06e", "parentcaller": "0x7ff79bc66f8c", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2330 }, { "timestamp": "2026-05-29 01:05:19,071", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "CLSID\\{56AD4C5D-B908-4F85-8FF1-7940C29B3BCF}\\Instance" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\CLSID\\{56AD4C5D-B908-4F85-8FF1-7940C29B3BCF}\\Instance" } ], "repeated": 0, "id": 2331 }, { "timestamp": "2026-05-29 01:05:19,071", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 2332 }, { "timestamp": "2026-05-29 01:05:19,071", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff58be0000", "arguments": [ { "name": "lpLibFileName", "value": "shell32.dll" }, { "name": "dwFlags", "value": "0x00004000" } ], "repeated": 0, "id": 2333 }, { "timestamp": "2026-05-29 01:05:19,071", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "SHELL32.dll" }, { "name": "ModuleHandle", "value": "0x7fff58be0000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff58c378f0" } ], "repeated": 0, "id": 2334 }, { "timestamp": "2026-05-29 01:05:19,071", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "synchronization", "api": "NtFindAtom", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "AtomName", "value": "{9F4C2855-9F79-4B39-A8D0-E1D42DE1D5F3} 3" }, { "name": "Atom", "value": "0x00000000" } ], "repeated": 0, "id": 2335 }, { "timestamp": "2026-05-29 01:05:19,087", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc686b4", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 2336 }, { "timestamp": "2026-05-29 01:05:19,087", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xdf\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x005\\x18\\xff\\x7f\\x00\\x00X\\xe0\\\\x03\\x00\\x00\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2337 }, { "timestamp": "2026-05-29 01:05:19,087", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002550" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 2338 }, { "timestamp": "2026-05-29 01:05:19,087", "thread_id": "4696", "caller": "0x7ff79bc8a418", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 0, "id": 2339 }, { "timestamp": "2026-05-29 01:05:19,087", "thread_id": "4696", "caller": "0x7ff79bc5652c", "parentcaller": "0x7ff79bc55d54", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\rsaenh.dll" }, { "name": "BaseAddress", "value": "0x7fff56630000" } ], "repeated": 0, "id": 2340 }, { "timestamp": "2026-05-29 01:05:19,087", "thread_id": "4696", "caller": "0x7ff79bc5652c", "parentcaller": "0x7ff79bc55d54", "category": "crypto", "api": "CryptAcquireContextW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Container", "value": "" }, { "name": "Provider", "value": "" }, { "name": "Flags", "value": "0xf0000000" } ], "repeated": 0, "id": 2341 }, { "timestamp": "2026-05-29 01:05:19,087", "thread_id": "4696", "caller": "0x7ff79bc5655a", "parentcaller": "0x7ff79bc55d54", "category": "crypto", "api": "CryptCreateHash", "status": true, "return": "0x00000001", "arguments": [ { "name": "Algid", "value": "0x00008003", "pretty_value": "MD5" }, { "name": "CryptKey", "value": "0x00000000" }, { "name": "Hash object", "value": "0x0caaf560" } ], "repeated": 0, "id": 2342 }, { "timestamp": "2026-05-29 01:05:19,087", "thread_id": "4696", "caller": "0x7ff79bc565a5", "parentcaller": "0x7ff79bc55d54", "category": "crypto", "api": "CryptHashData", "status": true, "return": "0x00000001", "arguments": [ { "name": "CryptHash", "value": "0x0caaf560" }, { "name": "Buffer", "value": "{\\x007\\x00C\\x005\\x00A\\x004\\x000\\x00E\\x00F\\x00-\\x00A\\x000\\x00F\\x00B\\x00-\\x004\\x00B\\x00F\\x00C\\x00-\\x008\\x007\\x004\\x00A\\x00-\\x00C\\x000\\x00F\\x002\\x00E\\x000\\x00B\\x009\\x00F\\x00A\\x008\\x00E\\x00}\\x00\\\\x00S\\x00t\\x00e\\x00a\\x00m\\x00\\\\x00s\\x00t\\x00e\\x00a\\x00m\\x00.\\x00e\\x00x\\x00e\\x00.\\x001\\x00" }, { "name": "Length", "value": "112" } ], "repeated": 0, "id": 2343 }, { "timestamp": "2026-05-29 01:05:19,087", "thread_id": "4696", "caller": "0x7ff79bc5652c", "parentcaller": "0x7ff79bc55d54", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\rsaenh.dll" }, { "name": "BaseAddress", "value": "0x7fff56630000" } ], "repeated": 0, "id": 2344 }, { "timestamp": "2026-05-29 01:05:19,087", "thread_id": "4696", "caller": "0x7ff79bc5652c", "parentcaller": "0x7ff79bc55d54", "category": "crypto", "api": "CryptAcquireContextW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Container", "value": "" }, { "name": "Provider", "value": "" }, { "name": "Flags", "value": "0xf0000000" } ], "repeated": 0, "id": 2345 }, { "timestamp": "2026-05-29 01:05:19,087", "thread_id": "4696", "caller": "0x7ff79bc5655a", "parentcaller": "0x7ff79bc55d54", "category": "crypto", "api": "CryptCreateHash", "status": true, "return": "0x00000001", "arguments": [ { "name": "Algid", "value": "0x00008003", "pretty_value": "MD5" }, { "name": "CryptKey", "value": "0x00000000" }, { "name": "Hash object", "value": "0x0caaf480" } ], "repeated": 0, "id": 2346 }, { "timestamp": "2026-05-29 01:05:19,087", "thread_id": "4696", "caller": "0x7ff79bc565a5", "parentcaller": "0x7ff79bc55d54", "category": "crypto", "api": "CryptHashData", "status": true, "return": "0x00000001", "arguments": [ { "name": "CryptHash", "value": "0x0caaf480" }, { "name": "Buffer", "value": "C\\x00:\\x00\\\\x00U\\x00s\\x00e\\x00r\\x00s\\x00\\\\x00a\\x00d\\x00m\\x00i\\x00n\\x00\\\\x00A\\x00p\\x00p\\x00D\\x00a\\x00t\\x00a\\x00\\\\x00L\\x00o\\x00c\\x00a\\x00l\\x00\\\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00\\\\x00O\\x00n\\x00e\\x00D\\x00r\\x00i\\x00v\\x00e\\x00\\\\x00O\\x00n\\x00e\\x00D\\x00r\\x00i\\x00v\\x00e\\x00.\\x00e\\x00x\\x00e\\x00.\\x005\\x000\\x001\\x00" }, { "name": "Length", "value": "128" } ], "repeated": 0, "id": 2347 }, { "timestamp": "2026-05-29 01:05:19,087", "thread_id": "4696", "caller": "0x7ff79bc5696c", "parentcaller": "0x7ff79bc55d54", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2348 }, { "timestamp": "2026-05-29 01:05:19,087", "thread_id": "4696", "caller": "0x7ff79bc623a8", "parentcaller": "0x7ff79bc62e19", "category": "system", "api": "LdrGetDllHandle", "status": false, "return": "0xffffffffc0000135", "pretty_return": "DLL_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\SecurityHealthSSO.dll" }, { "name": "ModuleHandle", "value": "0x7fff57ec14a4" } ], "repeated": 0, "id": 2349 }, { "timestamp": "2026-05-29 01:05:19,087", "thread_id": "4696", "caller": "0x7ff79bc8ab52", "parentcaller": "0x7ff79bc896ee", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x0000200a" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 2350 }, { "timestamp": "2026-05-29 01:05:19,087", "thread_id": "4696", "caller": "0x7ff79bc62fcc", "parentcaller": "0x7ff79bc569dd", "category": "system", "api": "CreateTimerQueueTimer", "status": true, "return": "0x00000001", "arguments": [ { "name": "phNewTimer", "value": "0x0caae840" }, { "name": "TimerQueue", "value": "0x00000000" }, { "name": "Callback", "value": "0x9be06320" }, { "name": "Parameter", "value": "0x035cb810" }, { "name": "DueTime", "value": "5000" }, { "name": "Period", "value": "1000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 2351 }, { "timestamp": "2026-05-29 01:05:19,087", "thread_id": "4696", "caller": "0x7ff79bc630c3", "parentcaller": "0x7ff79bc569dd", "category": "system", "api": "CreateTimerQueueTimer", "status": true, "return": "0x00000001", "arguments": [ { "name": "phNewTimer", "value": "0x0caaeae0" }, { "name": "TimerQueue", "value": "0x00000000" }, { "name": "Callback", "value": "0x9be06320" }, { "name": "Parameter", "value": "0x035cb810" }, { "name": "DueTime", "value": "1000" }, { "name": "Period", "value": "1000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 2352 }, { "timestamp": "2026-05-29 01:05:19,102", "thread_id": "4696", "caller": "0x7ff79bc91360", "parentcaller": "0x7ff79bc5d2c3", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2353 }, { "timestamp": "2026-05-29 01:05:19,102", "thread_id": "4696", "caller": "0x7ff79bc7a06e", "parentcaller": "0x7ff79bc78f2b", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2354 }, { "timestamp": "2026-05-29 01:05:19,102", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc78f2b", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "CLSID\\{56AD4C5D-B908-4F85-8FF1-7940C29B3BCF}\\Instance" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\CLSID\\{56AD4C5D-B908-4F85-8FF1-7940C29B3BCF}\\Instance" } ], "repeated": 0, "id": 2355 }, { "timestamp": "2026-05-29 01:05:19,102", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc78f2b", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 2356 }, { "timestamp": "2026-05-29 01:05:19,102", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc78f2b", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff58be0000", "arguments": [ { "name": "lpLibFileName", "value": "shell32.dll" }, { "name": "dwFlags", "value": "0x00004000" } ], "repeated": 0, "id": 2357 }, { "timestamp": "2026-05-29 01:05:19,102", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc78f2b", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "SHELL32.dll" }, { "name": "ModuleHandle", "value": "0x7fff58be0000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff58c378f0" } ], "repeated": 0, "id": 2358 }, { "timestamp": "2026-05-29 01:05:19,102", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc78f2b", "category": "synchronization", "api": "NtFindAtom", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "AtomName", "value": "{9F4C2855-9F79-4B39-A8D0-E1D42DE1D5F3} 3" }, { "name": "Atom", "value": "0x00000000" } ], "repeated": 0, "id": 2359 }, { "timestamp": "2026-05-29 01:05:19,102", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc68e6a", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 2, "id": 2360 }, { "timestamp": "2026-05-29 01:05:19,102", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xe2\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x005\\x18\\xff\\x7f\\x00\\x00(\\xe3\\\\x03\\x00\\x00\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2361 }, { "timestamp": "2026-05-29 01:05:19,102", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000256c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 2362 }, { "timestamp": "2026-05-29 01:05:19,102", "thread_id": "4696", "caller": "0x7ff79bc8a418", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 2363 }, { "timestamp": "2026-05-29 01:05:19,102", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc68e6a", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 2, "id": 2364 }, { "timestamp": "2026-05-29 01:05:19,102", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xdf\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x005\\x18\\xff\\x7f\\x00\\x00X\\xe0\\\\x03\\x00\\x00\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2365 }, { "timestamp": "2026-05-29 01:05:19,102", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000256c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 2366 }, { "timestamp": "2026-05-29 01:05:19,102", "thread_id": "4696", "caller": "0x7ff79bc8a418", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 2367 }, { "timestamp": "2026-05-29 01:05:19,102", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc686b4", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 2368 }, { "timestamp": "2026-05-29 01:05:19,102", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xdf\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x005\\x18\\xff\\x7f\\x00\\x00X\\xe0\\\\x03\\x00\\x00\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2369 }, { "timestamp": "2026-05-29 01:05:19,102", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000256c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 2370 }, { "timestamp": "2026-05-29 01:05:19,102", "thread_id": "4696", "caller": "0x7ff79bc8a418", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 2371 }, { "timestamp": "2026-05-29 01:05:19,118", "thread_id": "4696", "caller": "0x7ff79bc7a06e", "parentcaller": "0x7ff79bc66f8c", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2372 }, { "timestamp": "2026-05-29 01:05:19,118", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "CLSID\\{56AD4C5D-B908-4F85-8FF1-7940C29B3BCF}\\Instance" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\CLSID\\{56AD4C5D-B908-4F85-8FF1-7940C29B3BCF}\\Instance" } ], "repeated": 0, "id": 2373 }, { "timestamp": "2026-05-29 01:05:19,118", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 2374 }, { "timestamp": "2026-05-29 01:05:19,118", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff58be0000", "arguments": [ { "name": "lpLibFileName", "value": "shell32.dll" }, { "name": "dwFlags", "value": "0x00004000" } ], "repeated": 0, "id": 2375 }, { "timestamp": "2026-05-29 01:05:19,118", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "SHELL32.dll" }, { "name": "ModuleHandle", "value": "0x7fff58be0000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff58c378f0" } ], "repeated": 0, "id": 2376 }, { "timestamp": "2026-05-29 01:05:19,118", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "synchronization", "api": "NtFindAtom", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "AtomName", "value": "{9F4C2855-9F79-4B39-A8D0-E1D42DE1D5F3} 3" }, { "name": "Atom", "value": "0x00000000" } ], "repeated": 0, "id": 2377 }, { "timestamp": "2026-05-29 01:05:19,118", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc686b4", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 2378 }, { "timestamp": "2026-05-29 01:05:19,118", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xdf\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x005\\x18\\xff\\x7f\\x00\\x00X\\xe0\\\\x03\\x00\\x00\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2379 }, { "timestamp": "2026-05-29 01:05:19,118", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000256c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 2380 }, { "timestamp": "2026-05-29 01:05:19,118", "thread_id": "4696", "caller": "0x7ff79bc8a418", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 2381 }, { "timestamp": "2026-05-29 01:05:19,118", "thread_id": "4696", "caller": "0x7ff79bc7c9d8", "parentcaller": "0x7ff79bc7c92d", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\xf9\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00X\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x01\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4696" } ], "repeated": 0, "id": 2382 }, { "timestamp": "2026-05-29 01:05:19,118", "thread_id": "4636", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xf9\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x1c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4636" } ], "repeated": 0, "id": 2383 }, { "timestamp": "2026-05-29 01:05:19,118", "thread_id": "4636", "caller": "0x7ff79bc51f68", "parentcaller": "0x7ff79bc90020", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000100c4" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 1, "id": 2384 }, { "timestamp": "2026-05-29 01:05:19,118", "thread_id": "4636", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xf9\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x1c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4636" } ], "repeated": 0, "id": 2385 }, { "timestamp": "2026-05-29 01:05:19,118", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc68e6a", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 2, "id": 2386 }, { "timestamp": "2026-05-29 01:05:19,118", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xe2\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x005\\x18\\xff\\x7f\\x00\\x00(\\xe3\\\\x03\\x00\\x00\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2387 }, { "timestamp": "2026-05-29 01:05:19,118", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000252c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 2388 }, { "timestamp": "2026-05-29 01:05:19,118", "thread_id": "4696", "caller": "0x7ff79bc8a418", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000252c" } ], "repeated": 0, "id": 2389 }, { "timestamp": "2026-05-29 01:05:19,133", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc686b4", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 2390 }, { "timestamp": "2026-05-29 01:05:19,133", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xdf\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x005\\x18\\xff\\x7f\\x00\\x00X\\xe0\\\\x03\\x00\\x00\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2391 }, { "timestamp": "2026-05-29 01:05:19,133", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000256c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 2392 }, { "timestamp": "2026-05-29 01:05:19,133", "thread_id": "4696", "caller": "0x7ff79bc8a418", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 2393 }, { "timestamp": "2026-05-29 01:05:19,149", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc686b4", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 2394 }, { "timestamp": "2026-05-29 01:05:19,149", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xdf\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x005\\x18\\xff\\x7f\\x00\\x00X\\xe0\\\\x03\\x00\\x00\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2395 }, { "timestamp": "2026-05-29 01:05:19,149", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000252c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 2396 }, { "timestamp": "2026-05-29 01:05:19,149", "thread_id": "4696", "caller": "0x7ff79bc8a418", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000252c" } ], "repeated": 0, "id": 2397 }, { "timestamp": "2026-05-29 01:05:19,180", "thread_id": "4696", "caller": "0x7ff79bcbc401", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "Handle", "value": "0x0000252c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2398 }, { "timestamp": "2026-05-29 01:05:19,180", "thread_id": "4696", "caller": "0x7ff79bcbc434", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000252c" }, { "name": "ValueName", "value": "IsFeedsAvailable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\IsFeedsAvailable" } ], "repeated": 0, "id": 2399 }, { "timestamp": "2026-05-29 01:05:19,180", "thread_id": "4696", "caller": "0x7ff79bcbc458", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000252c" } ], "repeated": 0, "id": 2400 }, { "timestamp": "2026-05-29 01:05:19,180", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2401 }, { "timestamp": "2026-05-29 01:05:19,180", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2402 }, { "timestamp": "2026-05-29 01:05:19,180", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000252c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2403 }, { "timestamp": "2026-05-29 01:05:19,180", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000252c" }, { "name": "ValueName", "value": "HeadlinesOnboardingComplete" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\HeadlinesOnboardingComplete" } ], "repeated": 0, "id": 2404 }, { "timestamp": "2026-05-29 01:05:19,180", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000252c" } ], "repeated": 0, "id": 2405 }, { "timestamp": "2026-05-29 01:05:19,180", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2406 }, { "timestamp": "2026-05-29 01:05:19,180", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2407 }, { "timestamp": "2026-05-29 01:05:19,180", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000252c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2408 }, { "timestamp": "2026-05-29 01:05:19,180", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000252c" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 2409 }, { "timestamp": "2026-05-29 01:05:19,180", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000252c" } ], "repeated": 0, "id": 2410 }, { "timestamp": "2026-05-29 01:05:19,180", "thread_id": "4696", "caller": "0x7ff79bcbc401", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "Handle", "value": "0x0000252c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2411 }, { "timestamp": "2026-05-29 01:05:19,180", "thread_id": "4696", "caller": "0x7ff79bcbc434", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000252c" }, { "name": "ValueName", "value": "IsFeedsAvailable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\IsFeedsAvailable" } ], "repeated": 0, "id": 2412 }, { "timestamp": "2026-05-29 01:05:19,180", "thread_id": "4696", "caller": "0x7ff79bcbc458", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000252c" } ], "repeated": 0, "id": 2413 }, { "timestamp": "2026-05-29 01:05:19,180", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2414 }, { "timestamp": "2026-05-29 01:05:19,180", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2415 }, { "timestamp": "2026-05-29 01:05:19,180", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000252c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2416 }, { "timestamp": "2026-05-29 01:05:19,180", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000252c" }, { "name": "ValueName", "value": "HeadlinesOnboardingComplete" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\HeadlinesOnboardingComplete" } ], "repeated": 0, "id": 2417 }, { "timestamp": "2026-05-29 01:05:19,180", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000252c" } ], "repeated": 0, "id": 2418 }, { "timestamp": "2026-05-29 01:05:19,180", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2419 }, { "timestamp": "2026-05-29 01:05:19,180", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2420 }, { "timestamp": "2026-05-29 01:05:19,180", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000252c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2421 }, { "timestamp": "2026-05-29 01:05:19,180", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000252c" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 2422 }, { "timestamp": "2026-05-29 01:05:19,180", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000252c" } ], "repeated": 0, "id": 2423 }, { "timestamp": "2026-05-29 01:05:19,180", "thread_id": "4696", "caller": "0x7ff79bcbc401", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "Handle", "value": "0x0000252c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2424 }, { "timestamp": "2026-05-29 01:05:19,180", "thread_id": "4696", "caller": "0x7ff79bcbc434", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000252c" }, { "name": "ValueName", "value": "IsFeedsAvailable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\IsFeedsAvailable" } ], "repeated": 0, "id": 2425 }, { "timestamp": "2026-05-29 01:05:19,180", "thread_id": "4696", "caller": "0x7ff79bcbc458", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000252c" } ], "repeated": 0, "id": 2426 }, { "timestamp": "2026-05-29 01:05:19,180", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2427 }, { "timestamp": "2026-05-29 01:05:19,180", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2428 }, { "timestamp": "2026-05-29 01:05:19,180", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000252c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2429 }, { "timestamp": "2026-05-29 01:05:19,180", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000252c" }, { "name": "ValueName", "value": "HeadlinesOnboardingComplete" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\HeadlinesOnboardingComplete" } ], "repeated": 0, "id": 2430 }, { "timestamp": "2026-05-29 01:05:19,180", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000252c" } ], "repeated": 0, "id": 2431 }, { "timestamp": "2026-05-29 01:05:19,180", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2432 }, { "timestamp": "2026-05-29 01:05:19,180", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2433 }, { "timestamp": "2026-05-29 01:05:19,180", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000252c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2434 }, { "timestamp": "2026-05-29 01:05:19,180", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000252c" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 2435 }, { "timestamp": "2026-05-29 01:05:19,180", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000252c" } ], "repeated": 0, "id": 2436 }, { "timestamp": "2026-05-29 01:05:19,180", "thread_id": "4696", "caller": "0x7ff79bcbc401", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "Handle", "value": "0x0000252c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2437 }, { "timestamp": "2026-05-29 01:05:19,180", "thread_id": "4696", "caller": "0x7ff79bcbc434", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000252c" }, { "name": "ValueName", "value": "IsFeedsAvailable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\IsFeedsAvailable" } ], "repeated": 0, "id": 2438 }, { "timestamp": "2026-05-29 01:05:19,180", "thread_id": "4696", "caller": "0x7ff79bcbc458", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000252c" } ], "repeated": 0, "id": 2439 }, { "timestamp": "2026-05-29 01:05:19,180", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2440 }, { "timestamp": "2026-05-29 01:05:19,180", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2441 }, { "timestamp": "2026-05-29 01:05:19,180", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000252c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2442 }, { "timestamp": "2026-05-29 01:05:19,180", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000252c" }, { "name": "ValueName", "value": "HeadlinesOnboardingComplete" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\HeadlinesOnboardingComplete" } ], "repeated": 0, "id": 2443 }, { "timestamp": "2026-05-29 01:05:19,180", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000252c" } ], "repeated": 0, "id": 2444 }, { "timestamp": "2026-05-29 01:05:19,180", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2445 }, { "timestamp": "2026-05-29 01:05:19,180", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2446 }, { "timestamp": "2026-05-29 01:05:19,180", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000252c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2447 }, { "timestamp": "2026-05-29 01:05:19,180", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000252c" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 2448 }, { "timestamp": "2026-05-29 01:05:19,180", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000252c" } ], "repeated": 0, "id": 2449 }, { "timestamp": "2026-05-29 01:05:19,180", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2450 }, { "timestamp": "2026-05-29 01:05:19,180", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2451 }, { "timestamp": "2026-05-29 01:05:19,180", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000252c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2452 }, { "timestamp": "2026-05-29 01:05:19,180", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000252c" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 2453 }, { "timestamp": "2026-05-29 01:05:19,180", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000252c" } ], "repeated": 0, "id": 2454 }, { "timestamp": "2026-05-29 01:05:19,180", "thread_id": "4696", "caller": "0x7ff79bc557d2", "parentcaller": "0x7ff79bd1630d", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "TaskbarMonitor" }, { "name": "Atom", "value": "0x0000c045" } ], "repeated": 0, "id": 2455 }, { "timestamp": "2026-05-29 01:05:19,180", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2456 }, { "timestamp": "2026-05-29 01:05:19,180", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2457 }, { "timestamp": "2026-05-29 01:05:19,180", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000252c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2458 }, { "timestamp": "2026-05-29 01:05:19,180", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000252c" }, { "name": "ValueName", "value": "ShellFeedsTaskbarContentUpdateMode" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarContentUpdateMode" } ], "repeated": 0, "id": 2459 }, { "timestamp": "2026-05-29 01:05:19,180", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000252c" } ], "repeated": 0, "id": 2460 }, { "timestamp": "2026-05-29 01:05:19,180", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc686b4", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 2461 }, { "timestamp": "2026-05-29 01:05:19,180", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xdf\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x005\\x18\\xff\\x7f\\x00\\x00X\\xe0\\\\x03\\x00\\x00\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2462 }, { "timestamp": "2026-05-29 01:05:19,180", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000252c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 2463 }, { "timestamp": "2026-05-29 01:05:19,180", "thread_id": "4696", "caller": "0x7ff79bc8a418", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000252c" } ], "repeated": 0, "id": 2464 }, { "timestamp": "2026-05-29 01:05:19,180", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc68e6a", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 2, "id": 2465 }, { "timestamp": "2026-05-29 01:05:19,180", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xdf\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x005\\x18\\xff\\x7f\\x00\\x00X\\xe0\\\\x03\\x00\\x00\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2466 }, { "timestamp": "2026-05-29 01:05:19,180", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000252c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 2467 }, { "timestamp": "2026-05-29 01:05:19,180", "thread_id": "4696", "caller": "0x7ff79bc8a418", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000252c" } ], "repeated": 0, "id": 2468 }, { "timestamp": "2026-05-29 01:05:19,180", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc686b4", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 2469 }, { "timestamp": "2026-05-29 01:05:19,180", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xdf\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x005\\x18\\xff\\x7f\\x00\\x00X\\xe0\\\\x03\\x00\\x00\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2470 }, { "timestamp": "2026-05-29 01:05:19,180", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000252c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 2471 }, { "timestamp": "2026-05-29 01:05:19,180", "thread_id": "4696", "caller": "0x7ff79bc8a418", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000252c" } ], "repeated": 0, "id": 2472 }, { "timestamp": "2026-05-29 01:05:19,180", "thread_id": "4696", "caller": "0x7ff79bc7a06e", "parentcaller": "0x7ff79bc66f8c", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2473 }, { "timestamp": "2026-05-29 01:05:19,180", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "CLSID\\{56AD4C5D-B908-4F85-8FF1-7940C29B3BCF}\\Instance" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\CLSID\\{56AD4C5D-B908-4F85-8FF1-7940C29B3BCF}\\Instance" } ], "repeated": 0, "id": 2474 }, { "timestamp": "2026-05-29 01:05:19,180", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 2475 }, { "timestamp": "2026-05-29 01:05:19,180", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff58be0000", "arguments": [ { "name": "lpLibFileName", "value": "shell32.dll" }, { "name": "dwFlags", "value": "0x00004000" } ], "repeated": 0, "id": 2476 }, { "timestamp": "2026-05-29 01:05:19,180", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "SHELL32.dll" }, { "name": "ModuleHandle", "value": "0x7fff58be0000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff58c378f0" } ], "repeated": 0, "id": 2477 }, { "timestamp": "2026-05-29 01:05:19,180", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "synchronization", "api": "NtFindAtom", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "AtomName", "value": "{9F4C2855-9F79-4B39-A8D0-E1D42DE1D5F3} 3" }, { "name": "Atom", "value": "0x00000000" } ], "repeated": 0, "id": 2478 }, { "timestamp": "2026-05-29 01:05:19,196", "thread_id": "4696", "caller": "0x7ff79bcbc401", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "Handle", "value": "0x0000252c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2479 }, { "timestamp": "2026-05-29 01:05:19,196", "thread_id": "4696", "caller": "0x7ff79bcbc434", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000252c" }, { "name": "ValueName", "value": "IsFeedsAvailable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\IsFeedsAvailable" } ], "repeated": 0, "id": 2480 }, { "timestamp": "2026-05-29 01:05:19,196", "thread_id": "4696", "caller": "0x7ff79bcbc458", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000252c" } ], "repeated": 0, "id": 2481 }, { "timestamp": "2026-05-29 01:05:19,196", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2482 }, { "timestamp": "2026-05-29 01:05:19,196", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2483 }, { "timestamp": "2026-05-29 01:05:19,196", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000252c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2484 }, { "timestamp": "2026-05-29 01:05:19,196", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000252c" }, { "name": "ValueName", "value": "HeadlinesOnboardingComplete" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\HeadlinesOnboardingComplete" } ], "repeated": 0, "id": 2485 }, { "timestamp": "2026-05-29 01:05:19,196", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000252c" } ], "repeated": 0, "id": 2486 }, { "timestamp": "2026-05-29 01:05:19,196", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2487 }, { "timestamp": "2026-05-29 01:05:19,196", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2488 }, { "timestamp": "2026-05-29 01:05:19,196", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000252c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2489 }, { "timestamp": "2026-05-29 01:05:19,196", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000252c" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 2490 }, { "timestamp": "2026-05-29 01:05:19,196", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000252c" } ], "repeated": 0, "id": 2491 }, { "timestamp": "2026-05-29 01:05:19,196", "thread_id": "4696", "caller": "0x7ff79bcbc401", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "Handle", "value": "0x0000252c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2492 }, { "timestamp": "2026-05-29 01:05:19,196", "thread_id": "4696", "caller": "0x7ff79bcbc434", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000252c" }, { "name": "ValueName", "value": "IsFeedsAvailable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\IsFeedsAvailable" } ], "repeated": 0, "id": 2493 }, { "timestamp": "2026-05-29 01:05:19,196", "thread_id": "4696", "caller": "0x7ff79bcbc458", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000252c" } ], "repeated": 0, "id": 2494 }, { "timestamp": "2026-05-29 01:05:19,196", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2495 }, { "timestamp": "2026-05-29 01:05:19,196", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2496 }, { "timestamp": "2026-05-29 01:05:19,196", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000252c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2497 }, { "timestamp": "2026-05-29 01:05:19,196", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000252c" }, { "name": "ValueName", "value": "HeadlinesOnboardingComplete" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\HeadlinesOnboardingComplete" } ], "repeated": 0, "id": 2498 }, { "timestamp": "2026-05-29 01:05:19,196", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000252c" } ], "repeated": 0, "id": 2499 }, { "timestamp": "2026-05-29 01:05:19,196", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2500 }, { "timestamp": "2026-05-29 01:05:19,196", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2501 }, { "timestamp": "2026-05-29 01:05:19,196", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000252c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2502 }, { "timestamp": "2026-05-29 01:05:19,196", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000252c" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 2503 }, { "timestamp": "2026-05-29 01:05:19,196", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000252c" } ], "repeated": 0, "id": 2504 }, { "timestamp": "2026-05-29 01:05:19,196", "thread_id": "4696", "caller": "0x7ff79bcbc401", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "Handle", "value": "0x0000252c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2505 }, { "timestamp": "2026-05-29 01:05:19,196", "thread_id": "4696", "caller": "0x7ff79bcbc434", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000252c" }, { "name": "ValueName", "value": "IsFeedsAvailable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\IsFeedsAvailable" } ], "repeated": 0, "id": 2506 }, { "timestamp": "2026-05-29 01:05:19,196", "thread_id": "4696", "caller": "0x7ff79bcbc458", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000252c" } ], "repeated": 0, "id": 2507 }, { "timestamp": "2026-05-29 01:05:19,196", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2508 }, { "timestamp": "2026-05-29 01:05:19,196", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2509 }, { "timestamp": "2026-05-29 01:05:19,196", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000252c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2510 }, { "timestamp": "2026-05-29 01:05:19,196", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000252c" }, { "name": "ValueName", "value": "HeadlinesOnboardingComplete" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\HeadlinesOnboardingComplete" } ], "repeated": 0, "id": 2511 }, { "timestamp": "2026-05-29 01:05:19,196", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000252c" } ], "repeated": 0, "id": 2512 }, { "timestamp": "2026-05-29 01:05:19,196", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2513 }, { "timestamp": "2026-05-29 01:05:19,196", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2514 }, { "timestamp": "2026-05-29 01:05:19,196", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000252c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2515 }, { "timestamp": "2026-05-29 01:05:19,196", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000252c" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 2516 }, { "timestamp": "2026-05-29 01:05:19,196", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000252c" } ], "repeated": 0, "id": 2517 }, { "timestamp": "2026-05-29 01:05:19,196", "thread_id": "4696", "caller": "0x7ff79bcbc401", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "Handle", "value": "0x0000252c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2518 }, { "timestamp": "2026-05-29 01:05:19,196", "thread_id": "4696", "caller": "0x7ff79bcbc434", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000252c" }, { "name": "ValueName", "value": "IsFeedsAvailable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\IsFeedsAvailable" } ], "repeated": 0, "id": 2519 }, { "timestamp": "2026-05-29 01:05:19,196", "thread_id": "4696", "caller": "0x7ff79bcbc458", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000252c" } ], "repeated": 0, "id": 2520 }, { "timestamp": "2026-05-29 01:05:19,196", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2521 }, { "timestamp": "2026-05-29 01:05:19,196", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2522 }, { "timestamp": "2026-05-29 01:05:19,196", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000252c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2523 }, { "timestamp": "2026-05-29 01:05:19,196", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000252c" }, { "name": "ValueName", "value": "HeadlinesOnboardingComplete" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\HeadlinesOnboardingComplete" } ], "repeated": 0, "id": 2524 }, { "timestamp": "2026-05-29 01:05:19,196", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000252c" } ], "repeated": 0, "id": 2525 }, { "timestamp": "2026-05-29 01:05:19,196", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2526 }, { "timestamp": "2026-05-29 01:05:19,196", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2527 }, { "timestamp": "2026-05-29 01:05:19,196", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000252c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2528 }, { "timestamp": "2026-05-29 01:05:19,196", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000252c" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 2529 }, { "timestamp": "2026-05-29 01:05:19,196", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000252c" } ], "repeated": 0, "id": 2530 }, { "timestamp": "2026-05-29 01:05:19,196", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2531 }, { "timestamp": "2026-05-29 01:05:19,196", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2532 }, { "timestamp": "2026-05-29 01:05:19,196", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000252c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2533 }, { "timestamp": "2026-05-29 01:05:19,196", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000252c" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 2534 }, { "timestamp": "2026-05-29 01:05:19,196", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000252c" } ], "repeated": 0, "id": 2535 }, { "timestamp": "2026-05-29 01:05:19,196", "thread_id": "4696", "caller": "0x7ff79bc557d2", "parentcaller": "0x7ff79bd1630d", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "TaskbarMonitor" }, { "name": "Atom", "value": "0x0000c045" } ], "repeated": 0, "id": 2536 }, { "timestamp": "2026-05-29 01:05:19,196", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2537 }, { "timestamp": "2026-05-29 01:05:19,196", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2538 }, { "timestamp": "2026-05-29 01:05:19,196", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000252c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2539 }, { "timestamp": "2026-05-29 01:05:19,196", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000252c" }, { "name": "ValueName", "value": "ShellFeedsTaskbarContentUpdateMode" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarContentUpdateMode" } ], "repeated": 0, "id": 2540 }, { "timestamp": "2026-05-29 01:05:19,196", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000252c" } ], "repeated": 0, "id": 2541 }, { "timestamp": "2026-05-29 01:05:19,196", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc686b4", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 2542 }, { "timestamp": "2026-05-29 01:05:19,196", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xe2\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x005\\x18\\xff\\x7f\\x00\\x00(\\xe3\\\\x03\\x00\\x00\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2543 }, { "timestamp": "2026-05-29 01:05:19,196", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000256c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 2544 }, { "timestamp": "2026-05-29 01:05:19,196", "thread_id": "4696", "caller": "0x7ff79bc8a418", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 2545 }, { "timestamp": "2026-05-29 01:05:19,196", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc68e6a", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 2, "id": 2546 }, { "timestamp": "2026-05-29 01:05:19,196", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xe2\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x005\\x18\\xff\\x7f\\x00\\x00(\\xe3\\\\x03\\x00\\x00\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2547 }, { "timestamp": "2026-05-29 01:05:19,196", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000256c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 2548 }, { "timestamp": "2026-05-29 01:05:19,196", "thread_id": "4696", "caller": "0x7ff79bc8a418", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 2549 }, { "timestamp": "2026-05-29 01:05:19,196", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc686b4", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 2550 }, { "timestamp": "2026-05-29 01:05:19,196", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xe2\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x005\\x18\\xff\\x7f\\x00\\x00(\\xe3\\\\x03\\x00\\x00\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2551 }, { "timestamp": "2026-05-29 01:05:19,196", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000256c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 2552 }, { "timestamp": "2026-05-29 01:05:19,196", "thread_id": "4696", "caller": "0x7ff79bc8a418", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 2553 }, { "timestamp": "2026-05-29 01:05:19,196", "thread_id": "4696", "caller": "0x7ff79bc7a06e", "parentcaller": "0x7ff79bc66f8c", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2554 }, { "timestamp": "2026-05-29 01:05:19,196", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "CLSID\\{56AD4C5D-B908-4F85-8FF1-7940C29B3BCF}\\Instance" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\CLSID\\{56AD4C5D-B908-4F85-8FF1-7940C29B3BCF}\\Instance" } ], "repeated": 0, "id": 2555 }, { "timestamp": "2026-05-29 01:05:19,196", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 2556 }, { "timestamp": "2026-05-29 01:05:19,196", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff58be0000", "arguments": [ { "name": "lpLibFileName", "value": "shell32.dll" }, { "name": "dwFlags", "value": "0x00004000" } ], "repeated": 0, "id": 2557 }, { "timestamp": "2026-05-29 01:05:19,196", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "SHELL32.dll" }, { "name": "ModuleHandle", "value": "0x7fff58be0000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff58c378f0" } ], "repeated": 0, "id": 2558 }, { "timestamp": "2026-05-29 01:05:19,196", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "synchronization", "api": "NtFindAtom", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "AtomName", "value": "{9F4C2855-9F79-4B39-A8D0-E1D42DE1D5F3} 3" }, { "name": "Atom", "value": "0x00000000" } ], "repeated": 0, "id": 2559 }, { "timestamp": "2026-05-29 01:05:19,212", "thread_id": "4696", "caller": "0x7ff79bcbc401", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "Handle", "value": "0x00002550" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2560 }, { "timestamp": "2026-05-29 01:05:19,212", "thread_id": "4696", "caller": "0x7ff79bcbc434", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "ValueName", "value": "IsFeedsAvailable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\IsFeedsAvailable" } ], "repeated": 0, "id": 2561 }, { "timestamp": "2026-05-29 01:05:19,212", "thread_id": "4696", "caller": "0x7ff79bcbc458", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 0, "id": 2562 }, { "timestamp": "2026-05-29 01:05:19,212", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2563 }, { "timestamp": "2026-05-29 01:05:19,212", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2564 }, { "timestamp": "2026-05-29 01:05:19,212", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002550" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2565 }, { "timestamp": "2026-05-29 01:05:19,212", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "ValueName", "value": "HeadlinesOnboardingComplete" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\HeadlinesOnboardingComplete" } ], "repeated": 0, "id": 2566 }, { "timestamp": "2026-05-29 01:05:19,212", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 0, "id": 2567 }, { "timestamp": "2026-05-29 01:05:19,212", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2568 }, { "timestamp": "2026-05-29 01:05:19,212", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2569 }, { "timestamp": "2026-05-29 01:05:19,212", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002550" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2570 }, { "timestamp": "2026-05-29 01:05:19,212", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 2571 }, { "timestamp": "2026-05-29 01:05:19,212", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 0, "id": 2572 }, { "timestamp": "2026-05-29 01:05:19,212", "thread_id": "4696", "caller": "0x7ff79bcbc401", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "Handle", "value": "0x00002550" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2573 }, { "timestamp": "2026-05-29 01:05:19,212", "thread_id": "4696", "caller": "0x7ff79bcbc434", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "ValueName", "value": "IsFeedsAvailable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\IsFeedsAvailable" } ], "repeated": 0, "id": 2574 }, { "timestamp": "2026-05-29 01:05:19,212", "thread_id": "4696", "caller": "0x7ff79bcbc458", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 0, "id": 2575 }, { "timestamp": "2026-05-29 01:05:19,212", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2576 }, { "timestamp": "2026-05-29 01:05:19,212", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2577 }, { "timestamp": "2026-05-29 01:05:19,212", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002550" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2578 }, { "timestamp": "2026-05-29 01:05:19,212", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "ValueName", "value": "HeadlinesOnboardingComplete" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\HeadlinesOnboardingComplete" } ], "repeated": 0, "id": 2579 }, { "timestamp": "2026-05-29 01:05:19,212", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 0, "id": 2580 }, { "timestamp": "2026-05-29 01:05:19,212", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2581 }, { "timestamp": "2026-05-29 01:05:19,212", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2582 }, { "timestamp": "2026-05-29 01:05:19,212", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002550" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2583 }, { "timestamp": "2026-05-29 01:05:19,212", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 2584 }, { "timestamp": "2026-05-29 01:05:19,212", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 0, "id": 2585 }, { "timestamp": "2026-05-29 01:05:19,212", "thread_id": "4696", "caller": "0x7ff79bcbc401", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "Handle", "value": "0x00002550" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2586 }, { "timestamp": "2026-05-29 01:05:19,212", "thread_id": "4696", "caller": "0x7ff79bcbc434", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "ValueName", "value": "IsFeedsAvailable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\IsFeedsAvailable" } ], "repeated": 0, "id": 2587 }, { "timestamp": "2026-05-29 01:05:19,212", "thread_id": "4696", "caller": "0x7ff79bcbc458", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 0, "id": 2588 }, { "timestamp": "2026-05-29 01:05:19,212", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2589 }, { "timestamp": "2026-05-29 01:05:19,212", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2590 }, { "timestamp": "2026-05-29 01:05:19,212", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002550" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2591 }, { "timestamp": "2026-05-29 01:05:19,212", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "ValueName", "value": "HeadlinesOnboardingComplete" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\HeadlinesOnboardingComplete" } ], "repeated": 0, "id": 2592 }, { "timestamp": "2026-05-29 01:05:19,212", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 0, "id": 2593 }, { "timestamp": "2026-05-29 01:05:19,212", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2594 }, { "timestamp": "2026-05-29 01:05:19,212", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2595 }, { "timestamp": "2026-05-29 01:05:19,212", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002550" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2596 }, { "timestamp": "2026-05-29 01:05:19,212", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 2597 }, { "timestamp": "2026-05-29 01:05:19,212", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 0, "id": 2598 }, { "timestamp": "2026-05-29 01:05:19,212", "thread_id": "4696", "caller": "0x7ff79bcbc401", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "Handle", "value": "0x00002550" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2599 }, { "timestamp": "2026-05-29 01:05:19,212", "thread_id": "4696", "caller": "0x7ff79bcbc434", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "ValueName", "value": "IsFeedsAvailable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\IsFeedsAvailable" } ], "repeated": 0, "id": 2600 }, { "timestamp": "2026-05-29 01:05:19,212", "thread_id": "4696", "caller": "0x7ff79bcbc458", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 0, "id": 2601 }, { "timestamp": "2026-05-29 01:05:19,212", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2602 }, { "timestamp": "2026-05-29 01:05:19,212", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2603 }, { "timestamp": "2026-05-29 01:05:19,212", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002550" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2604 }, { "timestamp": "2026-05-29 01:05:19,212", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "ValueName", "value": "HeadlinesOnboardingComplete" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\HeadlinesOnboardingComplete" } ], "repeated": 0, "id": 2605 }, { "timestamp": "2026-05-29 01:05:19,212", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 0, "id": 2606 }, { "timestamp": "2026-05-29 01:05:19,212", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2607 }, { "timestamp": "2026-05-29 01:05:19,212", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2608 }, { "timestamp": "2026-05-29 01:05:19,212", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002550" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2609 }, { "timestamp": "2026-05-29 01:05:19,212", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 2610 }, { "timestamp": "2026-05-29 01:05:19,212", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 0, "id": 2611 }, { "timestamp": "2026-05-29 01:05:19,212", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2612 }, { "timestamp": "2026-05-29 01:05:19,212", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2613 }, { "timestamp": "2026-05-29 01:05:19,212", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002550" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2614 }, { "timestamp": "2026-05-29 01:05:19,212", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 2615 }, { "timestamp": "2026-05-29 01:05:19,212", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 0, "id": 2616 }, { "timestamp": "2026-05-29 01:05:19,212", "thread_id": "4696", "caller": "0x7ff79bc557d2", "parentcaller": "0x7ff79bd1630d", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "TaskbarMonitor" }, { "name": "Atom", "value": "0x0000c045" } ], "repeated": 0, "id": 2617 }, { "timestamp": "2026-05-29 01:05:19,212", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2618 }, { "timestamp": "2026-05-29 01:05:19,212", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2619 }, { "timestamp": "2026-05-29 01:05:19,212", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002550" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2620 }, { "timestamp": "2026-05-29 01:05:19,212", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "ValueName", "value": "ShellFeedsTaskbarContentUpdateMode" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarContentUpdateMode" } ], "repeated": 0, "id": 2621 }, { "timestamp": "2026-05-29 01:05:19,212", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 0, "id": 2622 }, { "timestamp": "2026-05-29 01:05:19,212", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc686b4", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 2623 }, { "timestamp": "2026-05-29 01:05:19,212", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xe2\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x005\\x18\\xff\\x7f\\x00\\x00(\\xe3\\\\x03\\x00\\x00\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2624 }, { "timestamp": "2026-05-29 01:05:19,212", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002550" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 2625 }, { "timestamp": "2026-05-29 01:05:19,212", "thread_id": "4696", "caller": "0x7ff79bc8a418", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 0, "id": 2626 }, { "timestamp": "2026-05-29 01:05:19,212", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc68e6a", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 2, "id": 2627 }, { "timestamp": "2026-05-29 01:05:19,212", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xe2\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x005\\x18\\xff\\x7f\\x00\\x00(\\xe3\\\\x03\\x00\\x00\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2628 }, { "timestamp": "2026-05-29 01:05:19,212", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002550" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 2629 }, { "timestamp": "2026-05-29 01:05:19,212", "thread_id": "4696", "caller": "0x7ff79bc8a418", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 0, "id": 2630 }, { "timestamp": "2026-05-29 01:05:19,212", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc686b4", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 2631 }, { "timestamp": "2026-05-29 01:05:19,212", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xe2\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x005\\x18\\xff\\x7f\\x00\\x00(\\xe3\\\\x03\\x00\\x00\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2632 }, { "timestamp": "2026-05-29 01:05:19,212", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002550" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 2633 }, { "timestamp": "2026-05-29 01:05:19,212", "thread_id": "4696", "caller": "0x7ff79bc8a418", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 0, "id": 2634 }, { "timestamp": "2026-05-29 01:05:19,212", "thread_id": "4696", "caller": "0x7ff79bc7a06e", "parentcaller": "0x7ff79bc66f8c", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2635 }, { "timestamp": "2026-05-29 01:05:19,212", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "CLSID\\{56AD4C5D-B908-4F85-8FF1-7940C29B3BCF}\\Instance" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\CLSID\\{56AD4C5D-B908-4F85-8FF1-7940C29B3BCF}\\Instance" } ], "repeated": 0, "id": 2636 }, { "timestamp": "2026-05-29 01:05:19,212", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 2637 }, { "timestamp": "2026-05-29 01:05:19,212", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff58be0000", "arguments": [ { "name": "lpLibFileName", "value": "shell32.dll" }, { "name": "dwFlags", "value": "0x00004000" } ], "repeated": 0, "id": 2638 }, { "timestamp": "2026-05-29 01:05:19,212", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "SHELL32.dll" }, { "name": "ModuleHandle", "value": "0x7fff58be0000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff58c378f0" } ], "repeated": 0, "id": 2639 }, { "timestamp": "2026-05-29 01:05:19,212", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "synchronization", "api": "NtFindAtom", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "AtomName", "value": "{9F4C2855-9F79-4B39-A8D0-E1D42DE1D5F3} 3" }, { "name": "Atom", "value": "0x00000000" } ], "repeated": 0, "id": 2640 }, { "timestamp": "2026-05-29 01:05:19,243", "thread_id": "4696", "caller": "0x7ff79bcbc401", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "Handle", "value": "0x00002550" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2641 }, { "timestamp": "2026-05-29 01:05:19,243", "thread_id": "4696", "caller": "0x7ff79bcbc434", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "ValueName", "value": "IsFeedsAvailable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\IsFeedsAvailable" } ], "repeated": 0, "id": 2642 }, { "timestamp": "2026-05-29 01:05:19,243", "thread_id": "4696", "caller": "0x7ff79bcbc458", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 0, "id": 2643 }, { "timestamp": "2026-05-29 01:05:19,243", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2644 }, { "timestamp": "2026-05-29 01:05:19,243", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2645 }, { "timestamp": "2026-05-29 01:05:19,243", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002550" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2646 }, { "timestamp": "2026-05-29 01:05:19,243", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "ValueName", "value": "HeadlinesOnboardingComplete" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\HeadlinesOnboardingComplete" } ], "repeated": 0, "id": 2647 }, { "timestamp": "2026-05-29 01:05:19,243", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 0, "id": 2648 }, { "timestamp": "2026-05-29 01:05:19,243", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2649 }, { "timestamp": "2026-05-29 01:05:19,243", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2650 }, { "timestamp": "2026-05-29 01:05:19,243", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002550" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2651 }, { "timestamp": "2026-05-29 01:05:19,243", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 2652 }, { "timestamp": "2026-05-29 01:05:19,243", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 0, "id": 2653 }, { "timestamp": "2026-05-29 01:05:19,243", "thread_id": "4696", "caller": "0x7ff79bcbc401", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "Handle", "value": "0x00002550" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2654 }, { "timestamp": "2026-05-29 01:05:19,243", "thread_id": "4696", "caller": "0x7ff79bcbc434", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "ValueName", "value": "IsFeedsAvailable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\IsFeedsAvailable" } ], "repeated": 0, "id": 2655 }, { "timestamp": "2026-05-29 01:05:19,243", "thread_id": "4696", "caller": "0x7ff79bcbc458", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 0, "id": 2656 }, { "timestamp": "2026-05-29 01:05:19,243", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2657 }, { "timestamp": "2026-05-29 01:05:19,243", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2658 }, { "timestamp": "2026-05-29 01:05:19,243", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002550" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2659 }, { "timestamp": "2026-05-29 01:05:19,243", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "ValueName", "value": "HeadlinesOnboardingComplete" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\HeadlinesOnboardingComplete" } ], "repeated": 0, "id": 2660 }, { "timestamp": "2026-05-29 01:05:19,243", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 0, "id": 2661 }, { "timestamp": "2026-05-29 01:05:19,243", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2662 }, { "timestamp": "2026-05-29 01:05:19,243", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2663 }, { "timestamp": "2026-05-29 01:05:19,243", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002550" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2664 }, { "timestamp": "2026-05-29 01:05:19,243", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 2665 }, { "timestamp": "2026-05-29 01:05:19,243", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 0, "id": 2666 }, { "timestamp": "2026-05-29 01:05:19,243", "thread_id": "4696", "caller": "0x7ff79bcbc401", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "Handle", "value": "0x00002550" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2667 }, { "timestamp": "2026-05-29 01:05:19,243", "thread_id": "4696", "caller": "0x7ff79bcbc434", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "ValueName", "value": "IsFeedsAvailable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\IsFeedsAvailable" } ], "repeated": 0, "id": 2668 }, { "timestamp": "2026-05-29 01:05:19,243", "thread_id": "4696", "caller": "0x7ff79bcbc458", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 0, "id": 2669 }, { "timestamp": "2026-05-29 01:05:19,243", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2670 }, { "timestamp": "2026-05-29 01:05:19,243", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2671 }, { "timestamp": "2026-05-29 01:05:19,243", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002550" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2672 }, { "timestamp": "2026-05-29 01:05:19,243", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "ValueName", "value": "HeadlinesOnboardingComplete" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\HeadlinesOnboardingComplete" } ], "repeated": 0, "id": 2673 }, { "timestamp": "2026-05-29 01:05:19,243", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 0, "id": 2674 }, { "timestamp": "2026-05-29 01:05:19,243", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2675 }, { "timestamp": "2026-05-29 01:05:19,243", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2676 }, { "timestamp": "2026-05-29 01:05:19,243", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002550" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2677 }, { "timestamp": "2026-05-29 01:05:19,243", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 2678 }, { "timestamp": "2026-05-29 01:05:19,243", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 0, "id": 2679 }, { "timestamp": "2026-05-29 01:05:19,243", "thread_id": "4696", "caller": "0x7ff79bcbc401", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "Handle", "value": "0x00002550" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2680 }, { "timestamp": "2026-05-29 01:05:19,243", "thread_id": "4696", "caller": "0x7ff79bcbc434", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "ValueName", "value": "IsFeedsAvailable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\IsFeedsAvailable" } ], "repeated": 0, "id": 2681 }, { "timestamp": "2026-05-29 01:05:19,243", "thread_id": "4696", "caller": "0x7ff79bcbc458", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 0, "id": 2682 }, { "timestamp": "2026-05-29 01:05:19,243", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2683 }, { "timestamp": "2026-05-29 01:05:19,243", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2684 }, { "timestamp": "2026-05-29 01:05:19,243", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002550" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2685 }, { "timestamp": "2026-05-29 01:05:19,243", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "ValueName", "value": "HeadlinesOnboardingComplete" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\HeadlinesOnboardingComplete" } ], "repeated": 0, "id": 2686 }, { "timestamp": "2026-05-29 01:05:19,243", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 0, "id": 2687 }, { "timestamp": "2026-05-29 01:05:19,243", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2688 }, { "timestamp": "2026-05-29 01:05:19,243", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2689 }, { "timestamp": "2026-05-29 01:05:19,243", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002550" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2690 }, { "timestamp": "2026-05-29 01:05:19,243", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 2691 }, { "timestamp": "2026-05-29 01:05:19,243", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 0, "id": 2692 }, { "timestamp": "2026-05-29 01:05:19,243", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2693 }, { "timestamp": "2026-05-29 01:05:19,243", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2694 }, { "timestamp": "2026-05-29 01:05:19,243", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002550" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2695 }, { "timestamp": "2026-05-29 01:05:19,243", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 2696 }, { "timestamp": "2026-05-29 01:05:19,243", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 0, "id": 2697 }, { "timestamp": "2026-05-29 01:05:19,243", "thread_id": "4696", "caller": "0x7ff79bc557d2", "parentcaller": "0x7ff79bd1630d", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "TaskbarMonitor" }, { "name": "Atom", "value": "0x0000c045" } ], "repeated": 0, "id": 2698 }, { "timestamp": "2026-05-29 01:05:19,243", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2699 }, { "timestamp": "2026-05-29 01:05:19,243", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2700 }, { "timestamp": "2026-05-29 01:05:19,243", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002550" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2701 }, { "timestamp": "2026-05-29 01:05:19,243", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "ValueName", "value": "ShellFeedsTaskbarContentUpdateMode" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarContentUpdateMode" } ], "repeated": 0, "id": 2702 }, { "timestamp": "2026-05-29 01:05:19,243", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 0, "id": 2703 }, { "timestamp": "2026-05-29 01:05:19,243", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc686b4", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 2704 }, { "timestamp": "2026-05-29 01:05:19,243", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xe2\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x005\\x18\\xff\\x7f\\x00\\x00(\\xe3\\\\x03\\x00\\x00\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2705 }, { "timestamp": "2026-05-29 01:05:19,243", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002550" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 2706 }, { "timestamp": "2026-05-29 01:05:19,243", "thread_id": "4696", "caller": "0x7ff79bc8a418", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 0, "id": 2707 }, { "timestamp": "2026-05-29 01:05:19,243", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc68e6a", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 2, "id": 2708 }, { "timestamp": "2026-05-29 01:05:19,243", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xe2\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x005\\x18\\xff\\x7f\\x00\\x00(\\xe3\\\\x03\\x00\\x00\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2709 }, { "timestamp": "2026-05-29 01:05:19,243", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002550" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 2710 }, { "timestamp": "2026-05-29 01:05:19,243", "thread_id": "4696", "caller": "0x7ff79bc8a418", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 0, "id": 2711 }, { "timestamp": "2026-05-29 01:05:19,243", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc686b4", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 2712 }, { "timestamp": "2026-05-29 01:05:19,243", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xe2\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x005\\x18\\xff\\x7f\\x00\\x00(\\xe3\\\\x03\\x00\\x00\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2713 }, { "timestamp": "2026-05-29 01:05:19,243", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002550" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 2714 }, { "timestamp": "2026-05-29 01:05:19,243", "thread_id": "4696", "caller": "0x7ff79bc8a418", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 0, "id": 2715 }, { "timestamp": "2026-05-29 01:05:19,243", "thread_id": "4696", "caller": "0x7ff79bc7a06e", "parentcaller": "0x7ff79bc66f8c", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2716 }, { "timestamp": "2026-05-29 01:05:19,243", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "CLSID\\{56AD4C5D-B908-4F85-8FF1-7940C29B3BCF}\\Instance" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\CLSID\\{56AD4C5D-B908-4F85-8FF1-7940C29B3BCF}\\Instance" } ], "repeated": 0, "id": 2717 }, { "timestamp": "2026-05-29 01:05:19,243", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 2718 }, { "timestamp": "2026-05-29 01:05:19,243", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff58be0000", "arguments": [ { "name": "lpLibFileName", "value": "shell32.dll" }, { "name": "dwFlags", "value": "0x00004000" } ], "repeated": 0, "id": 2719 }, { "timestamp": "2026-05-29 01:05:19,243", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "SHELL32.dll" }, { "name": "ModuleHandle", "value": "0x7fff58be0000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff58c378f0" } ], "repeated": 0, "id": 2720 }, { "timestamp": "2026-05-29 01:05:19,243", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "synchronization", "api": "NtFindAtom", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "AtomName", "value": "{9F4C2855-9F79-4B39-A8D0-E1D42DE1D5F3} 3" }, { "name": "Atom", "value": "0x00000000" } ], "repeated": 0, "id": 2721 }, { "timestamp": "2026-05-29 01:05:19,258", "thread_id": "4696", "caller": "0x7ff79bcbc401", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "Handle", "value": "0x0000255c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2722 }, { "timestamp": "2026-05-29 01:05:19,258", "thread_id": "4696", "caller": "0x7ff79bcbc434", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000255c" }, { "name": "ValueName", "value": "IsFeedsAvailable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\IsFeedsAvailable" } ], "repeated": 0, "id": 2723 }, { "timestamp": "2026-05-29 01:05:19,258", "thread_id": "4696", "caller": "0x7ff79bcbc458", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000255c" } ], "repeated": 0, "id": 2724 }, { "timestamp": "2026-05-29 01:05:19,258", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2725 }, { "timestamp": "2026-05-29 01:05:19,258", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2726 }, { "timestamp": "2026-05-29 01:05:19,258", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000255c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2727 }, { "timestamp": "2026-05-29 01:05:19,258", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000255c" }, { "name": "ValueName", "value": "HeadlinesOnboardingComplete" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\HeadlinesOnboardingComplete" } ], "repeated": 0, "id": 2728 }, { "timestamp": "2026-05-29 01:05:19,258", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000255c" } ], "repeated": 0, "id": 2729 }, { "timestamp": "2026-05-29 01:05:19,258", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2730 }, { "timestamp": "2026-05-29 01:05:19,258", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2731 }, { "timestamp": "2026-05-29 01:05:19,258", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000255c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2732 }, { "timestamp": "2026-05-29 01:05:19,258", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000255c" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 2733 }, { "timestamp": "2026-05-29 01:05:19,258", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000255c" } ], "repeated": 0, "id": 2734 }, { "timestamp": "2026-05-29 01:05:19,258", "thread_id": "4696", "caller": "0x7ff79bcbc401", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "Handle", "value": "0x0000255c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2735 }, { "timestamp": "2026-05-29 01:05:19,258", "thread_id": "4696", "caller": "0x7ff79bcbc434", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000255c" }, { "name": "ValueName", "value": "IsFeedsAvailable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\IsFeedsAvailable" } ], "repeated": 0, "id": 2736 }, { "timestamp": "2026-05-29 01:05:19,258", "thread_id": "4696", "caller": "0x7ff79bcbc458", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000255c" } ], "repeated": 0, "id": 2737 }, { "timestamp": "2026-05-29 01:05:19,258", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2738 }, { "timestamp": "2026-05-29 01:05:19,258", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2739 }, { "timestamp": "2026-05-29 01:05:19,258", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000255c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2740 }, { "timestamp": "2026-05-29 01:05:19,258", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000255c" }, { "name": "ValueName", "value": "HeadlinesOnboardingComplete" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\HeadlinesOnboardingComplete" } ], "repeated": 0, "id": 2741 }, { "timestamp": "2026-05-29 01:05:19,258", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000255c" } ], "repeated": 0, "id": 2742 }, { "timestamp": "2026-05-29 01:05:19,258", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2743 }, { "timestamp": "2026-05-29 01:05:19,258", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2744 }, { "timestamp": "2026-05-29 01:05:19,258", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000255c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2745 }, { "timestamp": "2026-05-29 01:05:19,258", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000255c" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 2746 }, { "timestamp": "2026-05-29 01:05:19,258", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000255c" } ], "repeated": 0, "id": 2747 }, { "timestamp": "2026-05-29 01:05:19,258", "thread_id": "4696", "caller": "0x7ff79bcbc401", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "Handle", "value": "0x0000255c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2748 }, { "timestamp": "2026-05-29 01:05:19,258", "thread_id": "4696", "caller": "0x7ff79bcbc434", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000255c" }, { "name": "ValueName", "value": "IsFeedsAvailable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\IsFeedsAvailable" } ], "repeated": 0, "id": 2749 }, { "timestamp": "2026-05-29 01:05:19,258", "thread_id": "4696", "caller": "0x7ff79bcbc458", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000255c" } ], "repeated": 0, "id": 2750 }, { "timestamp": "2026-05-29 01:05:19,258", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2751 }, { "timestamp": "2026-05-29 01:05:19,258", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2752 }, { "timestamp": "2026-05-29 01:05:19,258", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000255c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2753 }, { "timestamp": "2026-05-29 01:05:19,258", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000255c" }, { "name": "ValueName", "value": "HeadlinesOnboardingComplete" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\HeadlinesOnboardingComplete" } ], "repeated": 0, "id": 2754 }, { "timestamp": "2026-05-29 01:05:19,258", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000255c" } ], "repeated": 0, "id": 2755 }, { "timestamp": "2026-05-29 01:05:19,258", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2756 }, { "timestamp": "2026-05-29 01:05:19,258", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2757 }, { "timestamp": "2026-05-29 01:05:19,258", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000255c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2758 }, { "timestamp": "2026-05-29 01:05:19,258", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000255c" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 2759 }, { "timestamp": "2026-05-29 01:05:19,258", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000255c" } ], "repeated": 0, "id": 2760 }, { "timestamp": "2026-05-29 01:05:19,258", "thread_id": "4696", "caller": "0x7ff79bcbc401", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "Handle", "value": "0x0000255c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2761 }, { "timestamp": "2026-05-29 01:05:19,258", "thread_id": "4696", "caller": "0x7ff79bcbc434", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000255c" }, { "name": "ValueName", "value": "IsFeedsAvailable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\IsFeedsAvailable" } ], "repeated": 0, "id": 2762 }, { "timestamp": "2026-05-29 01:05:19,258", "thread_id": "4696", "caller": "0x7ff79bcbc458", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000255c" } ], "repeated": 0, "id": 2763 }, { "timestamp": "2026-05-29 01:05:19,258", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2764 }, { "timestamp": "2026-05-29 01:05:19,258", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2765 }, { "timestamp": "2026-05-29 01:05:19,258", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000255c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2766 }, { "timestamp": "2026-05-29 01:05:19,258", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000255c" }, { "name": "ValueName", "value": "HeadlinesOnboardingComplete" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\HeadlinesOnboardingComplete" } ], "repeated": 0, "id": 2767 }, { "timestamp": "2026-05-29 01:05:19,258", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000255c" } ], "repeated": 0, "id": 2768 }, { "timestamp": "2026-05-29 01:05:19,258", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2769 }, { "timestamp": "2026-05-29 01:05:19,258", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2770 }, { "timestamp": "2026-05-29 01:05:19,258", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000255c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2771 }, { "timestamp": "2026-05-29 01:05:19,258", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000255c" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 2772 }, { "timestamp": "2026-05-29 01:05:19,258", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000255c" } ], "repeated": 0, "id": 2773 }, { "timestamp": "2026-05-29 01:05:19,258", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2774 }, { "timestamp": "2026-05-29 01:05:19,258", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2775 }, { "timestamp": "2026-05-29 01:05:19,258", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000255c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2776 }, { "timestamp": "2026-05-29 01:05:19,258", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000255c" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 2777 }, { "timestamp": "2026-05-29 01:05:19,258", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000255c" } ], "repeated": 0, "id": 2778 }, { "timestamp": "2026-05-29 01:05:19,258", "thread_id": "4696", "caller": "0x7ff79bc557d2", "parentcaller": "0x7ff79bd1630d", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "TaskbarMonitor" }, { "name": "Atom", "value": "0x0000c045" } ], "repeated": 0, "id": 2779 }, { "timestamp": "2026-05-29 01:05:19,258", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2780 }, { "timestamp": "2026-05-29 01:05:19,258", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2781 }, { "timestamp": "2026-05-29 01:05:19,258", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000255c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2782 }, { "timestamp": "2026-05-29 01:05:19,258", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000255c" }, { "name": "ValueName", "value": "ShellFeedsTaskbarContentUpdateMode" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarContentUpdateMode" } ], "repeated": 0, "id": 2783 }, { "timestamp": "2026-05-29 01:05:19,258", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000255c" } ], "repeated": 0, "id": 2784 }, { "timestamp": "2026-05-29 01:05:19,258", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc686b4", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 2785 }, { "timestamp": "2026-05-29 01:05:19,258", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xe2\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x005\\x18\\xff\\x7f\\x00\\x00(\\xe3\\\\x03\\x00\\x00\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2786 }, { "timestamp": "2026-05-29 01:05:19,258", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000255c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 2787 }, { "timestamp": "2026-05-29 01:05:19,258", "thread_id": "4696", "caller": "0x7ff79bc8a418", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000255c" } ], "repeated": 0, "id": 2788 }, { "timestamp": "2026-05-29 01:05:19,258", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc68e6a", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 2, "id": 2789 }, { "timestamp": "2026-05-29 01:05:19,258", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xe2\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x005\\x18\\xff\\x7f\\x00\\x00(\\xe3\\\\x03\\x00\\x00\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2790 }, { "timestamp": "2026-05-29 01:05:19,258", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000255c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 2791 }, { "timestamp": "2026-05-29 01:05:19,258", "thread_id": "4696", "caller": "0x7ff79bc8a418", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000255c" } ], "repeated": 0, "id": 2792 }, { "timestamp": "2026-05-29 01:05:19,258", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc686b4", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 2793 }, { "timestamp": "2026-05-29 01:05:19,258", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xe2\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x005\\x18\\xff\\x7f\\x00\\x00(\\xe3\\\\x03\\x00\\x00\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2794 }, { "timestamp": "2026-05-29 01:05:19,258", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000255c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 2795 }, { "timestamp": "2026-05-29 01:05:19,258", "thread_id": "4696", "caller": "0x7ff79bc8a418", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000255c" } ], "repeated": 0, "id": 2796 }, { "timestamp": "2026-05-29 01:05:19,258", "thread_id": "4696", "caller": "0x7ff79bc7a06e", "parentcaller": "0x7ff79bc66f8c", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2797 }, { "timestamp": "2026-05-29 01:05:19,258", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "CLSID\\{56AD4C5D-B908-4F85-8FF1-7940C29B3BCF}\\Instance" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\CLSID\\{56AD4C5D-B908-4F85-8FF1-7940C29B3BCF}\\Instance" } ], "repeated": 0, "id": 2798 }, { "timestamp": "2026-05-29 01:05:19,258", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 2799 }, { "timestamp": "2026-05-29 01:05:19,258", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff58be0000", "arguments": [ { "name": "lpLibFileName", "value": "shell32.dll" }, { "name": "dwFlags", "value": "0x00004000" } ], "repeated": 0, "id": 2800 }, { "timestamp": "2026-05-29 01:05:19,258", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "SHELL32.dll" }, { "name": "ModuleHandle", "value": "0x7fff58be0000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff58c378f0" } ], "repeated": 0, "id": 2801 }, { "timestamp": "2026-05-29 01:05:19,258", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "synchronization", "api": "NtFindAtom", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "AtomName", "value": "{9F4C2855-9F79-4B39-A8D0-E1D42DE1D5F3} 3" }, { "name": "Atom", "value": "0x00000000" } ], "repeated": 0, "id": 2802 }, { "timestamp": "2026-05-29 01:05:19,274", "thread_id": "4696", "caller": "0x7ff79bcbc401", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "Handle", "value": "0x0000256c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2803 }, { "timestamp": "2026-05-29 01:05:19,274", "thread_id": "4696", "caller": "0x7ff79bcbc434", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "ValueName", "value": "IsFeedsAvailable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\IsFeedsAvailable" } ], "repeated": 0, "id": 2804 }, { "timestamp": "2026-05-29 01:05:19,274", "thread_id": "4696", "caller": "0x7ff79bcbc458", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 2805 }, { "timestamp": "2026-05-29 01:05:19,274", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2806 }, { "timestamp": "2026-05-29 01:05:19,274", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2807 }, { "timestamp": "2026-05-29 01:05:19,274", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000256c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2808 }, { "timestamp": "2026-05-29 01:05:19,274", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "ValueName", "value": "HeadlinesOnboardingComplete" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\HeadlinesOnboardingComplete" } ], "repeated": 0, "id": 2809 }, { "timestamp": "2026-05-29 01:05:19,274", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 2810 }, { "timestamp": "2026-05-29 01:05:19,274", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2811 }, { "timestamp": "2026-05-29 01:05:19,274", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2812 }, { "timestamp": "2026-05-29 01:05:19,274", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000256c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2813 }, { "timestamp": "2026-05-29 01:05:19,274", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 2814 }, { "timestamp": "2026-05-29 01:05:19,274", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 2815 }, { "timestamp": "2026-05-29 01:05:19,274", "thread_id": "4696", "caller": "0x7ff79bcbc401", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "Handle", "value": "0x0000256c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2816 }, { "timestamp": "2026-05-29 01:05:19,274", "thread_id": "4696", "caller": "0x7ff79bcbc434", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "ValueName", "value": "IsFeedsAvailable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\IsFeedsAvailable" } ], "repeated": 0, "id": 2817 }, { "timestamp": "2026-05-29 01:05:19,274", "thread_id": "4696", "caller": "0x7ff79bcbc458", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 2818 }, { "timestamp": "2026-05-29 01:05:19,274", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2819 }, { "timestamp": "2026-05-29 01:05:19,274", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2820 }, { "timestamp": "2026-05-29 01:05:19,274", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000256c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2821 }, { "timestamp": "2026-05-29 01:05:19,274", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "ValueName", "value": "HeadlinesOnboardingComplete" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\HeadlinesOnboardingComplete" } ], "repeated": 0, "id": 2822 }, { "timestamp": "2026-05-29 01:05:19,274", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 2823 }, { "timestamp": "2026-05-29 01:05:19,274", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2824 }, { "timestamp": "2026-05-29 01:05:19,274", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2825 }, { "timestamp": "2026-05-29 01:05:19,274", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000256c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2826 }, { "timestamp": "2026-05-29 01:05:19,274", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 2827 }, { "timestamp": "2026-05-29 01:05:19,274", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 2828 }, { "timestamp": "2026-05-29 01:05:19,274", "thread_id": "4696", "caller": "0x7ff79bcbc401", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "Handle", "value": "0x0000256c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2829 }, { "timestamp": "2026-05-29 01:05:19,274", "thread_id": "4696", "caller": "0x7ff79bcbc434", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "ValueName", "value": "IsFeedsAvailable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\IsFeedsAvailable" } ], "repeated": 0, "id": 2830 }, { "timestamp": "2026-05-29 01:05:19,274", "thread_id": "4696", "caller": "0x7ff79bcbc458", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 2831 }, { "timestamp": "2026-05-29 01:05:19,274", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2832 }, { "timestamp": "2026-05-29 01:05:19,274", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2833 }, { "timestamp": "2026-05-29 01:05:19,274", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000256c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2834 }, { "timestamp": "2026-05-29 01:05:19,274", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "ValueName", "value": "HeadlinesOnboardingComplete" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\HeadlinesOnboardingComplete" } ], "repeated": 0, "id": 2835 }, { "timestamp": "2026-05-29 01:05:19,274", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 2836 }, { "timestamp": "2026-05-29 01:05:19,274", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2837 }, { "timestamp": "2026-05-29 01:05:19,274", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2838 }, { "timestamp": "2026-05-29 01:05:19,274", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000256c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2839 }, { "timestamp": "2026-05-29 01:05:19,274", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 2840 }, { "timestamp": "2026-05-29 01:05:19,274", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 2841 }, { "timestamp": "2026-05-29 01:05:19,274", "thread_id": "4696", "caller": "0x7ff79bcbc401", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "Handle", "value": "0x0000256c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2842 }, { "timestamp": "2026-05-29 01:05:19,274", "thread_id": "4696", "caller": "0x7ff79bcbc434", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "ValueName", "value": "IsFeedsAvailable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\IsFeedsAvailable" } ], "repeated": 0, "id": 2843 }, { "timestamp": "2026-05-29 01:05:19,274", "thread_id": "4696", "caller": "0x7ff79bcbc458", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 2844 }, { "timestamp": "2026-05-29 01:05:19,274", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2845 }, { "timestamp": "2026-05-29 01:05:19,274", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2846 }, { "timestamp": "2026-05-29 01:05:19,274", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000256c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2847 }, { "timestamp": "2026-05-29 01:05:19,274", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "ValueName", "value": "HeadlinesOnboardingComplete" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\HeadlinesOnboardingComplete" } ], "repeated": 0, "id": 2848 }, { "timestamp": "2026-05-29 01:05:19,274", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 2849 }, { "timestamp": "2026-05-29 01:05:19,274", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2850 }, { "timestamp": "2026-05-29 01:05:19,274", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2851 }, { "timestamp": "2026-05-29 01:05:19,274", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000256c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2852 }, { "timestamp": "2026-05-29 01:05:19,274", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 2853 }, { "timestamp": "2026-05-29 01:05:19,274", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 2854 }, { "timestamp": "2026-05-29 01:05:19,274", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2855 }, { "timestamp": "2026-05-29 01:05:19,274", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2856 }, { "timestamp": "2026-05-29 01:05:19,274", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000256c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2857 }, { "timestamp": "2026-05-29 01:05:19,274", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 2858 }, { "timestamp": "2026-05-29 01:05:19,274", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 2859 }, { "timestamp": "2026-05-29 01:05:19,274", "thread_id": "4696", "caller": "0x7ff79bc557d2", "parentcaller": "0x7ff79bd1630d", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "TaskbarMonitor" }, { "name": "Atom", "value": "0x0000c045" } ], "repeated": 0, "id": 2860 }, { "timestamp": "2026-05-29 01:05:19,274", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2861 }, { "timestamp": "2026-05-29 01:05:19,274", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2862 }, { "timestamp": "2026-05-29 01:05:19,274", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000256c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2863 }, { "timestamp": "2026-05-29 01:05:19,274", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "ValueName", "value": "ShellFeedsTaskbarContentUpdateMode" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarContentUpdateMode" } ], "repeated": 0, "id": 2864 }, { "timestamp": "2026-05-29 01:05:19,274", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 2865 }, { "timestamp": "2026-05-29 01:05:19,274", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc686b4", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 2866 }, { "timestamp": "2026-05-29 01:05:19,274", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xe2\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x005\\x18\\xff\\x7f\\x00\\x00(\\xe3\\\\x03\\x00\\x00\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2867 }, { "timestamp": "2026-05-29 01:05:19,274", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000256c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 2868 }, { "timestamp": "2026-05-29 01:05:19,274", "thread_id": "4696", "caller": "0x7ff79bc8a418", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 2869 }, { "timestamp": "2026-05-29 01:05:19,274", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc68e6a", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 2, "id": 2870 }, { "timestamp": "2026-05-29 01:05:19,274", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xe2\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x005\\x18\\xff\\x7f\\x00\\x00(\\xe3\\\\x03\\x00\\x00\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2871 }, { "timestamp": "2026-05-29 01:05:19,274", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000256c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 2872 }, { "timestamp": "2026-05-29 01:05:19,274", "thread_id": "4696", "caller": "0x7ff79bc8a418", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 2873 }, { "timestamp": "2026-05-29 01:05:19,274", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc686b4", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 2874 }, { "timestamp": "2026-05-29 01:05:19,274", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xe2\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x005\\x18\\xff\\x7f\\x00\\x00(\\xe3\\\\x03\\x00\\x00\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2875 }, { "timestamp": "2026-05-29 01:05:19,274", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000256c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 2876 }, { "timestamp": "2026-05-29 01:05:19,274", "thread_id": "4696", "caller": "0x7ff79bc8a418", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 2877 }, { "timestamp": "2026-05-29 01:05:19,274", "thread_id": "4696", "caller": "0x7ff79bc7a06e", "parentcaller": "0x7ff79bc66f8c", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2878 }, { "timestamp": "2026-05-29 01:05:19,274", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "CLSID\\{56AD4C5D-B908-4F85-8FF1-7940C29B3BCF}\\Instance" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\CLSID\\{56AD4C5D-B908-4F85-8FF1-7940C29B3BCF}\\Instance" } ], "repeated": 0, "id": 2879 }, { "timestamp": "2026-05-29 01:05:19,274", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 2880 }, { "timestamp": "2026-05-29 01:05:19,274", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff58be0000", "arguments": [ { "name": "lpLibFileName", "value": "shell32.dll" }, { "name": "dwFlags", "value": "0x00004000" } ], "repeated": 0, "id": 2881 }, { "timestamp": "2026-05-29 01:05:19,274", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "SHELL32.dll" }, { "name": "ModuleHandle", "value": "0x7fff58be0000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff58c378f0" } ], "repeated": 0, "id": 2882 }, { "timestamp": "2026-05-29 01:05:19,274", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "synchronization", "api": "NtFindAtom", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "AtomName", "value": "{9F4C2855-9F79-4B39-A8D0-E1D42DE1D5F3} 3" }, { "name": "Atom", "value": "0x00000000" } ], "repeated": 0, "id": 2883 }, { "timestamp": "2026-05-29 01:05:19,290", "thread_id": "6156", "caller": "0x7ff79bc521d5", "parentcaller": "0x7ff79bc4f770", "category": "system", "api": "GetLastInputInfo", "status": true, "return": "0x00000001", "arguments": [], "repeated": 0, "id": 2884 }, { "timestamp": "2026-05-29 01:05:19,290", "thread_id": "6156", "caller": "0x7ff79bc521fe", "parentcaller": "0x7ff79bc4f770", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000254c" } ], "repeated": 0, "id": 2885 }, { "timestamp": "2026-05-29 01:05:19,290", "thread_id": "6156", "caller": "0x7ff79bc521fe", "parentcaller": "0x7ff79bc4f770", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 0, "id": 2886 }, { "timestamp": "2026-05-29 01:05:19,290", "thread_id": "6156", "caller": "0x7ff79bc521fe", "parentcaller": "0x7ff79bc4f770", "category": "device", "api": "NtPowerInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "InformationLevel", "value": "16" }, { "name": "InputBuffer", "value": "" }, { "name": "OutputBuffer", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2887 }, { "timestamp": "2026-05-29 01:05:19,290", "thread_id": "6156", "caller": "0x7ff79bc521fe", "parentcaller": "0x7ff79bc4f770", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 0, "id": 2888 }, { "timestamp": "2026-05-29 01:05:19,290", "thread_id": "4696", "caller": "0x7ff79bcbc401", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "Handle", "value": "0x00002544" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2889 }, { "timestamp": "2026-05-29 01:05:19,290", "thread_id": "4696", "caller": "0x7ff79bcbc434", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002544" }, { "name": "ValueName", "value": "IsFeedsAvailable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\IsFeedsAvailable" } ], "repeated": 0, "id": 2890 }, { "timestamp": "2026-05-29 01:05:19,290", "thread_id": "4696", "caller": "0x7ff79bcbc458", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002544" } ], "repeated": 0, "id": 2891 }, { "timestamp": "2026-05-29 01:05:19,290", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2892 }, { "timestamp": "2026-05-29 01:05:19,290", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2893 }, { "timestamp": "2026-05-29 01:05:19,290", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002544" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2894 }, { "timestamp": "2026-05-29 01:05:19,290", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002544" }, { "name": "ValueName", "value": "HeadlinesOnboardingComplete" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\HeadlinesOnboardingComplete" } ], "repeated": 0, "id": 2895 }, { "timestamp": "2026-05-29 01:05:19,290", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002544" } ], "repeated": 0, "id": 2896 }, { "timestamp": "2026-05-29 01:05:19,290", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2897 }, { "timestamp": "2026-05-29 01:05:19,290", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2898 }, { "timestamp": "2026-05-29 01:05:19,290", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002544" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2899 }, { "timestamp": "2026-05-29 01:05:19,290", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002544" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 2900 }, { "timestamp": "2026-05-29 01:05:19,290", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002544" } ], "repeated": 0, "id": 2901 }, { "timestamp": "2026-05-29 01:05:19,290", "thread_id": "4696", "caller": "0x7ff79bcbc401", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "Handle", "value": "0x00002544" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2902 }, { "timestamp": "2026-05-29 01:05:19,290", "thread_id": "4696", "caller": "0x7ff79bcbc434", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002544" }, { "name": "ValueName", "value": "IsFeedsAvailable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\IsFeedsAvailable" } ], "repeated": 0, "id": 2903 }, { "timestamp": "2026-05-29 01:05:19,290", "thread_id": "4696", "caller": "0x7ff79bcbc458", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002544" } ], "repeated": 0, "id": 2904 }, { "timestamp": "2026-05-29 01:05:19,290", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2905 }, { "timestamp": "2026-05-29 01:05:19,290", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2906 }, { "timestamp": "2026-05-29 01:05:19,290", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002544" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2907 }, { "timestamp": "2026-05-29 01:05:19,290", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002544" }, { "name": "ValueName", "value": "HeadlinesOnboardingComplete" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\HeadlinesOnboardingComplete" } ], "repeated": 0, "id": 2908 }, { "timestamp": "2026-05-29 01:05:19,290", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002544" } ], "repeated": 0, "id": 2909 }, { "timestamp": "2026-05-29 01:05:19,290", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2910 }, { "timestamp": "2026-05-29 01:05:19,290", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2911 }, { "timestamp": "2026-05-29 01:05:19,290", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002544" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2912 }, { "timestamp": "2026-05-29 01:05:19,290", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002544" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 2913 }, { "timestamp": "2026-05-29 01:05:19,290", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002544" } ], "repeated": 0, "id": 2914 }, { "timestamp": "2026-05-29 01:05:19,290", "thread_id": "4696", "caller": "0x7ff79bcbc401", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "Handle", "value": "0x00002544" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2915 }, { "timestamp": "2026-05-29 01:05:19,290", "thread_id": "4696", "caller": "0x7ff79bcbc434", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002544" }, { "name": "ValueName", "value": "IsFeedsAvailable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\IsFeedsAvailable" } ], "repeated": 0, "id": 2916 }, { "timestamp": "2026-05-29 01:05:19,290", "thread_id": "4696", "caller": "0x7ff79bcbc458", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002544" } ], "repeated": 0, "id": 2917 }, { "timestamp": "2026-05-29 01:05:19,290", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2918 }, { "timestamp": "2026-05-29 01:05:19,290", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2919 }, { "timestamp": "2026-05-29 01:05:19,290", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002544" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2920 }, { "timestamp": "2026-05-29 01:05:19,290", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002544" }, { "name": "ValueName", "value": "HeadlinesOnboardingComplete" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\HeadlinesOnboardingComplete" } ], "repeated": 0, "id": 2921 }, { "timestamp": "2026-05-29 01:05:19,290", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002544" } ], "repeated": 0, "id": 2922 }, { "timestamp": "2026-05-29 01:05:19,290", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2923 }, { "timestamp": "2026-05-29 01:05:19,290", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2924 }, { "timestamp": "2026-05-29 01:05:19,290", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002544" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2925 }, { "timestamp": "2026-05-29 01:05:19,290", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002544" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 2926 }, { "timestamp": "2026-05-29 01:05:19,290", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002544" } ], "repeated": 0, "id": 2927 }, { "timestamp": "2026-05-29 01:05:19,290", "thread_id": "4696", "caller": "0x7ff79bcbc401", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "Handle", "value": "0x00002544" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2928 }, { "timestamp": "2026-05-29 01:05:19,290", "thread_id": "4696", "caller": "0x7ff79bcbc434", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002544" }, { "name": "ValueName", "value": "IsFeedsAvailable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\IsFeedsAvailable" } ], "repeated": 0, "id": 2929 }, { "timestamp": "2026-05-29 01:05:19,290", "thread_id": "4696", "caller": "0x7ff79bcbc458", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002544" } ], "repeated": 0, "id": 2930 }, { "timestamp": "2026-05-29 01:05:19,290", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2931 }, { "timestamp": "2026-05-29 01:05:19,290", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2932 }, { "timestamp": "2026-05-29 01:05:19,290", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002544" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2933 }, { "timestamp": "2026-05-29 01:05:19,290", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002544" }, { "name": "ValueName", "value": "HeadlinesOnboardingComplete" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\HeadlinesOnboardingComplete" } ], "repeated": 0, "id": 2934 }, { "timestamp": "2026-05-29 01:05:19,290", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002544" } ], "repeated": 0, "id": 2935 }, { "timestamp": "2026-05-29 01:05:19,290", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2936 }, { "timestamp": "2026-05-29 01:05:19,290", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2937 }, { "timestamp": "2026-05-29 01:05:19,290", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002544" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2938 }, { "timestamp": "2026-05-29 01:05:19,290", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002544" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 2939 }, { "timestamp": "2026-05-29 01:05:19,290", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002544" } ], "repeated": 0, "id": 2940 }, { "timestamp": "2026-05-29 01:05:19,290", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2941 }, { "timestamp": "2026-05-29 01:05:19,290", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2942 }, { "timestamp": "2026-05-29 01:05:19,290", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002544" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2943 }, { "timestamp": "2026-05-29 01:05:19,290", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002544" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 2944 }, { "timestamp": "2026-05-29 01:05:19,290", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002544" } ], "repeated": 0, "id": 2945 }, { "timestamp": "2026-05-29 01:05:19,290", "thread_id": "4696", "caller": "0x7ff79bc557d2", "parentcaller": "0x7ff79bd1630d", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "TaskbarMonitor" }, { "name": "Atom", "value": "0x0000c045" } ], "repeated": 0, "id": 2946 }, { "timestamp": "2026-05-29 01:05:19,290", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2947 }, { "timestamp": "2026-05-29 01:05:19,290", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2948 }, { "timestamp": "2026-05-29 01:05:19,290", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002544" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2949 }, { "timestamp": "2026-05-29 01:05:19,290", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002544" }, { "name": "ValueName", "value": "ShellFeedsTaskbarContentUpdateMode" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarContentUpdateMode" } ], "repeated": 0, "id": 2950 }, { "timestamp": "2026-05-29 01:05:19,290", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002544" } ], "repeated": 0, "id": 2951 }, { "timestamp": "2026-05-29 01:05:19,290", "thread_id": "4696", "caller": "0x7ff79bc76bd8", "parentcaller": "0x7ff79bc8a0c8", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00010110" }, { "name": "Message", "value": "0x0000c028" } ], "repeated": 1, "id": 2952 }, { "timestamp": "2026-05-29 01:05:19,290", "thread_id": "5000", "caller": "0x7fff57fc2eeb", "parentcaller": "0x7fff581ba00f", "category": "synchronization", "api": "NtFindAtom", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "AtomName", "value": "Windows.Internal.Shell.Holographic.Win32PortedView" }, { "name": "Atom", "value": "0x00000000" } ], "repeated": 0, "id": 2953 }, { "timestamp": "2026-05-29 01:05:19,290", "thread_id": "4696", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00010110" }, { "name": "Message", "value": "0x0000c028" } ], "repeated": 0, "id": 2954 }, { "timestamp": "2026-05-29 01:05:19,290", "thread_id": "5000", "caller": "0x7fff57fc2eeb", "parentcaller": "0x7fff581ba00f", "category": "synchronization", "api": "NtFindAtom", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "AtomName", "value": "Windows.Internal.Shell.Holographic.Win32PortedView" }, { "name": "Atom", "value": "0x00000000" } ], "repeated": 0, "id": 2955 }, { "timestamp": "2026-05-29 01:05:19,290", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc686b4", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 2956 }, { "timestamp": "2026-05-29 01:05:19,290", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xe2\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x005\\x18\\xff\\x7f\\x00\\x00(\\xe3\\\\x03\\x00\\x00\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2957 }, { "timestamp": "2026-05-29 01:05:19,290", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000256c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 2958 }, { "timestamp": "2026-05-29 01:05:19,290", "thread_id": "4696", "caller": "0x7ff79bc8a418", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 2959 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc68e6a", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 2960 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff455848a6", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002544" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "11652" }, { "name": "ProcessName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe" } ], "repeated": 0, "id": 2961 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "5000", "caller": "0x7fff5781026b", "parentcaller": "0x7fff45584920", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002544" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000252c" } ], "repeated": 0, "id": 2962 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "5000", "caller": "0x7fff45584c45", "parentcaller": "0x7fff45584941", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2963 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "5000", "caller": "0x7fff45584ce5", "parentcaller": "0x7fff45584941", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\xa0\\xff\\xa8\\x0c\\x00\\x00\\x00\\x00\\x1c\\x00\\x1c\\x00\\x00\\x00\\x00\\x00@\\x00\\xa9\\x0c\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\x00\\xa9\\x0c\\x00\\x00\\x00\\x00\\x12\\x00\\x12\\x00\\x00\\x00\\x00\\x00t\\x01\\xa9\\x0c\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x01\\xa9\\x0c\\x00\\x00\\x00\\x00\\x1e\\x00\\x1e\\x00\\x00\\x00\\x00\\x00\\x90\\x01\\xa9\\x0c\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\x01\\xa9\\x0c\\x00\\x00\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00\\xb8\\x01\\xa9\\x0c\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd8\\x01\\xa9\\x0c\\x00\\x00\\x00\\x00W\\x00I\\x00N\\x00:\\x00/\\x00/\\x00S\\x00Y\\x00S\\x00A\\x00P\\x00P\\x00I\\x00D\\x00\\x00\\x00\\x00\\x00\\x86\\x00\\x86\\x00\\x00\\x00\\x00\\x00\\x90\\x00\\xa9\\x0c\\x00\\x00\\x00\\x00\\x06\\x00\\x06\\x00\\x00\\x00\\x00\\x00\\x16\\x01\\xa9\\x0c\\x00\\x00\\x00\\x00X\\x00X\\x00\\x00\\x00\\x00\\x00\\x1c\\x01\\xa9\\x0c\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2964 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff45584956", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000252c" } ], "repeated": 0, "id": 2965 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff45584ab8", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002544" } ], "repeated": 0, "id": 2966 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "5000", "caller": "0x7fff57fc2eeb", "parentcaller": "0x7fff581ba00f", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "MultimonitorActivationException" }, { "name": "Atom", "value": "0x0000c049" } ], "repeated": 0, "id": 2967 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc690f2", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 2968 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "5000", "caller": "0x7fff57fc2eeb", "parentcaller": "0x7fff581ba00f", "category": "synchronization", "api": "NtFindAtom", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "AtomName", "value": "Windows.Internal.Shell.Holographic.Win32PortedView" }, { "name": "Atom", "value": "0x00000000" } ], "repeated": 1, "id": 2969 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff455848a6", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002438" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "11652" }, { "name": "ProcessName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe" } ], "repeated": 0, "id": 2970 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "5000", "caller": "0x7fff5781026b", "parentcaller": "0x7fff45584920", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002438" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00001ab0" } ], "repeated": 0, "id": 2971 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "5000", "caller": "0x7fff45584c45", "parentcaller": "0x7fff45584941", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2972 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "5000", "caller": "0x7fff45584ce5", "parentcaller": "0x7fff45584941", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\xa0\\xff\\xa8\\x0c\\x00\\x00\\x00\\x00\\x1c\\x00\\x1c\\x00\\x00\\x00\\x00\\x00@\\x00\\xa9\\x0c\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\x00\\xa9\\x0c\\x00\\x00\\x00\\x00\\x12\\x00\\x12\\x00\\x00\\x00\\x00\\x00t\\x01\\xa9\\x0c\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x01\\xa9\\x0c\\x00\\x00\\x00\\x00\\x1e\\x00\\x1e\\x00\\x00\\x00\\x00\\x00\\x90\\x01\\xa9\\x0c\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\x01\\xa9\\x0c\\x00\\x00\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00\\xb8\\x01\\xa9\\x0c\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd8\\x01\\xa9\\x0c\\x00\\x00\\x00\\x00W\\x00I\\x00N\\x00:\\x00/\\x00/\\x00S\\x00Y\\x00S\\x00A\\x00P\\x00P\\x00I\\x00D\\x00\\x00\\x00\\x00\\x00\\x86\\x00\\x86\\x00\\x00\\x00\\x00\\x00\\x90\\x00\\xa9\\x0c\\x00\\x00\\x00\\x00\\x06\\x00\\x06\\x00\\x00\\x00\\x00\\x00\\x16\\x01\\xa9\\x0c\\x00\\x00\\x00\\x00X\\x00X\\x00\\x00\\x00\\x00\\x00\\x1c\\x01\\xa9\\x0c\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2973 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff45584956", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" } ], "repeated": 0, "id": 2974 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc686b4", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 2975 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff45584ab8", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 2976 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 2977 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xe2\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x005\\x18\\xff\\x7f\\x00\\x00(\\xe3\\\\x03\\x00\\x00\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2978 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "5000", "caller": "0x7fff57fc2eeb", "parentcaller": "0x7fff581ba00f", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "MultimonitorActivationException" }, { "name": "Atom", "value": "0x0000c049" } ], "repeated": 0, "id": 2979 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab0" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 2980 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "4696", "caller": "0x7ff79bc8a418", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" } ], "repeated": 0, "id": 2981 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 2982 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc686b4", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 2983 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xe2\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x005\\x18\\xff\\x7f\\x00\\x00(\\xe3\\\\x03\\x00\\x00\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2984 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab0" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 2985 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "4696", "caller": "0x7ff79bc8a418", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" } ], "repeated": 0, "id": 2986 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "4696", "caller": "0x7ff79bc7a06e", "parentcaller": "0x7ff79bc66f8c", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2987 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "CLSID\\{56AD4C5D-B908-4F85-8FF1-7940C29B3BCF}\\Instance" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\CLSID\\{56AD4C5D-B908-4F85-8FF1-7940C29B3BCF}\\Instance" } ], "repeated": 0, "id": 2988 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 2989 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff58be0000", "arguments": [ { "name": "lpLibFileName", "value": "shell32.dll" }, { "name": "dwFlags", "value": "0x00004000" } ], "repeated": 0, "id": 2990 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "SHELL32.dll" }, { "name": "ModuleHandle", "value": "0x7fff58be0000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff58c378f0" } ], "repeated": 0, "id": 2991 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "synchronization", "api": "NtFindAtom", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "AtomName", "value": "{9F4C2855-9F79-4B39-A8D0-E1D42DE1D5F3} 3" }, { "name": "Atom", "value": "0x00000000" } ], "repeated": 0, "id": 2992 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "4696", "caller": "0x7ff79bcbc401", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "Handle", "value": "0x00002438" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2993 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "4696", "caller": "0x7ff79bcbc434", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "IsFeedsAvailable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\IsFeedsAvailable" } ], "repeated": 0, "id": 2994 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "4696", "caller": "0x7ff79bcbc458", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 2995 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2996 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2997 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002438" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 2998 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "HeadlinesOnboardingComplete" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\HeadlinesOnboardingComplete" } ], "repeated": 0, "id": 2999 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 3000 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3001 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3002 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002438" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3003 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 3004 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 3005 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "4696", "caller": "0x7ff79bcbc401", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "Handle", "value": "0x00002438" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3006 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "4696", "caller": "0x7ff79bcbc434", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "IsFeedsAvailable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\IsFeedsAvailable" } ], "repeated": 0, "id": 3007 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "4696", "caller": "0x7ff79bcbc458", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 3008 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3009 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3010 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002438" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3011 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "HeadlinesOnboardingComplete" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\HeadlinesOnboardingComplete" } ], "repeated": 0, "id": 3012 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 3013 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3014 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3015 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002438" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3016 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 3017 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 3018 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "4696", "caller": "0x7ff79bcbc401", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "Handle", "value": "0x00002438" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3019 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "4696", "caller": "0x7ff79bcbc434", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "IsFeedsAvailable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\IsFeedsAvailable" } ], "repeated": 0, "id": 3020 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "4696", "caller": "0x7ff79bcbc458", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 3021 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3022 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3023 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002438" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3024 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "HeadlinesOnboardingComplete" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\HeadlinesOnboardingComplete" } ], "repeated": 0, "id": 3025 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 3026 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3027 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3028 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002438" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3029 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 3030 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 3031 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "4696", "caller": "0x7ff79bcbc401", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "Handle", "value": "0x00002438" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3032 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "4696", "caller": "0x7ff79bcbc434", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "IsFeedsAvailable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\IsFeedsAvailable" } ], "repeated": 0, "id": 3033 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "4696", "caller": "0x7ff79bcbc458", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 3034 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3035 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3036 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002438" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3037 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "HeadlinesOnboardingComplete" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\HeadlinesOnboardingComplete" } ], "repeated": 0, "id": 3038 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 3039 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3040 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3041 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002438" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3042 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 3043 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 3044 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3045 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3046 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002438" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3047 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 3048 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 3049 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "4696", "caller": "0x7ff79bc557d2", "parentcaller": "0x7ff79bd1630d", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "TaskbarMonitor" }, { "name": "Atom", "value": "0x0000c045" } ], "repeated": 0, "id": 3050 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3051 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3052 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002438" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3053 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "ShellFeedsTaskbarContentUpdateMode" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarContentUpdateMode" } ], "repeated": 0, "id": 3054 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 3055 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc686b4", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 3056 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xe2\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x005\\x18\\xff\\x7f\\x00\\x00(\\xe3\\\\x03\\x00\\x00\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3057 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002438" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 3058 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "4696", "caller": "0x7ff79bc8a418", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 3059 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc68e6a", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 2, "id": 3060 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xe2\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x005\\x18\\xff\\x7f\\x00\\x00(\\xe3\\\\x03\\x00\\x00\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3061 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002438" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 3062 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "4696", "caller": "0x7ff79bc8a418", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 3063 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc686b4", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 3064 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xe2\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x005\\x18\\xff\\x7f\\x00\\x00(\\xe3\\\\x03\\x00\\x00\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3065 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002438" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 3066 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "4696", "caller": "0x7ff79bc8a418", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 3067 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "4696", "caller": "0x7ff79bc7a06e", "parentcaller": "0x7ff79bc66f8c", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 3068 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "CLSID\\{56AD4C5D-B908-4F85-8FF1-7940C29B3BCF}\\Instance" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\CLSID\\{56AD4C5D-B908-4F85-8FF1-7940C29B3BCF}\\Instance" } ], "repeated": 0, "id": 3069 }, { "timestamp": "2026-05-29 01:05:19,305", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 3070 }, { "timestamp": "2026-05-29 01:05:19,321", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff58be0000", "arguments": [ { "name": "lpLibFileName", "value": "shell32.dll" }, { "name": "dwFlags", "value": "0x00004000" } ], "repeated": 0, "id": 3071 }, { "timestamp": "2026-05-29 01:05:19,321", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "SHELL32.dll" }, { "name": "ModuleHandle", "value": "0x7fff58be0000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff58c378f0" } ], "repeated": 0, "id": 3072 }, { "timestamp": "2026-05-29 01:05:19,321", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "synchronization", "api": "NtFindAtom", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "AtomName", "value": "{9F4C2855-9F79-4B39-A8D0-E1D42DE1D5F3} 3" }, { "name": "Atom", "value": "0x00000000" } ], "repeated": 0, "id": 3073 }, { "timestamp": "2026-05-29 01:05:19,321", "thread_id": "4696", "caller": "0x7ff79bcbc401", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "Handle", "value": "0x0000256c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3074 }, { "timestamp": "2026-05-29 01:05:19,321", "thread_id": "4696", "caller": "0x7ff79bcbc434", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "ValueName", "value": "IsFeedsAvailable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\IsFeedsAvailable" } ], "repeated": 0, "id": 3075 }, { "timestamp": "2026-05-29 01:05:19,321", "thread_id": "4696", "caller": "0x7ff79bcbc458", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 3076 }, { "timestamp": "2026-05-29 01:05:19,321", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3077 }, { "timestamp": "2026-05-29 01:05:19,321", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3078 }, { "timestamp": "2026-05-29 01:05:19,321", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000256c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3079 }, { "timestamp": "2026-05-29 01:05:19,321", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "ValueName", "value": "HeadlinesOnboardingComplete" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\HeadlinesOnboardingComplete" } ], "repeated": 0, "id": 3080 }, { "timestamp": "2026-05-29 01:05:19,321", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 3081 }, { "timestamp": "2026-05-29 01:05:19,321", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3082 }, { "timestamp": "2026-05-29 01:05:19,321", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3083 }, { "timestamp": "2026-05-29 01:05:19,321", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000256c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3084 }, { "timestamp": "2026-05-29 01:05:19,321", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 3085 }, { "timestamp": "2026-05-29 01:05:19,321", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 3086 }, { "timestamp": "2026-05-29 01:05:19,321", "thread_id": "4696", "caller": "0x7ff79bcbc401", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "Handle", "value": "0x0000256c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3087 }, { "timestamp": "2026-05-29 01:05:19,321", "thread_id": "4696", "caller": "0x7ff79bcbc434", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "ValueName", "value": "IsFeedsAvailable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\IsFeedsAvailable" } ], "repeated": 0, "id": 3088 }, { "timestamp": "2026-05-29 01:05:19,321", "thread_id": "4696", "caller": "0x7ff79bcbc458", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 3089 }, { "timestamp": "2026-05-29 01:05:19,321", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3090 }, { "timestamp": "2026-05-29 01:05:19,321", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3091 }, { "timestamp": "2026-05-29 01:05:19,321", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000256c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3092 }, { "timestamp": "2026-05-29 01:05:19,321", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "ValueName", "value": "HeadlinesOnboardingComplete" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\HeadlinesOnboardingComplete" } ], "repeated": 0, "id": 3093 }, { "timestamp": "2026-05-29 01:05:19,321", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 3094 }, { "timestamp": "2026-05-29 01:05:19,321", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3095 }, { "timestamp": "2026-05-29 01:05:19,321", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3096 }, { "timestamp": "2026-05-29 01:05:19,321", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000256c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3097 }, { "timestamp": "2026-05-29 01:05:19,321", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 3098 }, { "timestamp": "2026-05-29 01:05:19,321", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 3099 }, { "timestamp": "2026-05-29 01:05:19,321", "thread_id": "4696", "caller": "0x7ff79bcbc401", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "Handle", "value": "0x0000256c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3100 }, { "timestamp": "2026-05-29 01:05:19,321", "thread_id": "4696", "caller": "0x7ff79bcbc434", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "ValueName", "value": "IsFeedsAvailable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\IsFeedsAvailable" } ], "repeated": 0, "id": 3101 }, { "timestamp": "2026-05-29 01:05:19,321", "thread_id": "4696", "caller": "0x7ff79bcbc458", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 3102 }, { "timestamp": "2026-05-29 01:05:19,321", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3103 }, { "timestamp": "2026-05-29 01:05:19,321", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3104 }, { "timestamp": "2026-05-29 01:05:19,321", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000256c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3105 }, { "timestamp": "2026-05-29 01:05:19,321", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "ValueName", "value": "HeadlinesOnboardingComplete" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\HeadlinesOnboardingComplete" } ], "repeated": 0, "id": 3106 }, { "timestamp": "2026-05-29 01:05:19,321", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 3107 }, { "timestamp": "2026-05-29 01:05:19,321", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3108 }, { "timestamp": "2026-05-29 01:05:19,321", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3109 }, { "timestamp": "2026-05-29 01:05:19,321", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000256c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3110 }, { "timestamp": "2026-05-29 01:05:19,321", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 3111 }, { "timestamp": "2026-05-29 01:05:19,321", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 3112 }, { "timestamp": "2026-05-29 01:05:19,321", "thread_id": "4696", "caller": "0x7ff79bcbc401", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "Handle", "value": "0x0000256c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3113 }, { "timestamp": "2026-05-29 01:05:19,321", "thread_id": "4696", "caller": "0x7ff79bcbc434", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "ValueName", "value": "IsFeedsAvailable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\IsFeedsAvailable" } ], "repeated": 0, "id": 3114 }, { "timestamp": "2026-05-29 01:05:19,321", "thread_id": "4696", "caller": "0x7ff79bcbc458", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 3115 }, { "timestamp": "2026-05-29 01:05:19,321", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3116 }, { "timestamp": "2026-05-29 01:05:19,321", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3117 }, { "timestamp": "2026-05-29 01:05:19,321", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000256c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3118 }, { "timestamp": "2026-05-29 01:05:19,321", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "ValueName", "value": "HeadlinesOnboardingComplete" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\HeadlinesOnboardingComplete" } ], "repeated": 0, "id": 3119 }, { "timestamp": "2026-05-29 01:05:19,321", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 3120 }, { "timestamp": "2026-05-29 01:05:19,321", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3121 }, { "timestamp": "2026-05-29 01:05:19,321", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3122 }, { "timestamp": "2026-05-29 01:05:19,321", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000256c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3123 }, { "timestamp": "2026-05-29 01:05:19,321", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 3124 }, { "timestamp": "2026-05-29 01:05:19,321", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 3125 }, { "timestamp": "2026-05-29 01:05:19,321", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3126 }, { "timestamp": "2026-05-29 01:05:19,321", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3127 }, { "timestamp": "2026-05-29 01:05:19,321", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000256c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3128 }, { "timestamp": "2026-05-29 01:05:19,321", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 3129 }, { "timestamp": "2026-05-29 01:05:19,321", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 3130 }, { "timestamp": "2026-05-29 01:05:19,321", "thread_id": "4696", "caller": "0x7ff79bc557d2", "parentcaller": "0x7ff79bd1630d", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "TaskbarMonitor" }, { "name": "Atom", "value": "0x0000c045" } ], "repeated": 0, "id": 3131 }, { "timestamp": "2026-05-29 01:05:19,321", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3132 }, { "timestamp": "2026-05-29 01:05:19,321", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3133 }, { "timestamp": "2026-05-29 01:05:19,321", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000256c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3134 }, { "timestamp": "2026-05-29 01:05:19,321", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "ValueName", "value": "ShellFeedsTaskbarContentUpdateMode" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarContentUpdateMode" } ], "repeated": 0, "id": 3135 }, { "timestamp": "2026-05-29 01:05:19,321", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 3136 }, { "timestamp": "2026-05-29 01:05:19,321", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc686b4", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 3137 }, { "timestamp": "2026-05-29 01:05:19,321", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xe2\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x005\\x18\\xff\\x7f\\x00\\x00(\\xe3\\\\x03\\x00\\x00\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3138 }, { "timestamp": "2026-05-29 01:05:19,321", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000256c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 3139 }, { "timestamp": "2026-05-29 01:05:19,321", "thread_id": "4696", "caller": "0x7ff79bc8a418", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 3140 }, { "timestamp": "2026-05-29 01:05:19,321", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc68e6a", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 2, "id": 3141 }, { "timestamp": "2026-05-29 01:05:19,321", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xe2\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x005\\x18\\xff\\x7f\\x00\\x00(\\xe3\\\\x03\\x00\\x00\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3142 }, { "timestamp": "2026-05-29 01:05:19,321", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000256c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 3143 }, { "timestamp": "2026-05-29 01:05:19,321", "thread_id": "4696", "caller": "0x7ff79bc8a418", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 3144 }, { "timestamp": "2026-05-29 01:05:19,321", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc686b4", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 3145 }, { "timestamp": "2026-05-29 01:05:19,321", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xe2\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x005\\x18\\xff\\x7f\\x00\\x00(\\xe3\\\\x03\\x00\\x00\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3146 }, { "timestamp": "2026-05-29 01:05:19,321", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000256c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 3147 }, { "timestamp": "2026-05-29 01:05:19,321", "thread_id": "4696", "caller": "0x7ff79bc8a418", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 3148 }, { "timestamp": "2026-05-29 01:05:19,337", "thread_id": "4696", "caller": "0x7ff79bc7a06e", "parentcaller": "0x7ff79bc66f8c", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 3149 }, { "timestamp": "2026-05-29 01:05:19,337", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "CLSID\\{56AD4C5D-B908-4F85-8FF1-7940C29B3BCF}\\Instance" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\CLSID\\{56AD4C5D-B908-4F85-8FF1-7940C29B3BCF}\\Instance" } ], "repeated": 0, "id": 3150 }, { "timestamp": "2026-05-29 01:05:19,337", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 3151 }, { "timestamp": "2026-05-29 01:05:19,337", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff58be0000", "arguments": [ { "name": "lpLibFileName", "value": "shell32.dll" }, { "name": "dwFlags", "value": "0x00004000" } ], "repeated": 0, "id": 3152 }, { "timestamp": "2026-05-29 01:05:19,337", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "SHELL32.dll" }, { "name": "ModuleHandle", "value": "0x7fff58be0000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff58c378f0" } ], "repeated": 0, "id": 3153 }, { "timestamp": "2026-05-29 01:05:19,337", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "synchronization", "api": "NtFindAtom", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "AtomName", "value": "{9F4C2855-9F79-4B39-A8D0-E1D42DE1D5F3} 3" }, { "name": "Atom", "value": "0x00000000" } ], "repeated": 0, "id": 3154 }, { "timestamp": "2026-05-29 01:05:19,337", "thread_id": "4696", "caller": "0x7ff79bcbc401", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "Handle", "value": "0x00002438" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3155 }, { "timestamp": "2026-05-29 01:05:19,337", "thread_id": "4696", "caller": "0x7ff79bcbc434", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "IsFeedsAvailable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\IsFeedsAvailable" } ], "repeated": 0, "id": 3156 }, { "timestamp": "2026-05-29 01:05:19,337", "thread_id": "4696", "caller": "0x7ff79bcbc458", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 3157 }, { "timestamp": "2026-05-29 01:05:19,337", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3158 }, { "timestamp": "2026-05-29 01:05:19,337", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3159 }, { "timestamp": "2026-05-29 01:05:19,337", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002438" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3160 }, { "timestamp": "2026-05-29 01:05:19,337", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "HeadlinesOnboardingComplete" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\HeadlinesOnboardingComplete" } ], "repeated": 0, "id": 3161 }, { "timestamp": "2026-05-29 01:05:19,337", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 3162 }, { "timestamp": "2026-05-29 01:05:19,337", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3163 }, { "timestamp": "2026-05-29 01:05:19,337", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3164 }, { "timestamp": "2026-05-29 01:05:19,337", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002438" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3165 }, { "timestamp": "2026-05-29 01:05:19,337", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 3166 }, { "timestamp": "2026-05-29 01:05:19,337", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 3167 }, { "timestamp": "2026-05-29 01:05:19,337", "thread_id": "4696", "caller": "0x7ff79bcbc401", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "Handle", "value": "0x00002438" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3168 }, { "timestamp": "2026-05-29 01:05:19,337", "thread_id": "4696", "caller": "0x7ff79bcbc434", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "IsFeedsAvailable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\IsFeedsAvailable" } ], "repeated": 0, "id": 3169 }, { "timestamp": "2026-05-29 01:05:19,337", "thread_id": "4696", "caller": "0x7ff79bcbc458", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 3170 }, { "timestamp": "2026-05-29 01:05:19,337", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3171 }, { "timestamp": "2026-05-29 01:05:19,337", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3172 }, { "timestamp": "2026-05-29 01:05:19,337", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002438" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3173 }, { "timestamp": "2026-05-29 01:05:19,337", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "HeadlinesOnboardingComplete" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\HeadlinesOnboardingComplete" } ], "repeated": 0, "id": 3174 }, { "timestamp": "2026-05-29 01:05:19,337", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 3175 }, { "timestamp": "2026-05-29 01:05:19,337", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3176 }, { "timestamp": "2026-05-29 01:05:19,337", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3177 }, { "timestamp": "2026-05-29 01:05:19,337", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002438" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3178 }, { "timestamp": "2026-05-29 01:05:19,337", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 3179 }, { "timestamp": "2026-05-29 01:05:19,337", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 3180 }, { "timestamp": "2026-05-29 01:05:19,337", "thread_id": "4696", "caller": "0x7ff79bcbc401", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "Handle", "value": "0x00002438" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3181 }, { "timestamp": "2026-05-29 01:05:19,337", "thread_id": "4696", "caller": "0x7ff79bcbc434", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "IsFeedsAvailable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\IsFeedsAvailable" } ], "repeated": 0, "id": 3182 }, { "timestamp": "2026-05-29 01:05:19,337", "thread_id": "4696", "caller": "0x7ff79bcbc458", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 3183 }, { "timestamp": "2026-05-29 01:05:19,337", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3184 }, { "timestamp": "2026-05-29 01:05:19,337", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3185 }, { "timestamp": "2026-05-29 01:05:19,337", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002438" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3186 }, { "timestamp": "2026-05-29 01:05:19,337", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "HeadlinesOnboardingComplete" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\HeadlinesOnboardingComplete" } ], "repeated": 0, "id": 3187 }, { "timestamp": "2026-05-29 01:05:19,337", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 3188 }, { "timestamp": "2026-05-29 01:05:19,337", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3189 }, { "timestamp": "2026-05-29 01:05:19,337", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3190 }, { "timestamp": "2026-05-29 01:05:19,337", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002438" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3191 }, { "timestamp": "2026-05-29 01:05:19,337", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 3192 }, { "timestamp": "2026-05-29 01:05:19,337", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 3193 }, { "timestamp": "2026-05-29 01:05:19,337", "thread_id": "4696", "caller": "0x7ff79bcbc401", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "Handle", "value": "0x00002438" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3194 }, { "timestamp": "2026-05-29 01:05:19,337", "thread_id": "4696", "caller": "0x7ff79bcbc434", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "IsFeedsAvailable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\IsFeedsAvailable" } ], "repeated": 0, "id": 3195 }, { "timestamp": "2026-05-29 01:05:19,337", "thread_id": "4696", "caller": "0x7ff79bcbc458", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 3196 }, { "timestamp": "2026-05-29 01:05:19,337", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3197 }, { "timestamp": "2026-05-29 01:05:19,337", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3198 }, { "timestamp": "2026-05-29 01:05:19,337", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002438" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3199 }, { "timestamp": "2026-05-29 01:05:19,337", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "HeadlinesOnboardingComplete" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\HeadlinesOnboardingComplete" } ], "repeated": 0, "id": 3200 }, { "timestamp": "2026-05-29 01:05:19,337", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 3201 }, { "timestamp": "2026-05-29 01:05:19,337", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3202 }, { "timestamp": "2026-05-29 01:05:19,337", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3203 }, { "timestamp": "2026-05-29 01:05:19,337", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002438" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3204 }, { "timestamp": "2026-05-29 01:05:19,337", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 3205 }, { "timestamp": "2026-05-29 01:05:19,337", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 3206 }, { "timestamp": "2026-05-29 01:05:19,337", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3207 }, { "timestamp": "2026-05-29 01:05:19,337", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3208 }, { "timestamp": "2026-05-29 01:05:19,337", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002438" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3209 }, { "timestamp": "2026-05-29 01:05:19,337", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 3210 }, { "timestamp": "2026-05-29 01:05:19,337", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 3211 }, { "timestamp": "2026-05-29 01:05:19,337", "thread_id": "4696", "caller": "0x7ff79bc557d2", "parentcaller": "0x7ff79bd1630d", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "TaskbarMonitor" }, { "name": "Atom", "value": "0x0000c045" } ], "repeated": 0, "id": 3212 }, { "timestamp": "2026-05-29 01:05:19,337", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3213 }, { "timestamp": "2026-05-29 01:05:19,337", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3214 }, { "timestamp": "2026-05-29 01:05:19,337", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002438" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3215 }, { "timestamp": "2026-05-29 01:05:19,337", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "ShellFeedsTaskbarContentUpdateMode" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarContentUpdateMode" } ], "repeated": 0, "id": 3216 }, { "timestamp": "2026-05-29 01:05:19,337", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 3217 }, { "timestamp": "2026-05-29 01:05:19,337", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc686b4", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 3218 }, { "timestamp": "2026-05-29 01:05:19,337", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xe2\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x005\\x18\\xff\\x7f\\x00\\x00(\\xe3\\\\x03\\x00\\x00\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3219 }, { "timestamp": "2026-05-29 01:05:19,337", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002438" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 3220 }, { "timestamp": "2026-05-29 01:05:19,337", "thread_id": "4696", "caller": "0x7ff79bc8a418", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 3221 }, { "timestamp": "2026-05-29 01:05:19,337", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc68e6a", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 2, "id": 3222 }, { "timestamp": "2026-05-29 01:05:19,337", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xe2\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x005\\x18\\xff\\x7f\\x00\\x00(\\xe3\\\\x03\\x00\\x00\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3223 }, { "timestamp": "2026-05-29 01:05:19,337", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002438" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 3224 }, { "timestamp": "2026-05-29 01:05:19,337", "thread_id": "4696", "caller": "0x7ff79bc8a418", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 3225 }, { "timestamp": "2026-05-29 01:05:19,337", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc686b4", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 3226 }, { "timestamp": "2026-05-29 01:05:19,337", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xe2\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x005\\x18\\xff\\x7f\\x00\\x00(\\xe3\\\\x03\\x00\\x00\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3227 }, { "timestamp": "2026-05-29 01:05:19,337", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002438" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 3228 }, { "timestamp": "2026-05-29 01:05:19,337", "thread_id": "4696", "caller": "0x7ff79bc8a418", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 3229 }, { "timestamp": "2026-05-29 01:05:19,352", "thread_id": "4696", "caller": "0x7ff79bc7a06e", "parentcaller": "0x7ff79bc66f8c", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 3230 }, { "timestamp": "2026-05-29 01:05:19,352", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "CLSID\\{56AD4C5D-B908-4F85-8FF1-7940C29B3BCF}\\Instance" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\CLSID\\{56AD4C5D-B908-4F85-8FF1-7940C29B3BCF}\\Instance" } ], "repeated": 0, "id": 3231 }, { "timestamp": "2026-05-29 01:05:19,352", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 3232 }, { "timestamp": "2026-05-29 01:05:19,352", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff58be0000", "arguments": [ { "name": "lpLibFileName", "value": "shell32.dll" }, { "name": "dwFlags", "value": "0x00004000" } ], "repeated": 0, "id": 3233 }, { "timestamp": "2026-05-29 01:05:19,352", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "SHELL32.dll" }, { "name": "ModuleHandle", "value": "0x7fff58be0000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff58c378f0" } ], "repeated": 0, "id": 3234 }, { "timestamp": "2026-05-29 01:05:19,352", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "synchronization", "api": "NtFindAtom", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "AtomName", "value": "{9F4C2855-9F79-4B39-A8D0-E1D42DE1D5F3} 3" }, { "name": "Atom", "value": "0x00000000" } ], "repeated": 0, "id": 3235 }, { "timestamp": "2026-05-29 01:05:19,352", "thread_id": "4696", "caller": "0x7ff79bcbc401", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "Handle", "value": "0x0000256c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3236 }, { "timestamp": "2026-05-29 01:05:19,352", "thread_id": "4696", "caller": "0x7ff79bcbc434", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "ValueName", "value": "IsFeedsAvailable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\IsFeedsAvailable" } ], "repeated": 0, "id": 3237 }, { "timestamp": "2026-05-29 01:05:19,352", "thread_id": "4696", "caller": "0x7ff79bcbc458", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 3238 }, { "timestamp": "2026-05-29 01:05:19,352", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3239 }, { "timestamp": "2026-05-29 01:05:19,352", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3240 }, { "timestamp": "2026-05-29 01:05:19,352", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000256c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3241 }, { "timestamp": "2026-05-29 01:05:19,352", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "ValueName", "value": "HeadlinesOnboardingComplete" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\HeadlinesOnboardingComplete" } ], "repeated": 0, "id": 3242 }, { "timestamp": "2026-05-29 01:05:19,352", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 3243 }, { "timestamp": "2026-05-29 01:05:19,352", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3244 }, { "timestamp": "2026-05-29 01:05:19,352", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3245 }, { "timestamp": "2026-05-29 01:05:19,352", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000256c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3246 }, { "timestamp": "2026-05-29 01:05:19,352", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 3247 }, { "timestamp": "2026-05-29 01:05:19,352", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 3248 }, { "timestamp": "2026-05-29 01:05:19,352", "thread_id": "4696", "caller": "0x7ff79bcbc401", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "Handle", "value": "0x0000256c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3249 }, { "timestamp": "2026-05-29 01:05:19,352", "thread_id": "4696", "caller": "0x7ff79bcbc434", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "ValueName", "value": "IsFeedsAvailable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\IsFeedsAvailable" } ], "repeated": 0, "id": 3250 }, { "timestamp": "2026-05-29 01:05:19,352", "thread_id": "4696", "caller": "0x7ff79bcbc458", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 3251 }, { "timestamp": "2026-05-29 01:05:19,352", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3252 }, { "timestamp": "2026-05-29 01:05:19,352", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3253 }, { "timestamp": "2026-05-29 01:05:19,352", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000256c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3254 }, { "timestamp": "2026-05-29 01:05:19,352", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "ValueName", "value": "HeadlinesOnboardingComplete" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\HeadlinesOnboardingComplete" } ], "repeated": 0, "id": 3255 }, { "timestamp": "2026-05-29 01:05:19,352", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 3256 }, { "timestamp": "2026-05-29 01:05:19,352", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3257 }, { "timestamp": "2026-05-29 01:05:19,352", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3258 }, { "timestamp": "2026-05-29 01:05:19,352", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000256c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3259 }, { "timestamp": "2026-05-29 01:05:19,352", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 3260 }, { "timestamp": "2026-05-29 01:05:19,352", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 3261 }, { "timestamp": "2026-05-29 01:05:19,352", "thread_id": "4696", "caller": "0x7ff79bcbc401", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "Handle", "value": "0x0000256c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3262 }, { "timestamp": "2026-05-29 01:05:19,352", "thread_id": "4696", "caller": "0x7ff79bcbc434", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "ValueName", "value": "IsFeedsAvailable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\IsFeedsAvailable" } ], "repeated": 0, "id": 3263 }, { "timestamp": "2026-05-29 01:05:19,352", "thread_id": "4696", "caller": "0x7ff79bcbc458", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 3264 }, { "timestamp": "2026-05-29 01:05:19,352", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3265 }, { "timestamp": "2026-05-29 01:05:19,352", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3266 }, { "timestamp": "2026-05-29 01:05:19,352", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000256c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3267 }, { "timestamp": "2026-05-29 01:05:19,352", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "ValueName", "value": "HeadlinesOnboardingComplete" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\HeadlinesOnboardingComplete" } ], "repeated": 0, "id": 3268 }, { "timestamp": "2026-05-29 01:05:19,352", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 3269 }, { "timestamp": "2026-05-29 01:05:19,352", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3270 }, { "timestamp": "2026-05-29 01:05:19,352", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3271 }, { "timestamp": "2026-05-29 01:05:19,352", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000256c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3272 }, { "timestamp": "2026-05-29 01:05:19,352", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 3273 }, { "timestamp": "2026-05-29 01:05:19,352", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 3274 }, { "timestamp": "2026-05-29 01:05:19,352", "thread_id": "4696", "caller": "0x7ff79bcbc401", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "Handle", "value": "0x0000256c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3275 }, { "timestamp": "2026-05-29 01:05:19,352", "thread_id": "4696", "caller": "0x7ff79bcbc434", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "ValueName", "value": "IsFeedsAvailable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\IsFeedsAvailable" } ], "repeated": 0, "id": 3276 }, { "timestamp": "2026-05-29 01:05:19,352", "thread_id": "4696", "caller": "0x7ff79bcbc458", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 3277 }, { "timestamp": "2026-05-29 01:05:19,352", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3278 }, { "timestamp": "2026-05-29 01:05:19,352", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3279 }, { "timestamp": "2026-05-29 01:05:19,352", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000256c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3280 }, { "timestamp": "2026-05-29 01:05:19,352", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "ValueName", "value": "HeadlinesOnboardingComplete" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\HeadlinesOnboardingComplete" } ], "repeated": 0, "id": 3281 }, { "timestamp": "2026-05-29 01:05:19,352", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 3282 }, { "timestamp": "2026-05-29 01:05:19,352", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3283 }, { "timestamp": "2026-05-29 01:05:19,352", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3284 }, { "timestamp": "2026-05-29 01:05:19,352", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000256c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3285 }, { "timestamp": "2026-05-29 01:05:19,352", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 3286 }, { "timestamp": "2026-05-29 01:05:19,352", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 3287 }, { "timestamp": "2026-05-29 01:05:19,352", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3288 }, { "timestamp": "2026-05-29 01:05:19,352", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3289 }, { "timestamp": "2026-05-29 01:05:19,352", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000256c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3290 }, { "timestamp": "2026-05-29 01:05:19,352", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 3291 }, { "timestamp": "2026-05-29 01:05:19,352", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 3292 }, { "timestamp": "2026-05-29 01:05:19,352", "thread_id": "4696", "caller": "0x7ff79bc557d2", "parentcaller": "0x7ff79bd1630d", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "TaskbarMonitor" }, { "name": "Atom", "value": "0x0000c045" } ], "repeated": 0, "id": 3293 }, { "timestamp": "2026-05-29 01:05:19,352", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3294 }, { "timestamp": "2026-05-29 01:05:19,352", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3295 }, { "timestamp": "2026-05-29 01:05:19,352", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000256c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3296 }, { "timestamp": "2026-05-29 01:05:19,352", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "ValueName", "value": "ShellFeedsTaskbarContentUpdateMode" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarContentUpdateMode" } ], "repeated": 0, "id": 3297 }, { "timestamp": "2026-05-29 01:05:19,352", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 3298 }, { "timestamp": "2026-05-29 01:05:19,352", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc686b4", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 3299 }, { "timestamp": "2026-05-29 01:05:19,352", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xe2\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x005\\x18\\xff\\x7f\\x00\\x00(\\xe3\\\\x03\\x00\\x00\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3300 }, { "timestamp": "2026-05-29 01:05:19,352", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000256c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 3301 }, { "timestamp": "2026-05-29 01:05:19,352", "thread_id": "4696", "caller": "0x7ff79bc8a418", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 3302 }, { "timestamp": "2026-05-29 01:05:19,352", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc68e6a", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 2, "id": 3303 }, { "timestamp": "2026-05-29 01:05:19,352", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xe2\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x005\\x18\\xff\\x7f\\x00\\x00(\\xe3\\\\x03\\x00\\x00\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3304 }, { "timestamp": "2026-05-29 01:05:19,352", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000256c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 3305 }, { "timestamp": "2026-05-29 01:05:19,352", "thread_id": "4696", "caller": "0x7ff79bc8a418", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 3306 }, { "timestamp": "2026-05-29 01:05:19,352", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc686b4", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 3307 }, { "timestamp": "2026-05-29 01:05:19,352", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xe2\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x005\\x18\\xff\\x7f\\x00\\x00(\\xe3\\\\x03\\x00\\x00\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3308 }, { "timestamp": "2026-05-29 01:05:19,352", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000256c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 3309 }, { "timestamp": "2026-05-29 01:05:19,352", "thread_id": "4696", "caller": "0x7ff79bc8a418", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 3310 }, { "timestamp": "2026-05-29 01:05:19,368", "thread_id": "4696", "caller": "0x7ff79bc7a06e", "parentcaller": "0x7ff79bc66f8c", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 3311 }, { "timestamp": "2026-05-29 01:05:19,368", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "CLSID\\{56AD4C5D-B908-4F85-8FF1-7940C29B3BCF}\\Instance" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\CLSID\\{56AD4C5D-B908-4F85-8FF1-7940C29B3BCF}\\Instance" } ], "repeated": 0, "id": 3312 }, { "timestamp": "2026-05-29 01:05:19,368", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 3313 }, { "timestamp": "2026-05-29 01:05:19,368", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff58be0000", "arguments": [ { "name": "lpLibFileName", "value": "shell32.dll" }, { "name": "dwFlags", "value": "0x00004000" } ], "repeated": 0, "id": 3314 }, { "timestamp": "2026-05-29 01:05:19,368", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "SHELL32.dll" }, { "name": "ModuleHandle", "value": "0x7fff58be0000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff58c378f0" } ], "repeated": 0, "id": 3315 }, { "timestamp": "2026-05-29 01:05:19,368", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "synchronization", "api": "NtFindAtom", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "AtomName", "value": "{9F4C2855-9F79-4B39-A8D0-E1D42DE1D5F3} 3" }, { "name": "Atom", "value": "0x00000000" } ], "repeated": 0, "id": 3316 }, { "timestamp": "2026-05-29 01:05:19,383", "thread_id": "4696", "caller": "0x7ff79bcbc401", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "Handle", "value": "0x00002438" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3317 }, { "timestamp": "2026-05-29 01:05:19,383", "thread_id": "4696", "caller": "0x7ff79bcbc434", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "IsFeedsAvailable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\IsFeedsAvailable" } ], "repeated": 0, "id": 3318 }, { "timestamp": "2026-05-29 01:05:19,383", "thread_id": "4696", "caller": "0x7ff79bcbc458", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 3319 }, { "timestamp": "2026-05-29 01:05:19,383", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3320 }, { "timestamp": "2026-05-29 01:05:19,383", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3321 }, { "timestamp": "2026-05-29 01:05:19,383", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002438" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3322 }, { "timestamp": "2026-05-29 01:05:19,383", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "HeadlinesOnboardingComplete" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\HeadlinesOnboardingComplete" } ], "repeated": 0, "id": 3323 }, { "timestamp": "2026-05-29 01:05:19,383", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 3324 }, { "timestamp": "2026-05-29 01:05:19,383", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3325 }, { "timestamp": "2026-05-29 01:05:19,383", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3326 }, { "timestamp": "2026-05-29 01:05:19,383", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002438" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3327 }, { "timestamp": "2026-05-29 01:05:19,383", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 3328 }, { "timestamp": "2026-05-29 01:05:19,383", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 3329 }, { "timestamp": "2026-05-29 01:05:19,383", "thread_id": "4696", "caller": "0x7ff79bcbc401", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "Handle", "value": "0x00002438" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3330 }, { "timestamp": "2026-05-29 01:05:19,383", "thread_id": "4696", "caller": "0x7ff79bcbc434", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "IsFeedsAvailable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\IsFeedsAvailable" } ], "repeated": 0, "id": 3331 }, { "timestamp": "2026-05-29 01:05:19,383", "thread_id": "4696", "caller": "0x7ff79bcbc458", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 3332 }, { "timestamp": "2026-05-29 01:05:19,383", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3333 }, { "timestamp": "2026-05-29 01:05:19,383", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3334 }, { "timestamp": "2026-05-29 01:05:19,383", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002438" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3335 }, { "timestamp": "2026-05-29 01:05:19,383", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "HeadlinesOnboardingComplete" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\HeadlinesOnboardingComplete" } ], "repeated": 0, "id": 3336 }, { "timestamp": "2026-05-29 01:05:19,383", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 3337 }, { "timestamp": "2026-05-29 01:05:19,383", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3338 }, { "timestamp": "2026-05-29 01:05:19,383", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3339 }, { "timestamp": "2026-05-29 01:05:19,383", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002438" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3340 }, { "timestamp": "2026-05-29 01:05:19,383", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 3341 }, { "timestamp": "2026-05-29 01:05:19,383", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 3342 }, { "timestamp": "2026-05-29 01:05:19,383", "thread_id": "4696", "caller": "0x7ff79bcbc401", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "Handle", "value": "0x00002438" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3343 }, { "timestamp": "2026-05-29 01:05:19,383", "thread_id": "4696", "caller": "0x7ff79bcbc434", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "IsFeedsAvailable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\IsFeedsAvailable" } ], "repeated": 0, "id": 3344 }, { "timestamp": "2026-05-29 01:05:19,383", "thread_id": "4696", "caller": "0x7ff79bcbc458", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 3345 }, { "timestamp": "2026-05-29 01:05:19,383", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3346 }, { "timestamp": "2026-05-29 01:05:19,383", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3347 }, { "timestamp": "2026-05-29 01:05:19,383", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002438" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3348 }, { "timestamp": "2026-05-29 01:05:19,383", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "HeadlinesOnboardingComplete" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\HeadlinesOnboardingComplete" } ], "repeated": 0, "id": 3349 }, { "timestamp": "2026-05-29 01:05:19,383", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 3350 }, { "timestamp": "2026-05-29 01:05:19,383", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3351 }, { "timestamp": "2026-05-29 01:05:19,383", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3352 }, { "timestamp": "2026-05-29 01:05:19,383", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002438" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3353 }, { "timestamp": "2026-05-29 01:05:19,383", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 3354 }, { "timestamp": "2026-05-29 01:05:19,383", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 3355 }, { "timestamp": "2026-05-29 01:05:19,383", "thread_id": "4696", "caller": "0x7ff79bcbc401", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "Handle", "value": "0x00002438" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3356 }, { "timestamp": "2026-05-29 01:05:19,383", "thread_id": "4696", "caller": "0x7ff79bcbc434", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "IsFeedsAvailable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\IsFeedsAvailable" } ], "repeated": 0, "id": 3357 }, { "timestamp": "2026-05-29 01:05:19,383", "thread_id": "4696", "caller": "0x7ff79bcbc458", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 3358 }, { "timestamp": "2026-05-29 01:05:19,383", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3359 }, { "timestamp": "2026-05-29 01:05:19,383", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3360 }, { "timestamp": "2026-05-29 01:05:19,383", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002438" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3361 }, { "timestamp": "2026-05-29 01:05:19,383", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "HeadlinesOnboardingComplete" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\HeadlinesOnboardingComplete" } ], "repeated": 0, "id": 3362 }, { "timestamp": "2026-05-29 01:05:19,383", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 3363 }, { "timestamp": "2026-05-29 01:05:19,383", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3364 }, { "timestamp": "2026-05-29 01:05:19,383", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3365 }, { "timestamp": "2026-05-29 01:05:19,383", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002438" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3366 }, { "timestamp": "2026-05-29 01:05:19,383", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 3367 }, { "timestamp": "2026-05-29 01:05:19,383", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 3368 }, { "timestamp": "2026-05-29 01:05:19,383", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3369 }, { "timestamp": "2026-05-29 01:05:19,383", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3370 }, { "timestamp": "2026-05-29 01:05:19,383", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002438" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3371 }, { "timestamp": "2026-05-29 01:05:19,383", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 3372 }, { "timestamp": "2026-05-29 01:05:19,383", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 3373 }, { "timestamp": "2026-05-29 01:05:19,383", "thread_id": "4696", "caller": "0x7ff79bc557d2", "parentcaller": "0x7ff79bd1630d", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "TaskbarMonitor" }, { "name": "Atom", "value": "0x0000c045" } ], "repeated": 0, "id": 3374 }, { "timestamp": "2026-05-29 01:05:19,383", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3375 }, { "timestamp": "2026-05-29 01:05:19,383", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3376 }, { "timestamp": "2026-05-29 01:05:19,383", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002438" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3377 }, { "timestamp": "2026-05-29 01:05:19,383", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "ShellFeedsTaskbarContentUpdateMode" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarContentUpdateMode" } ], "repeated": 0, "id": 3378 }, { "timestamp": "2026-05-29 01:05:19,383", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 3379 }, { "timestamp": "2026-05-29 01:05:19,383", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc686b4", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 3380 }, { "timestamp": "2026-05-29 01:05:19,383", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xe2\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x005\\x18\\xff\\x7f\\x00\\x00(\\xe3\\\\x03\\x00\\x00\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3381 }, { "timestamp": "2026-05-29 01:05:19,383", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002438" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 3382 }, { "timestamp": "2026-05-29 01:05:19,383", "thread_id": "4696", "caller": "0x7ff79bc8a418", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 3383 }, { "timestamp": "2026-05-29 01:05:19,383", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc68e6a", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 2, "id": 3384 }, { "timestamp": "2026-05-29 01:05:19,383", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xe2\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x005\\x18\\xff\\x7f\\x00\\x00(\\xe3\\\\x03\\x00\\x00\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3385 }, { "timestamp": "2026-05-29 01:05:19,383", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002438" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 3386 }, { "timestamp": "2026-05-29 01:05:19,383", "thread_id": "4696", "caller": "0x7ff79bc8a418", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 3387 }, { "timestamp": "2026-05-29 01:05:19,383", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc686b4", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 3388 }, { "timestamp": "2026-05-29 01:05:19,383", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xe2\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x005\\x18\\xff\\x7f\\x00\\x00(\\xe3\\\\x03\\x00\\x00\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3389 }, { "timestamp": "2026-05-29 01:05:19,383", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002438" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 3390 }, { "timestamp": "2026-05-29 01:05:19,383", "thread_id": "4696", "caller": "0x7ff79bc8a418", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 3391 }, { "timestamp": "2026-05-29 01:05:19,383", "thread_id": "4696", "caller": "0x7ff79bc7a06e", "parentcaller": "0x7ff79bc66f8c", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 3392 }, { "timestamp": "2026-05-29 01:05:19,383", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "CLSID\\{56AD4C5D-B908-4F85-8FF1-7940C29B3BCF}\\Instance" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\CLSID\\{56AD4C5D-B908-4F85-8FF1-7940C29B3BCF}\\Instance" } ], "repeated": 0, "id": 3393 }, { "timestamp": "2026-05-29 01:05:19,383", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 3394 }, { "timestamp": "2026-05-29 01:05:19,383", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff58be0000", "arguments": [ { "name": "lpLibFileName", "value": "shell32.dll" }, { "name": "dwFlags", "value": "0x00004000" } ], "repeated": 0, "id": 3395 }, { "timestamp": "2026-05-29 01:05:19,383", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "SHELL32.dll" }, { "name": "ModuleHandle", "value": "0x7fff58be0000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff58c378f0" } ], "repeated": 0, "id": 3396 }, { "timestamp": "2026-05-29 01:05:19,383", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "synchronization", "api": "NtFindAtom", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "AtomName", "value": "{9F4C2855-9F79-4B39-A8D0-E1D42DE1D5F3} 3" }, { "name": "Atom", "value": "0x00000000" } ], "repeated": 0, "id": 3397 }, { "timestamp": "2026-05-29 01:05:19,399", "thread_id": "4696", "caller": "0x7ff79bcbc401", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "Handle", "value": "0x00002438" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3398 }, { "timestamp": "2026-05-29 01:05:19,399", "thread_id": "4696", "caller": "0x7ff79bcbc434", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "IsFeedsAvailable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\IsFeedsAvailable" } ], "repeated": 0, "id": 3399 }, { "timestamp": "2026-05-29 01:05:19,399", "thread_id": "4696", "caller": "0x7ff79bcbc458", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 3400 }, { "timestamp": "2026-05-29 01:05:19,399", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3401 }, { "timestamp": "2026-05-29 01:05:19,399", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3402 }, { "timestamp": "2026-05-29 01:05:19,399", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002438" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3403 }, { "timestamp": "2026-05-29 01:05:19,399", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "HeadlinesOnboardingComplete" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\HeadlinesOnboardingComplete" } ], "repeated": 0, "id": 3404 }, { "timestamp": "2026-05-29 01:05:19,399", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 3405 }, { "timestamp": "2026-05-29 01:05:19,399", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3406 }, { "timestamp": "2026-05-29 01:05:19,399", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3407 }, { "timestamp": "2026-05-29 01:05:19,399", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002438" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3408 }, { "timestamp": "2026-05-29 01:05:19,399", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 3409 }, { "timestamp": "2026-05-29 01:05:19,399", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 3410 }, { "timestamp": "2026-05-29 01:05:19,399", "thread_id": "4696", "caller": "0x7ff79bcbc401", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "Handle", "value": "0x00002438" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3411 }, { "timestamp": "2026-05-29 01:05:19,399", "thread_id": "4696", "caller": "0x7ff79bcbc434", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "IsFeedsAvailable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\IsFeedsAvailable" } ], "repeated": 0, "id": 3412 }, { "timestamp": "2026-05-29 01:05:19,399", "thread_id": "4696", "caller": "0x7ff79bcbc458", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 3413 }, { "timestamp": "2026-05-29 01:05:19,399", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3414 }, { "timestamp": "2026-05-29 01:05:19,399", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3415 }, { "timestamp": "2026-05-29 01:05:19,399", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002438" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3416 }, { "timestamp": "2026-05-29 01:05:19,399", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "HeadlinesOnboardingComplete" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\HeadlinesOnboardingComplete" } ], "repeated": 0, "id": 3417 }, { "timestamp": "2026-05-29 01:05:19,399", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 3418 }, { "timestamp": "2026-05-29 01:05:19,399", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3419 }, { "timestamp": "2026-05-29 01:05:19,399", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3420 }, { "timestamp": "2026-05-29 01:05:19,399", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002438" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3421 }, { "timestamp": "2026-05-29 01:05:19,399", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 3422 }, { "timestamp": "2026-05-29 01:05:19,399", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 3423 }, { "timestamp": "2026-05-29 01:05:19,399", "thread_id": "4696", "caller": "0x7ff79bcbc401", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "Handle", "value": "0x00002438" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3424 }, { "timestamp": "2026-05-29 01:05:19,399", "thread_id": "4696", "caller": "0x7ff79bcbc434", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "IsFeedsAvailable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\IsFeedsAvailable" } ], "repeated": 0, "id": 3425 }, { "timestamp": "2026-05-29 01:05:19,399", "thread_id": "4696", "caller": "0x7ff79bcbc458", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 3426 }, { "timestamp": "2026-05-29 01:05:19,399", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3427 }, { "timestamp": "2026-05-29 01:05:19,399", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3428 }, { "timestamp": "2026-05-29 01:05:19,399", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002438" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3429 }, { "timestamp": "2026-05-29 01:05:19,399", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "HeadlinesOnboardingComplete" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\HeadlinesOnboardingComplete" } ], "repeated": 0, "id": 3430 }, { "timestamp": "2026-05-29 01:05:19,399", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 3431 }, { "timestamp": "2026-05-29 01:05:19,399", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3432 }, { "timestamp": "2026-05-29 01:05:19,399", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3433 }, { "timestamp": "2026-05-29 01:05:19,399", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002438" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3434 }, { "timestamp": "2026-05-29 01:05:19,399", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 3435 }, { "timestamp": "2026-05-29 01:05:19,399", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 3436 }, { "timestamp": "2026-05-29 01:05:19,399", "thread_id": "4696", "caller": "0x7ff79bcbc401", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "Handle", "value": "0x00002438" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3437 }, { "timestamp": "2026-05-29 01:05:19,399", "thread_id": "4696", "caller": "0x7ff79bcbc434", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "IsFeedsAvailable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\IsFeedsAvailable" } ], "repeated": 0, "id": 3438 }, { "timestamp": "2026-05-29 01:05:19,399", "thread_id": "4696", "caller": "0x7ff79bcbc458", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 3439 }, { "timestamp": "2026-05-29 01:05:19,399", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3440 }, { "timestamp": "2026-05-29 01:05:19,399", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3441 }, { "timestamp": "2026-05-29 01:05:19,399", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002438" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3442 }, { "timestamp": "2026-05-29 01:05:19,399", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "HeadlinesOnboardingComplete" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\HeadlinesOnboardingComplete" } ], "repeated": 0, "id": 3443 }, { "timestamp": "2026-05-29 01:05:19,399", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 3444 }, { "timestamp": "2026-05-29 01:05:19,399", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3445 }, { "timestamp": "2026-05-29 01:05:19,399", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3446 }, { "timestamp": "2026-05-29 01:05:19,399", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002438" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3447 }, { "timestamp": "2026-05-29 01:05:19,399", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 3448 }, { "timestamp": "2026-05-29 01:05:19,399", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 3449 }, { "timestamp": "2026-05-29 01:05:19,399", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3450 }, { "timestamp": "2026-05-29 01:05:19,399", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3451 }, { "timestamp": "2026-05-29 01:05:19,399", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002438" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3452 }, { "timestamp": "2026-05-29 01:05:19,399", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 3453 }, { "timestamp": "2026-05-29 01:05:19,399", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 3454 }, { "timestamp": "2026-05-29 01:05:19,399", "thread_id": "4696", "caller": "0x7ff79bc557d2", "parentcaller": "0x7ff79bd1630d", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "TaskbarMonitor" }, { "name": "Atom", "value": "0x0000c045" } ], "repeated": 0, "id": 3455 }, { "timestamp": "2026-05-29 01:05:19,399", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3456 }, { "timestamp": "2026-05-29 01:05:19,399", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3457 }, { "timestamp": "2026-05-29 01:05:19,399", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002438" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3458 }, { "timestamp": "2026-05-29 01:05:19,399", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "ShellFeedsTaskbarContentUpdateMode" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarContentUpdateMode" } ], "repeated": 0, "id": 3459 }, { "timestamp": "2026-05-29 01:05:19,399", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 3460 }, { "timestamp": "2026-05-29 01:05:19,399", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc686b4", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 3461 }, { "timestamp": "2026-05-29 01:05:19,399", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xe2\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x005\\x18\\xff\\x7f\\x00\\x00(\\xe3\\\\x03\\x00\\x00\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3462 }, { "timestamp": "2026-05-29 01:05:19,399", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002438" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 3463 }, { "timestamp": "2026-05-29 01:05:19,399", "thread_id": "4696", "caller": "0x7ff79bc8a418", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 3464 }, { "timestamp": "2026-05-29 01:05:19,399", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc68e6a", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 2, "id": 3465 }, { "timestamp": "2026-05-29 01:05:19,399", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xe2\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x005\\x18\\xff\\x7f\\x00\\x00(\\xe3\\\\x03\\x00\\x00\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3466 }, { "timestamp": "2026-05-29 01:05:19,399", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002438" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 3467 }, { "timestamp": "2026-05-29 01:05:19,399", "thread_id": "4696", "caller": "0x7ff79bc8a418", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 3468 }, { "timestamp": "2026-05-29 01:05:19,399", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc686b4", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 3469 }, { "timestamp": "2026-05-29 01:05:19,399", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xe2\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x005\\x18\\xff\\x7f\\x00\\x00(\\xe3\\\\x03\\x00\\x00\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3470 }, { "timestamp": "2026-05-29 01:05:19,399", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002438" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 3471 }, { "timestamp": "2026-05-29 01:05:19,399", "thread_id": "4696", "caller": "0x7ff79bc8a418", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 3472 }, { "timestamp": "2026-05-29 01:05:19,399", "thread_id": "4696", "caller": "0x7ff79bc7a06e", "parentcaller": "0x7ff79bc66f8c", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 3473 }, { "timestamp": "2026-05-29 01:05:19,399", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "CLSID\\{56AD4C5D-B908-4F85-8FF1-7940C29B3BCF}\\Instance" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\CLSID\\{56AD4C5D-B908-4F85-8FF1-7940C29B3BCF}\\Instance" } ], "repeated": 0, "id": 3474 }, { "timestamp": "2026-05-29 01:05:19,399", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 3475 }, { "timestamp": "2026-05-29 01:05:19,399", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff58be0000", "arguments": [ { "name": "lpLibFileName", "value": "shell32.dll" }, { "name": "dwFlags", "value": "0x00004000" } ], "repeated": 0, "id": 3476 }, { "timestamp": "2026-05-29 01:05:19,399", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "SHELL32.dll" }, { "name": "ModuleHandle", "value": "0x7fff58be0000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff58c378f0" } ], "repeated": 0, "id": 3477 }, { "timestamp": "2026-05-29 01:05:19,399", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "synchronization", "api": "NtFindAtom", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "AtomName", "value": "{9F4C2855-9F79-4B39-A8D0-E1D42DE1D5F3} 3" }, { "name": "Atom", "value": "0x00000000" } ], "repeated": 0, "id": 3478 }, { "timestamp": "2026-05-29 01:05:19,415", "thread_id": "4696", "caller": "0x7ff79bcbc401", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "Handle", "value": "0x00001ab0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3479 }, { "timestamp": "2026-05-29 01:05:19,415", "thread_id": "4696", "caller": "0x7ff79bcbc434", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" }, { "name": "ValueName", "value": "IsFeedsAvailable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\IsFeedsAvailable" } ], "repeated": 0, "id": 3480 }, { "timestamp": "2026-05-29 01:05:19,415", "thread_id": "4696", "caller": "0x7ff79bcbc458", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" } ], "repeated": 0, "id": 3481 }, { "timestamp": "2026-05-29 01:05:19,415", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3482 }, { "timestamp": "2026-05-29 01:05:19,415", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3483 }, { "timestamp": "2026-05-29 01:05:19,415", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab0" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3484 }, { "timestamp": "2026-05-29 01:05:19,415", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" }, { "name": "ValueName", "value": "HeadlinesOnboardingComplete" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\HeadlinesOnboardingComplete" } ], "repeated": 0, "id": 3485 }, { "timestamp": "2026-05-29 01:05:19,415", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" } ], "repeated": 0, "id": 3486 }, { "timestamp": "2026-05-29 01:05:19,415", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3487 }, { "timestamp": "2026-05-29 01:05:19,415", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3488 }, { "timestamp": "2026-05-29 01:05:19,415", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab0" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3489 }, { "timestamp": "2026-05-29 01:05:19,415", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 3490 }, { "timestamp": "2026-05-29 01:05:19,415", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" } ], "repeated": 0, "id": 3491 }, { "timestamp": "2026-05-29 01:05:19,415", "thread_id": "4696", "caller": "0x7ff79bcbc401", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "Handle", "value": "0x00001ab0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3492 }, { "timestamp": "2026-05-29 01:05:19,415", "thread_id": "4696", "caller": "0x7ff79bcbc434", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" }, { "name": "ValueName", "value": "IsFeedsAvailable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\IsFeedsAvailable" } ], "repeated": 0, "id": 3493 }, { "timestamp": "2026-05-29 01:05:19,415", "thread_id": "4696", "caller": "0x7ff79bcbc458", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" } ], "repeated": 0, "id": 3494 }, { "timestamp": "2026-05-29 01:05:19,415", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3495 }, { "timestamp": "2026-05-29 01:05:19,415", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3496 }, { "timestamp": "2026-05-29 01:05:19,415", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab0" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3497 }, { "timestamp": "2026-05-29 01:05:19,415", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" }, { "name": "ValueName", "value": "HeadlinesOnboardingComplete" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\HeadlinesOnboardingComplete" } ], "repeated": 0, "id": 3498 }, { "timestamp": "2026-05-29 01:05:19,415", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" } ], "repeated": 0, "id": 3499 }, { "timestamp": "2026-05-29 01:05:19,415", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3500 }, { "timestamp": "2026-05-29 01:05:19,415", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3501 }, { "timestamp": "2026-05-29 01:05:19,415", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab0" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3502 }, { "timestamp": "2026-05-29 01:05:19,415", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 3503 }, { "timestamp": "2026-05-29 01:05:19,415", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" } ], "repeated": 0, "id": 3504 }, { "timestamp": "2026-05-29 01:05:19,415", "thread_id": "4696", "caller": "0x7ff79bcbc401", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "Handle", "value": "0x00001ab0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3505 }, { "timestamp": "2026-05-29 01:05:19,415", "thread_id": "4696", "caller": "0x7ff79bcbc434", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" }, { "name": "ValueName", "value": "IsFeedsAvailable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\IsFeedsAvailable" } ], "repeated": 0, "id": 3506 }, { "timestamp": "2026-05-29 01:05:19,415", "thread_id": "4696", "caller": "0x7ff79bcbc458", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" } ], "repeated": 0, "id": 3507 }, { "timestamp": "2026-05-29 01:05:19,415", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3508 }, { "timestamp": "2026-05-29 01:05:19,415", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3509 }, { "timestamp": "2026-05-29 01:05:19,415", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab0" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3510 }, { "timestamp": "2026-05-29 01:05:19,415", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" }, { "name": "ValueName", "value": "HeadlinesOnboardingComplete" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\HeadlinesOnboardingComplete" } ], "repeated": 0, "id": 3511 }, { "timestamp": "2026-05-29 01:05:19,415", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" } ], "repeated": 0, "id": 3512 }, { "timestamp": "2026-05-29 01:05:19,415", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3513 }, { "timestamp": "2026-05-29 01:05:19,415", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3514 }, { "timestamp": "2026-05-29 01:05:19,415", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab0" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3515 }, { "timestamp": "2026-05-29 01:05:19,415", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 3516 }, { "timestamp": "2026-05-29 01:05:19,415", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" } ], "repeated": 0, "id": 3517 }, { "timestamp": "2026-05-29 01:05:19,415", "thread_id": "4696", "caller": "0x7ff79bcbc401", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "Handle", "value": "0x00001ab0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3518 }, { "timestamp": "2026-05-29 01:05:19,415", "thread_id": "4696", "caller": "0x7ff79bcbc434", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" }, { "name": "ValueName", "value": "IsFeedsAvailable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\IsFeedsAvailable" } ], "repeated": 0, "id": 3519 }, { "timestamp": "2026-05-29 01:05:19,415", "thread_id": "4696", "caller": "0x7ff79bcbc458", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" } ], "repeated": 0, "id": 3520 }, { "timestamp": "2026-05-29 01:05:19,415", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3521 }, { "timestamp": "2026-05-29 01:05:19,415", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3522 }, { "timestamp": "2026-05-29 01:05:19,415", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab0" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3523 }, { "timestamp": "2026-05-29 01:05:19,415", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" }, { "name": "ValueName", "value": "HeadlinesOnboardingComplete" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\HeadlinesOnboardingComplete" } ], "repeated": 0, "id": 3524 }, { "timestamp": "2026-05-29 01:05:19,415", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" } ], "repeated": 0, "id": 3525 }, { "timestamp": "2026-05-29 01:05:19,415", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3526 }, { "timestamp": "2026-05-29 01:05:19,415", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3527 }, { "timestamp": "2026-05-29 01:05:19,415", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab0" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3528 }, { "timestamp": "2026-05-29 01:05:19,415", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 3529 }, { "timestamp": "2026-05-29 01:05:19,415", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" } ], "repeated": 0, "id": 3530 }, { "timestamp": "2026-05-29 01:05:19,415", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3531 }, { "timestamp": "2026-05-29 01:05:19,415", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3532 }, { "timestamp": "2026-05-29 01:05:19,415", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab0" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3533 }, { "timestamp": "2026-05-29 01:05:19,415", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 3534 }, { "timestamp": "2026-05-29 01:05:19,415", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" } ], "repeated": 0, "id": 3535 }, { "timestamp": "2026-05-29 01:05:19,415", "thread_id": "4696", "caller": "0x7ff79bc557d2", "parentcaller": "0x7ff79bd1630d", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "TaskbarMonitor" }, { "name": "Atom", "value": "0x0000c045" } ], "repeated": 0, "id": 3536 }, { "timestamp": "2026-05-29 01:05:19,415", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3537 }, { "timestamp": "2026-05-29 01:05:19,415", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3538 }, { "timestamp": "2026-05-29 01:05:19,415", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab0" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3539 }, { "timestamp": "2026-05-29 01:05:19,415", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001ab0" }, { "name": "ValueName", "value": "ShellFeedsTaskbarContentUpdateMode" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarContentUpdateMode" } ], "repeated": 0, "id": 3540 }, { "timestamp": "2026-05-29 01:05:19,415", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" } ], "repeated": 0, "id": 3541 }, { "timestamp": "2026-05-29 01:05:19,430", "thread_id": "4696", "caller": "0x7ff79bcbc401", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "Handle", "value": "0x00001ab0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3542 }, { "timestamp": "2026-05-29 01:05:19,430", "thread_id": "4696", "caller": "0x7ff79bcbc434", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" }, { "name": "ValueName", "value": "IsFeedsAvailable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\IsFeedsAvailable" } ], "repeated": 0, "id": 3543 }, { "timestamp": "2026-05-29 01:05:19,430", "thread_id": "4696", "caller": "0x7ff79bcbc458", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" } ], "repeated": 0, "id": 3544 }, { "timestamp": "2026-05-29 01:05:19,430", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3545 }, { "timestamp": "2026-05-29 01:05:19,430", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3546 }, { "timestamp": "2026-05-29 01:05:19,430", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab0" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3547 }, { "timestamp": "2026-05-29 01:05:19,430", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" }, { "name": "ValueName", "value": "HeadlinesOnboardingComplete" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\HeadlinesOnboardingComplete" } ], "repeated": 0, "id": 3548 }, { "timestamp": "2026-05-29 01:05:19,430", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" } ], "repeated": 0, "id": 3549 }, { "timestamp": "2026-05-29 01:05:19,430", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3550 }, { "timestamp": "2026-05-29 01:05:19,430", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3551 }, { "timestamp": "2026-05-29 01:05:19,430", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab0" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3552 }, { "timestamp": "2026-05-29 01:05:19,430", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 3553 }, { "timestamp": "2026-05-29 01:05:19,430", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" } ], "repeated": 0, "id": 3554 }, { "timestamp": "2026-05-29 01:05:19,430", "thread_id": "4696", "caller": "0x7ff79bcbc401", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "Handle", "value": "0x00001ab0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3555 }, { "timestamp": "2026-05-29 01:05:19,430", "thread_id": "4696", "caller": "0x7ff79bcbc434", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" }, { "name": "ValueName", "value": "IsFeedsAvailable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\IsFeedsAvailable" } ], "repeated": 0, "id": 3556 }, { "timestamp": "2026-05-29 01:05:19,430", "thread_id": "4696", "caller": "0x7ff79bcbc458", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" } ], "repeated": 0, "id": 3557 }, { "timestamp": "2026-05-29 01:05:19,430", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3558 }, { "timestamp": "2026-05-29 01:05:19,430", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3559 }, { "timestamp": "2026-05-29 01:05:19,430", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab0" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3560 }, { "timestamp": "2026-05-29 01:05:19,430", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" }, { "name": "ValueName", "value": "HeadlinesOnboardingComplete" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\HeadlinesOnboardingComplete" } ], "repeated": 0, "id": 3561 }, { "timestamp": "2026-05-29 01:05:19,430", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" } ], "repeated": 0, "id": 3562 }, { "timestamp": "2026-05-29 01:05:19,430", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3563 }, { "timestamp": "2026-05-29 01:05:19,430", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3564 }, { "timestamp": "2026-05-29 01:05:19,430", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab0" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3565 }, { "timestamp": "2026-05-29 01:05:19,430", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 3566 }, { "timestamp": "2026-05-29 01:05:19,430", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" } ], "repeated": 0, "id": 3567 }, { "timestamp": "2026-05-29 01:05:19,430", "thread_id": "4696", "caller": "0x7ff79bcbc401", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "Handle", "value": "0x00001ab0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3568 }, { "timestamp": "2026-05-29 01:05:19,430", "thread_id": "4696", "caller": "0x7ff79bcbc434", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" }, { "name": "ValueName", "value": "IsFeedsAvailable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\IsFeedsAvailable" } ], "repeated": 0, "id": 3569 }, { "timestamp": "2026-05-29 01:05:19,430", "thread_id": "4696", "caller": "0x7ff79bcbc458", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" } ], "repeated": 0, "id": 3570 }, { "timestamp": "2026-05-29 01:05:19,430", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3571 }, { "timestamp": "2026-05-29 01:05:19,430", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3572 }, { "timestamp": "2026-05-29 01:05:19,430", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab0" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3573 }, { "timestamp": "2026-05-29 01:05:19,430", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" }, { "name": "ValueName", "value": "HeadlinesOnboardingComplete" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\HeadlinesOnboardingComplete" } ], "repeated": 0, "id": 3574 }, { "timestamp": "2026-05-29 01:05:19,430", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" } ], "repeated": 0, "id": 3575 }, { "timestamp": "2026-05-29 01:05:19,430", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3576 }, { "timestamp": "2026-05-29 01:05:19,430", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3577 }, { "timestamp": "2026-05-29 01:05:19,430", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab0" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3578 }, { "timestamp": "2026-05-29 01:05:19,430", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 3579 }, { "timestamp": "2026-05-29 01:05:19,430", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" } ], "repeated": 0, "id": 3580 }, { "timestamp": "2026-05-29 01:05:19,430", "thread_id": "4696", "caller": "0x7ff79bcbc401", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "Handle", "value": "0x00001ab0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3581 }, { "timestamp": "2026-05-29 01:05:19,430", "thread_id": "4696", "caller": "0x7ff79bcbc434", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" }, { "name": "ValueName", "value": "IsFeedsAvailable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\IsFeedsAvailable" } ], "repeated": 0, "id": 3582 }, { "timestamp": "2026-05-29 01:05:19,430", "thread_id": "4696", "caller": "0x7ff79bcbc458", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" } ], "repeated": 0, "id": 3583 }, { "timestamp": "2026-05-29 01:05:19,430", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3584 }, { "timestamp": "2026-05-29 01:05:19,430", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3585 }, { "timestamp": "2026-05-29 01:05:19,430", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab0" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3586 }, { "timestamp": "2026-05-29 01:05:19,430", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" }, { "name": "ValueName", "value": "HeadlinesOnboardingComplete" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\HeadlinesOnboardingComplete" } ], "repeated": 0, "id": 3587 }, { "timestamp": "2026-05-29 01:05:19,430", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" } ], "repeated": 0, "id": 3588 }, { "timestamp": "2026-05-29 01:05:19,430", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3589 }, { "timestamp": "2026-05-29 01:05:19,430", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3590 }, { "timestamp": "2026-05-29 01:05:19,430", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab0" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3591 }, { "timestamp": "2026-05-29 01:05:19,430", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 3592 }, { "timestamp": "2026-05-29 01:05:19,430", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" } ], "repeated": 0, "id": 3593 }, { "timestamp": "2026-05-29 01:05:19,430", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3594 }, { "timestamp": "2026-05-29 01:05:19,430", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3595 }, { "timestamp": "2026-05-29 01:05:19,430", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab0" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3596 }, { "timestamp": "2026-05-29 01:05:19,430", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 3597 }, { "timestamp": "2026-05-29 01:05:19,430", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" } ], "repeated": 0, "id": 3598 }, { "timestamp": "2026-05-29 01:05:19,430", "thread_id": "4696", "caller": "0x7ff79bc557d2", "parentcaller": "0x7ff79bd1630d", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "TaskbarMonitor" }, { "name": "Atom", "value": "0x0000c045" } ], "repeated": 0, "id": 3599 }, { "timestamp": "2026-05-29 01:05:19,430", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3600 }, { "timestamp": "2026-05-29 01:05:19,430", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3601 }, { "timestamp": "2026-05-29 01:05:19,430", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab0" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3602 }, { "timestamp": "2026-05-29 01:05:19,430", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001ab0" }, { "name": "ValueName", "value": "ShellFeedsTaskbarContentUpdateMode" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarContentUpdateMode" } ], "repeated": 0, "id": 3603 }, { "timestamp": "2026-05-29 01:05:19,430", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" } ], "repeated": 0, "id": 3604 }, { "timestamp": "2026-05-29 01:05:19,430", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc686b4", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 3605 }, { "timestamp": "2026-05-29 01:05:19,430", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xe2\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x005\\x18\\xff\\x7f\\x00\\x00(\\xe3\\\\x03\\x00\\x00\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3606 }, { "timestamp": "2026-05-29 01:05:19,430", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab0" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 3607 }, { "timestamp": "2026-05-29 01:05:19,430", "thread_id": "4696", "caller": "0x7ff79bc8a418", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" } ], "repeated": 0, "id": 3608 }, { "timestamp": "2026-05-29 01:05:19,430", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc68e6a", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 2, "id": 3609 }, { "timestamp": "2026-05-29 01:05:19,430", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xe2\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x005\\x18\\xff\\x7f\\x00\\x00(\\xe3\\\\x03\\x00\\x00\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3610 }, { "timestamp": "2026-05-29 01:05:19,430", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab0" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 3611 }, { "timestamp": "2026-05-29 01:05:19,430", "thread_id": "4696", "caller": "0x7ff79bc8a418", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" } ], "repeated": 0, "id": 3612 }, { "timestamp": "2026-05-29 01:05:19,430", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc686b4", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 3613 }, { "timestamp": "2026-05-29 01:05:19,430", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xe2\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x005\\x18\\xff\\x7f\\x00\\x00(\\xe3\\\\x03\\x00\\x00\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3614 }, { "timestamp": "2026-05-29 01:05:19,430", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab0" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 3615 }, { "timestamp": "2026-05-29 01:05:19,430", "thread_id": "4696", "caller": "0x7ff79bc8a418", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" } ], "repeated": 0, "id": 3616 }, { "timestamp": "2026-05-29 01:05:19,430", "thread_id": "4696", "caller": "0x7ff79bc7a06e", "parentcaller": "0x7ff79bc66f8c", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 3617 }, { "timestamp": "2026-05-29 01:05:19,430", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "CLSID\\{56AD4C5D-B908-4F85-8FF1-7940C29B3BCF}\\Instance" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\CLSID\\{56AD4C5D-B908-4F85-8FF1-7940C29B3BCF}\\Instance" } ], "repeated": 0, "id": 3618 }, { "timestamp": "2026-05-29 01:05:19,430", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 3619 }, { "timestamp": "2026-05-29 01:05:19,430", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff58be0000", "arguments": [ { "name": "lpLibFileName", "value": "shell32.dll" }, { "name": "dwFlags", "value": "0x00004000" } ], "repeated": 0, "id": 3620 }, { "timestamp": "2026-05-29 01:05:19,430", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "SHELL32.dll" }, { "name": "ModuleHandle", "value": "0x7fff58be0000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff58c378f0" } ], "repeated": 0, "id": 3621 }, { "timestamp": "2026-05-29 01:05:19,430", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "synchronization", "api": "NtFindAtom", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "AtomName", "value": "{9F4C2855-9F79-4B39-A8D0-E1D42DE1D5F3} 3" }, { "name": "Atom", "value": "0x00000000" } ], "repeated": 0, "id": 3622 }, { "timestamp": "2026-05-29 01:05:19,477", "thread_id": "6156", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff584c8ce0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\x9dd\\x0b\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x02\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x01V\\x0b\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3623 }, { "timestamp": "2026-05-29 01:05:19,477", "thread_id": "6156", "caller": "0x7fff577d6785", "parentcaller": "0x7fff584c8c8a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 3624 }, { "timestamp": "2026-05-29 01:05:19,477", "thread_id": "6156", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff584fb0ca", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3625 }, { "timestamp": "2026-05-29 01:05:19,477", "thread_id": "6156", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 3626 }, { "timestamp": "2026-05-29 01:05:19,477", "thread_id": "6156", "caller": "0x7fff584d7b74", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000034a" }, { "name": "SubKey", "value": "CLSID\\{C2F03A33-21F5-47FA-B4BB-156362A2F239}" }, { "name": "Handle", "value": "0x0000243a" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{C2F03A33-21F5-47FA-B4BB-156362A2F239}" } ], "repeated": 0, "id": 3627 }, { "timestamp": "2026-05-29 01:05:19,477", "thread_id": "6156", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000243a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{c2f03a33-21f5-47fa-b4bb-156362a2f239}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 3628 }, { "timestamp": "2026-05-29 01:05:19,477", "thread_id": "6156", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000243a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3629 }, { "timestamp": "2026-05-29 01:05:19,477", "thread_id": "6156", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xa0\\xcba\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00:$\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xcca\r\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3630 }, { "timestamp": "2026-05-29 01:05:19,477", "thread_id": "6156", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{c2f03a33-21f5-47fa-b4bb-156362a2f239}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{c2f03a33-21f5-47fa-b4bb-156362a2f239}\\TreatAs" } ], "repeated": 0, "id": 3631 }, { "timestamp": "2026-05-29 01:05:19,477", "thread_id": "6156", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000243a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3632 }, { "timestamp": "2026-05-29 01:05:19,477", "thread_id": "6156", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000243a" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c2f03a33-21f5-47fa-b4bb-156362a2f239}\\TreatAs" } ], "repeated": 0, "id": 3633 }, { "timestamp": "2026-05-29 01:05:19,477", "thread_id": "6156", "caller": "0x7fff585622e1", "parentcaller": "0x7fff584d7c1d", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000243a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{c2f03a33-21f5-47fa-b4bb-156362a2f239}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 3634 }, { "timestamp": "2026-05-29 01:05:19,477", "thread_id": "6156", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d81f5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000243a" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c2f03a33-21f5-47fa-b4bb-156362a2f239}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 3635 }, { "timestamp": "2026-05-29 01:05:19,477", "thread_id": "6156", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000243a" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c2f03a33-21f5-47fa-b4bb-156362a2f239}\\(Default)" } ], "repeated": 0, "id": 3636 }, { "timestamp": "2026-05-29 01:05:19,477", "thread_id": "6156", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000243a" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "Immersive Shell" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c2f03a33-21f5-47fa-b4bb-156362a2f239}\\(Default)" } ], "repeated": 0, "id": 3637 }, { "timestamp": "2026-05-29 01:05:19,477", "thread_id": "6156", "caller": "0x7fff584d8485", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x0000243a" }, { "name": "SubKey", "value": "InprocServer32" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c2f03a33-21f5-47fa-b4bb-156362a2f239}\\InprocServer32" } ], "repeated": 0, "id": 3638 }, { "timestamp": "2026-05-29 01:05:19,477", "thread_id": "6156", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000243a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{c2f03a33-21f5-47fa-b4bb-156362a2f239}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 3639 }, { "timestamp": "2026-05-29 01:05:19,477", "thread_id": "6156", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000243a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3640 }, { "timestamp": "2026-05-29 01:05:19,477", "thread_id": "6156", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "0\\xcaa\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00:$\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xcba\r\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3641 }, { "timestamp": "2026-05-29 01:05:19,477", "thread_id": "6156", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{c2f03a33-21f5-47fa-b4bb-156362a2f239}\\InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{c2f03a33-21f5-47fa-b4bb-156362a2f239}\\InprocHandler32" } ], "repeated": 0, "id": 3642 }, { "timestamp": "2026-05-29 01:05:19,477", "thread_id": "6156", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000243a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3643 }, { "timestamp": "2026-05-29 01:05:19,477", "thread_id": "6156", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000243a" }, { "name": "ObjectAttributesName", "value": "InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c2f03a33-21f5-47fa-b4bb-156362a2f239}\\InprocHandler32" } ], "repeated": 0, "id": 3644 }, { "timestamp": "2026-05-29 01:05:19,477", "thread_id": "6156", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000243a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{c2f03a33-21f5-47fa-b4bb-156362a2f239}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 3645 }, { "timestamp": "2026-05-29 01:05:19,477", "thread_id": "6156", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000243a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3646 }, { "timestamp": "2026-05-29 01:05:19,477", "thread_id": "6156", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "0\\xcaa\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00:$\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xcba\r\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3647 }, { "timestamp": "2026-05-29 01:05:19,477", "thread_id": "6156", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{c2f03a33-21f5-47fa-b4bb-156362a2f239}\\InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{c2f03a33-21f5-47fa-b4bb-156362a2f239}\\InprocHandler" } ], "repeated": 0, "id": 3648 }, { "timestamp": "2026-05-29 01:05:19,477", "thread_id": "6156", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000243a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3649 }, { "timestamp": "2026-05-29 01:05:19,477", "thread_id": "6156", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000243a" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c2f03a33-21f5-47fa-b4bb-156362a2f239}\\InprocHandler" } ], "repeated": 0, "id": 3650 }, { "timestamp": "2026-05-29 01:05:19,477", "thread_id": "6156", "caller": "0x7fff584d8010", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000243a" } ], "repeated": 0, "id": 3651 }, { "timestamp": "2026-05-29 01:05:19,477", "thread_id": "6148", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5978ef53", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002544" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 3652 }, { "timestamp": "2026-05-29 01:05:19,477", "thread_id": "6148", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff5854fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000033a" }, { "name": "SubKey", "value": "Interface\\{7E470A8A-3ACD-5913-AF64-4AB78355BE5F}" }, { "name": "Handle", "value": "0x00001ab2" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{7E470A8A-3ACD-5913-AF64-4AB78355BE5F}" } ], "repeated": 0, "id": 3653 }, { "timestamp": "2026-05-29 01:05:19,477", "thread_id": "6148", "caller": "0x7fff5854fa51", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00001ab2" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x00001af6" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7E470A8A-3ACD-5913-AF64-4AB78355BE5F}\\ProxyStubClsid32" } ], "repeated": 0, "id": 3654 }, { "timestamp": "2026-05-29 01:05:19,477", "thread_id": "6148", "caller": "0x7fff5854fa8c", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af6" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7E470A8A-3ACD-5913-AF64-4AB78355BE5F}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 3655 }, { "timestamp": "2026-05-29 01:05:19,477", "thread_id": "6148", "caller": "0x7fff5854fad3", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af6" } ], "repeated": 0, "id": 3656 }, { "timestamp": "2026-05-29 01:05:19,477", "thread_id": "6148", "caller": "0x7fff5854fae4", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab2" } ], "repeated": 0, "id": 3657 }, { "timestamp": "2026-05-29 01:05:19,477", "thread_id": "6148", "caller": "0x7fff584d7b74", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000034a" }, { "name": "SubKey", "value": "CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}" }, { "name": "Handle", "value": "0x00001ab2" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}" } ], "repeated": 0, "id": 3658 }, { "timestamp": "2026-05-29 01:05:19,477", "thread_id": "6148", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab2" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 3659 }, { "timestamp": "2026-05-29 01:05:19,477", "thread_id": "6148", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab2" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3660 }, { "timestamp": "2026-05-29 01:05:19,477", "thread_id": "6148", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x00\\xbbQ\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\xb2\\x1a\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xbcQ\r\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3661 }, { "timestamp": "2026-05-29 01:05:19,477", "thread_id": "6148", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\TreatAs" } ], "repeated": 0, "id": 3662 }, { "timestamp": "2026-05-29 01:05:19,477", "thread_id": "6148", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab2" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3663 }, { "timestamp": "2026-05-29 01:05:19,477", "thread_id": "6148", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00001ab2" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\TreatAs" } ], "repeated": 0, "id": 3664 }, { "timestamp": "2026-05-29 01:05:19,477", "thread_id": "6148", "caller": "0x7fff585622e1", "parentcaller": "0x7fff584d7c1d", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab2" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 3665 }, { "timestamp": "2026-05-29 01:05:19,477", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d81f5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001ab2" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 3666 }, { "timestamp": "2026-05-29 01:05:19,477", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab2" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\(Default)" } ], "repeated": 0, "id": 3667 }, { "timestamp": "2026-05-29 01:05:19,477", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab2" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "PSFactoryBuffer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\(Default)" } ], "repeated": 0, "id": 3668 }, { "timestamp": "2026-05-29 01:05:19,477", "thread_id": "6148", "caller": "0x7fff584d8485", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00001ab2" }, { "name": "SubKey", "value": "InprocServer32" }, { "name": "Handle", "value": "0x00001af6" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InprocServer32" } ], "repeated": 0, "id": 3669 }, { "timestamp": "2026-05-29 01:05:19,477", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001af6" }, { "name": "ValueName", "value": "InprocServer32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InProcServer32\\InprocServer32" } ], "repeated": 0, "id": 3670 }, { "timestamp": "2026-05-29 01:05:19,477", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af6" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 3671 }, { "timestamp": "2026-05-29 01:05:19,477", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af6" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "C:\\Windows\\System32\\PCShellCommonProxyStub.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 3672 }, { "timestamp": "2026-05-29 01:05:19,477", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d8d32", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af6" }, { "name": "ValueName", "value": "ThreadingModel" }, { "name": "Data", "value": "Both" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InProcServer32\\ThreadingModel" } ], "repeated": 0, "id": 3673 }, { "timestamp": "2026-05-29 01:05:19,477", "thread_id": "6148", "caller": "0x7fff584d855f", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af6" } ], "repeated": 0, "id": 3674 }, { "timestamp": "2026-05-29 01:05:19,477", "thread_id": "6148", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab2" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 3675 }, { "timestamp": "2026-05-29 01:05:19,477", "thread_id": "6148", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab2" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3676 }, { "timestamp": "2026-05-29 01:05:19,477", "thread_id": "6148", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x90\\xb9Q\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\xb2\\x1a\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xbaQ\r\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3677 }, { "timestamp": "2026-05-29 01:05:19,477", "thread_id": "6148", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InprocHandler32" } ], "repeated": 0, "id": 3678 }, { "timestamp": "2026-05-29 01:05:19,477", "thread_id": "6148", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab2" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3679 }, { "timestamp": "2026-05-29 01:05:19,477", "thread_id": "6148", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00001ab2" }, { "name": "ObjectAttributesName", "value": "InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InprocHandler32" } ], "repeated": 0, "id": 3680 }, { "timestamp": "2026-05-29 01:05:19,477", "thread_id": "6148", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab2" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 3681 }, { "timestamp": "2026-05-29 01:05:19,477", "thread_id": "6148", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab2" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3682 }, { "timestamp": "2026-05-29 01:05:19,477", "thread_id": "6148", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x90\\xb9Q\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\xb2\\x1a\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xbaQ\r\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3683 }, { "timestamp": "2026-05-29 01:05:19,477", "thread_id": "6148", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InprocHandler" } ], "repeated": 0, "id": 3684 }, { "timestamp": "2026-05-29 01:05:19,477", "thread_id": "6148", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab2" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3685 }, { "timestamp": "2026-05-29 01:05:19,477", "thread_id": "6148", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00001ab2" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InprocHandler" } ], "repeated": 0, "id": 3686 }, { "timestamp": "2026-05-29 01:05:19,477", "thread_id": "6148", "caller": "0x7fff584d8010", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab2" } ], "repeated": 0, "id": 3687 }, { "timestamp": "2026-05-29 01:05:19,477", "thread_id": "6148", "caller": "0x7fff59f93f7a", "parentcaller": "0x7fff59770ed7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3688 }, { "timestamp": "2026-05-29 01:05:19,477", "thread_id": "6148", "caller": "0x7fff59770cd1", "parentcaller": "0x7fff5976f28f", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00001ab0" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 3689 }, { "timestamp": "2026-05-29 01:05:19,477", "thread_id": "6148", "caller": "0x7fff5781026b", "parentcaller": "0x7fff59770daf", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00001af4" } ], "repeated": 0, "id": 3690 }, { "timestamp": "2026-05-29 01:05:19,477", "thread_id": "6148", "caller": "0x7fff59f88cde", "parentcaller": "0x7fff59fc9c4e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": " \\xf1\\x02\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3691 }, { "timestamp": "2026-05-29 01:05:19,477", "thread_id": "6148", "caller": "0x7fff59fb6e46", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "xU\\xa9\\x0c\\x00\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x007\\x00-\\x009\\x005\\x001\\x00A\\x00-\\x000\\x00E\\x004\\x00E\\x00-\\x00E\\x009\\x008\\x00C\\x00E\\x00C\\x004\\x004\\x002\\x00E\\x00C\\x009\\x00\\x00\\x00at" } ], "repeated": 0, "id": 3692 }, { "timestamp": "2026-05-29 01:05:19,477", "thread_id": "6148", "caller": "0x7fff59fb6e9b", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xa0A\\xa9\\x0c\\x00\\x00\\x00\\x00`\\x00\\x00\\x00-\\x00w\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00r\\x00-\\x00l\\x001\\x00-\\x001\\x00-\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00" } ], "repeated": 0, "id": 3693 }, { "timestamp": "2026-05-29 01:05:19,477", "thread_id": "6148", "caller": "0x7fff59fb6ec0", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 3694 }, { "timestamp": "2026-05-29 01:05:19,477", "thread_id": "6148", "caller": "0x7fff59fb6f0e", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "h\\xd8\\xd8\\x08\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 3695 }, { "timestamp": "2026-05-29 01:05:19,477", "thread_id": "6148", "caller": "0x7fff59fb6f37", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 3696 }, { "timestamp": "2026-05-29 01:05:19,477", "thread_id": "6148", "caller": "0x7fff59fb6f8f", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xd8U\\xa9\\x0c\\x00\\x00\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 3697 }, { "timestamp": "2026-05-29 01:05:19,477", "thread_id": "6148", "caller": "0x7fff59fb7048", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x81\\x1a\\xff\\x7f\\x00\\x00\\xebPY\\x1a\\xff\\x7f\\x00\\x00\\x08-[w^t\\x00\\x00(N}\\x1a\\xff\\x7f\\x00\\x00P\\xc9Q\r\\x00\\x00\\x00\\x00H\\xc9Q\r\\x00\\x00\\x00\\x00\\x18\\xc9Q\r\\x00\\x00\\x00\\x008\\xc9Q\r" } ], "repeated": 0, "id": 3698 }, { "timestamp": "2026-05-29 01:05:19,477", "thread_id": "6148", "caller": "0x7fff59fb707b", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0U\\xa9\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8Z\\x1a\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x008\\xc7Q\r\\x00\\x00\\x00\\x00\\xf4\\x1a\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00$\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2}\\x1a" } ], "repeated": 0, "id": 3699 }, { "timestamp": "2026-05-29 01:05:19,477", "thread_id": "6148", "caller": "0x7fff59f88cde", "parentcaller": "0x7fff59f8953a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": " \\xf1\\x02\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3700 }, { "timestamp": "2026-05-29 01:05:19,477", "thread_id": "6148", "caller": "0x7fff59fb6e46", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "8M\\xa9\\x0c\\x00\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00ue:Tuesday:Wed:Wednesday:Thu:Thursday:Fri:Friday:Sat" } ], "repeated": 0, "id": 3701 }, { "timestamp": "2026-05-29 01:05:19,477", "thread_id": "6148", "caller": "0x7fff59fb6e9b", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "@A\\xa9\\x0c\\x00\\x00\\x00\\x00`\\x00\\x00\\x00F\\x003\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x004\\x000\\x008\\x006\\x00-\\x009\\x004\\x00E\\x003\\x00-\\x005\\x003\\x001\\x001\\x00F\\x009\\x007\\x00F\\x008\\x009\\x00C\\x004\\x00\\x00\\x000\\x00\\x00\\x00aturda" } ], "repeated": 0, "id": 3702 }, { "timestamp": "2026-05-29 01:05:19,477", "thread_id": "6148", "caller": "0x7fff59fb6ec0", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 3703 }, { "timestamp": "2026-05-29 01:05:19,477", "thread_id": "6148", "caller": "0x7fff59fb6f0e", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\x88\\xd9\\xd8\\x08\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 3704 }, { "timestamp": "2026-05-29 01:05:19,477", "thread_id": "6148", "caller": "0x7fff59fb6f37", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 3705 }, { "timestamp": "2026-05-29 01:05:19,477", "thread_id": "6148", "caller": "0x7fff59fb6f8f", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\x98M\\xa9\\x0c\\x00\\x00\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 3706 }, { "timestamp": "2026-05-29 01:05:19,477", "thread_id": "6148", "caller": "0x7fff59fb7048", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x81\\x1a\\xff\\x7f\\x00\\x00\\xebPY\\x1a\\xff\\x7f\\x00\\x00\\xe8P[w^t\\x00\\x00(N}\\x1a\\xff\\x7f\\x00\\x00\\xb0\\xc5Q\r\\x00\\x00\\x00\\x00\\xa8\\xc5Q\r\\x00\\x00\\x00\\x00x\\xc5Q\r\\x00\\x00\\x00\\x00\\x98\\xc5Q\r" } ], "repeated": 0, "id": 3707 }, { "timestamp": "2026-05-29 01:05:19,477", "thread_id": "6148", "caller": "0x7fff59fb707b", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90M\\xa9\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8Z\\x1a\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x98\\xc3Q\r\\x00\\x00\\x00\\x00\\xf4\\x1a\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00$\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2}\\x1a" } ], "repeated": 0, "id": 3708 }, { "timestamp": "2026-05-29 01:05:19,477", "thread_id": "6148", "caller": "0x7fff577d6785", "parentcaller": "0x7fff59770e27", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" } ], "repeated": 0, "id": 3709 }, { "timestamp": "2026-05-29 01:05:19,477", "thread_id": "6148", "caller": "0x7fff577d6785", "parentcaller": "0x7fff59770e49", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af4" } ], "repeated": 0, "id": 3710 }, { "timestamp": "2026-05-29 01:05:19,493", "thread_id": "6148", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff584fb0ca", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3711 }, { "timestamp": "2026-05-29 01:05:19,493", "thread_id": "6148", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 3712 }, { "timestamp": "2026-05-29 01:05:19,493", "thread_id": "6148", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3713 }, { "timestamp": "2026-05-29 01:05:19,493", "thread_id": "6148", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000360" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3714 }, { "timestamp": "2026-05-29 01:05:19,524", "thread_id": "6148", "caller": "0x7fff597abf07", "parentcaller": "0x7fff597abe66", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3715 }, { "timestamp": "2026-05-29 01:05:19,524", "thread_id": "6148", "caller": "0x7fff59765bc1", "parentcaller": "0x7fff59765b34", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 3716 }, { "timestamp": "2026-05-29 01:05:19,805", "thread_id": "6148", "caller": "0x7fff577d6785", "parentcaller": "0x7fff597c4f59", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001838" } ], "repeated": 0, "id": 3717 }, { "timestamp": "2026-05-29 01:05:19,805", "thread_id": "6148", "caller": "0x7fff59f5c23a", "parentcaller": "0x7fff59f5c30d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000017d8" } ], "repeated": 0, "id": 3718 }, { "timestamp": "2026-05-29 01:05:21,415", "thread_id": "4696", "caller": "0x7ff79be6dccc", "parentcaller": "0x7ff79be74662", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000066" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 3719 }, { "timestamp": "2026-05-29 01:05:21,415", "thread_id": "4696", "caller": "0x7ff79be61930", "parentcaller": "0x7ff79be6dd29", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "user32" }, { "name": "BaseAddress", "value": "0x7fff581b0000" } ], "repeated": 0, "id": 3720 }, { "timestamp": "2026-05-29 01:05:21,415", "thread_id": "4696", "caller": "0x7ff79be61930", "parentcaller": "0x7ff79be6dd29", "category": "misc", "api": "GetCursorPos", "status": true, "return": "0x00000001", "arguments": [ { "name": "x", "value": "1829" }, { "name": "y", "value": "55" } ], "repeated": 0, "id": 3721 }, { "timestamp": "2026-05-29 01:05:21,415", "thread_id": "4696", "caller": "0x7ff79bc6b631", "parentcaller": "0x7ff79bc6b527", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "TaskbarMonitor" }, { "name": "Atom", "value": "0x0000c045" } ], "repeated": 1, "id": 3722 }, { "timestamp": "2026-05-29 01:05:21,462", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc69953", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 3723 }, { "timestamp": "2026-05-29 01:05:21,602", "thread_id": "5108", "caller": "0x7fff426da250", "parentcaller": "0x7fff57fc7344", "category": "system", "api": "GetSystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3724 }, { "timestamp": "2026-05-29 01:05:21,602", "thread_id": "5108", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff42570a3f", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002438" }, { "name": "DesiredAccess", "value": "0x00000410", "pretty_value": "PROCESS_VM_READ|PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 3725 }, { "timestamp": "2026-05-29 01:05:21,602", "thread_id": "5108", "caller": "0x7fff5781026b", "parentcaller": "0x7fff42570dc8", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002438" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000255c" } ], "repeated": 0, "id": 3726 }, { "timestamp": "2026-05-29 01:05:21,602", "thread_id": "5108", "caller": "0x7fff42570e03", "parentcaller": "0x7fff42570a6b", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 3727 }, { "timestamp": "2026-05-29 01:05:21,602", "thread_id": "5108", "caller": "0x7fff42570e77", "parentcaller": "0x7fff42570a6b", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xb0\\x8c\\xc6\\x0b\\x00\\x00\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00\\xd8\\x8c\\xc6\\x0b\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\\x8c\\xc6\\x0b\\x00\\x00\\x00\\x00T\\x00S\\x00A\\x00:\\x00/\\x00/\\x00P\\x00r\\x00o\\x00c\\x00U\\x00n\\x00i\\x00q\\x00u\\x00e\\x00W\\x00\\x00\\x00\\x00\\x00\\x00\\x00%\\xf1\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3728 }, { "timestamp": "2026-05-29 01:05:21,602", "thread_id": "5108", "caller": "0x7fff577d6785", "parentcaller": "0x7fff42570eff", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000255c" } ], "repeated": 0, "id": 3729 }, { "timestamp": "2026-05-29 01:05:21,602", "thread_id": "5108", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff44bd4f06", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000255c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 3730 }, { "timestamp": "2026-05-29 01:05:21,602", "thread_id": "5108", "caller": "0x7fff5781026b", "parentcaller": "0x7fff44c0f8f9", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000255c" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00001af4" } ], "repeated": 0, "id": 3731 }, { "timestamp": "2026-05-29 01:05:21,602", "thread_id": "5108", "caller": "0x7fff44c0f5ac", "parentcaller": "0x7fff44c0f931", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 3732 }, { "timestamp": "2026-05-29 01:05:21,602", "thread_id": "5108", "caller": "0x7fff44c0f65d", "parentcaller": "0x7fff44c0f931", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00y\\xc6\\x0b\\x00\\x00\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00(y\\xc6\\x0b\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00Hy\\xc6\\x0b\\x00\\x00\\x00\\x00T\\x00S\\x00A\\x00:\\x00/\\x00/\\x00P\\x00r\\x00o\\x00c\\x00U\\x00n\\x00i\\x00q\\x00u\\x00e\\x00W\\x00\\x00\\x00\\x00\\x00\\x00\\x00%\\xf1\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3733 }, { "timestamp": "2026-05-29 01:05:21,602", "thread_id": "5108", "caller": "0x7fff577d6785", "parentcaller": "0x7fff44c0f944", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af4" } ], "repeated": 0, "id": 3734 }, { "timestamp": "2026-05-29 01:05:21,602", "thread_id": "5108", "caller": "0x7fff577d6785", "parentcaller": "0x7fff44bd525c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000255c" } ], "repeated": 0, "id": 3735 }, { "timestamp": "2026-05-29 01:05:21,602", "thread_id": "5108", "caller": "0x7fff577d6785", "parentcaller": "0x7fff42570a7d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 3736 }, { "timestamp": "2026-05-29 01:05:21,602", "thread_id": "5108", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff426da18b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000ea0" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 3737 }, { "timestamp": "2026-05-29 01:05:21,602", "thread_id": "4696", "caller": "0x7ff79bc54d73", "parentcaller": "0x7ff79bc4e52c", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3738 }, { "timestamp": "2026-05-29 01:05:21,602", "thread_id": "4696", "caller": "0x7ff79bc54d73", "parentcaller": "0x7ff79bc4e52c", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3739 }, { "timestamp": "2026-05-29 01:05:21,602", "thread_id": "4696", "caller": "0x7ff79bc54d73", "parentcaller": "0x7ff79bc4e52c", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002438" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search" } ], "repeated": 0, "id": 3740 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "4696", "caller": "0x7ff79bc54d73", "parentcaller": "0x7ff79bc4e52c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "SearchboxTaskbarMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\SearchboxTaskbarMode" } ], "repeated": 0, "id": 3741 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "4696", "caller": "0x7ff79bc54d73", "parentcaller": "0x7ff79bc4e52c", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 3742 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "4696", "caller": "0x7ff79bc54d73", "parentcaller": "0x7ff79bc5370c", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3743 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "4696", "caller": "0x7ff79bc54d73", "parentcaller": "0x7ff79bc5370c", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3744 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "4696", "caller": "0x7ff79bc54d73", "parentcaller": "0x7ff79bc5370c", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002438" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search" } ], "repeated": 0, "id": 3745 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "4696", "caller": "0x7ff79bc54d73", "parentcaller": "0x7ff79bc5370c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "SearchboxTaskbarMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\SearchboxTaskbarMode" } ], "repeated": 0, "id": 3746 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "4696", "caller": "0x7ff79bc54d73", "parentcaller": "0x7ff79bc5370c", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 3747 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "4696", "caller": "0x7ff79bc54d73", "parentcaller": "0x7ff79bc53715", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3748 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "4696", "caller": "0x7ff79bc54d73", "parentcaller": "0x7ff79bc53715", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3749 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "4696", "caller": "0x7ff79bc54d73", "parentcaller": "0x7ff79bc53715", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002438" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search" } ], "repeated": 0, "id": 3750 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "4696", "caller": "0x7ff79bc54d73", "parentcaller": "0x7ff79bc53715", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "SearchboxTaskbarMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\SearchboxTaskbarMode" } ], "repeated": 0, "id": 3751 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "4696", "caller": "0x7ff79bc54d73", "parentcaller": "0x7ff79bc53715", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 3752 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "4696", "caller": "0x7ff79bc69d1d", "parentcaller": "0x7ff79bc69cab", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3753 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "4696", "caller": "0x7ff79bc69d1d", "parentcaller": "0x7ff79bc69cab", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3754 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "4696", "caller": "0x7ff79bc69d1d", "parentcaller": "0x7ff79bc69cab", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002438" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced" } ], "repeated": 0, "id": 3755 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "4696", "caller": "0x7ff79bc69d1d", "parentcaller": "0x7ff79bc69cab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "ShowCortanaButton" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowCortanaButton" } ], "repeated": 0, "id": 3756 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "4696", "caller": "0x7ff79bc69d1d", "parentcaller": "0x7ff79bc69cab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 3757 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "4696", "caller": "0x7ff79bc54f57", "parentcaller": "0x7ff79bc4e161", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "TaskbarMonitor" }, { "name": "Atom", "value": "0x0000c045" } ], "repeated": 1, "id": 3758 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "4696", "caller": "0x7ff79bc4e734", "parentcaller": "0x7ff79bc4e33a", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\xf9\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00X\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\r\\x00\\x00\\x00\\x01\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4696" } ], "repeated": 0, "id": 3759 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "4636", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xf9\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x1c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4636" } ], "repeated": 0, "id": 3760 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "4696", "caller": "0x7ff79bc54f57", "parentcaller": "0x7ff79bc4d8f5", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "TaskbarMonitor" }, { "name": "Atom", "value": "0x0000c045" } ], "repeated": 0, "id": 3761 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "4696", "caller": "0x7ff79bdd34aa", "parentcaller": "0x7ff79bdd4d6e", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x00000002", "pretty_value": "KEY_SET_VALUE" }, { "name": "Handle", "value": "0x00002438" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 3762 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "4696", "caller": "0x7ff79bdd34e9", "parentcaller": "0x7ff79bdd4d6e", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "TraySearchBoxVisible" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Buffer", "value": "0" }, { "name": "BufferLength", "value": "4" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\TraySearchBoxVisible" } ], "repeated": 0, "id": 3763 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "4696", "caller": "0x7ff79bdd3501", "parentcaller": "0x7ff79bdd4d6e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 3764 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "4696", "caller": "0x7ff79bdd34aa", "parentcaller": "0x7ff79bdd4d6e", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x00000002", "pretty_value": "KEY_SET_VALUE" }, { "name": "Handle", "value": "0x00002438" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 3765 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "4696", "caller": "0x7ff79bdd34e9", "parentcaller": "0x7ff79bdd4d6e", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "TraySearchBoxVisibleOnAnyMonitor" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Buffer", "value": "0" }, { "name": "BufferLength", "value": "4" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\TraySearchBoxVisibleOnAnyMonitor" } ], "repeated": 0, "id": 3766 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "4696", "caller": "0x7ff79bdd3501", "parentcaller": "0x7ff79bdd4d6e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 3767 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "4696", "caller": "0x7ff79bc4dffd", "parentcaller": "0x7ff79bc4db65", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "TaskbarMonitor" }, { "name": "Atom", "value": "0x0000c045" } ], "repeated": 0, "id": 3768 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "4696", "caller": "0x7ff79bc4e7b4", "parentcaller": "0x7ff79bc4e3e5", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\xf9\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00X\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\r\\x00\\x00\\x00\\x01\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4696" } ], "repeated": 1, "id": 3769 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 3770 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "4576", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\x11\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4576" } ], "repeated": 0, "id": 3771 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "4696", "caller": "0x7ff79bcbc434", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "IsFeedsAvailable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\IsFeedsAvailable" } ], "repeated": 0, "id": 3772 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "4696", "caller": "0x7ff79bcbc458", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 3773 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3774 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3775 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002438" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3776 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "HeadlinesOnboardingComplete" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\HeadlinesOnboardingComplete" } ], "repeated": 0, "id": 3777 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 3778 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3779 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3780 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002438" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3781 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "4576", "caller": "0x7ff79bc4ac80", "parentcaller": "0x00000000", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 3782 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 3783 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "4636", "caller": "0x7ff79bc4ab22", "parentcaller": "0x00000000", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 3784 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "4696", "caller": "0x7ff79bcbc401", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "Handle", "value": "0x00002438" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3785 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "4576", "caller": "0x7ff79bc4ac80", "parentcaller": "0x00000000", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 3786 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "4696", "caller": "0x7ff79bcbc434", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "IsFeedsAvailable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\IsFeedsAvailable" } ], "repeated": 0, "id": 3787 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "4696", "caller": "0x7ff79bcbc458", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 3788 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 3789 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "4636", "caller": "0x7ff79bc4ab4a", "parentcaller": "0x00000000", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 3790 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3791 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "6148", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff584fb0ca", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3792 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "4576", "caller": "0x7ff79bc4ac9f", "parentcaller": "0x00000000", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 3793 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002438" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3794 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "4636", "caller": "0x7ff79bc4ab8a", "parentcaller": "0x00000000", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 3795 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002438" }, { "name": "ValueName", "value": "HeadlinesOnboardingComplete" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\HeadlinesOnboardingComplete" } ], "repeated": 0, "id": 3796 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 3797 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "4636", "caller": "0x7ff79bc4aba9", "parentcaller": "0x00000000", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 3798 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3799 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3800 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002438" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3801 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "6148", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 3802 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 3803 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "6148", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3804 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "6148", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000360" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3805 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 3806 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "4696", "caller": "0x7ff79bcbc401", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "Handle", "value": "0x00002438" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3807 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "4696", "caller": "0x7ff79bcbc434", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "IsFeedsAvailable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\IsFeedsAvailable" } ], "repeated": 0, "id": 3808 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "4696", "caller": "0x7ff79bcbc458", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 3809 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 3810 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3811 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002438" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3812 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "HeadlinesOnboardingComplete" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\HeadlinesOnboardingComplete" } ], "repeated": 0, "id": 3813 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 3814 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "4620", "caller": "0x7ff79bcb8fba", "parentcaller": "0x00000000", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 3815 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3816 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3817 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002438" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3818 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 3819 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "4620", "caller": "0x7ff79bcb8fba", "parentcaller": "0x00000000", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "C2F03A33-21F5-47FA-B4BB-156362A2F239" }, { "name": "ClsContext", "value": "0x00000404", "pretty_value": "CLSCTX_LOCAL_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "6D5140C1-7436-11CE-8034-00AA006009FA" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 3820 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 3821 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3822 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "4620", "caller": "0x7ff79bcb8ff6", "parentcaller": "0x00000000", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 3823 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3824 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002438" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3825 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 3826 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 3827 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "4696", "caller": "0x7ff79bc557d2", "parentcaller": "0x7ff79bd1630d", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "TaskbarMonitor" }, { "name": "Atom", "value": "0x0000c045" } ], "repeated": 0, "id": 3828 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3829 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3830 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002438" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 3831 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "ShellFeedsTaskbarContentUpdateMode" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarContentUpdateMode" } ], "repeated": 0, "id": 3832 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 3833 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "4696", "caller": "0x7ff79bc4d757", "parentcaller": "0x7ff79bc4b674", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 3834 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "4696", "caller": "0x7ff79bc6b631", "parentcaller": "0x7ff79bc6b527", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "TaskbarMonitor" }, { "name": "Atom", "value": "0x0000c045" } ], "repeated": 0, "id": 3835 }, { "timestamp": "2026-05-29 01:05:21,618", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc69953", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 3836 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "5000", "caller": "0x7fff42595b7f", "parentcaller": "0x7fff42595b24", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CloudExperienceHost" }, { "name": "Handle", "value": "0x00002440" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CloudExperienceHost" } ], "repeated": 0, "id": 3837 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002440" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3838 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00002440" }, { "name": "ObjectAttributesName", "value": "Fullscreen" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CloudExperienceHost\\Fullscreen" } ], "repeated": 0, "id": 3839 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "5000", "caller": "0x7fff426bfce2", "parentcaller": "0x7fff42595b24", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002440" } ], "repeated": 0, "id": 3840 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4620", "caller": "0x7ff79bcb8ff6", "parentcaller": "0x00000000", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 4, "id": 3841 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4636", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xf9\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x1c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4636" } ], "repeated": 0, "id": 3842 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4696", "caller": "0x7ff79bc801c8", "parentcaller": "0x7ff79bc8a0c8", "category": "misc", "api": "GetKeyboardLayout", "status": true, "return": "0x04090409", "arguments": [ { "name": "KeyboardLayout", "value": "0x00000409" }, { "name": "LanguageName", "value": "English (United States)" } ], "repeated": 0, "id": 3843 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 3844 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4696", "caller": "0x7ff79bc801c8", "parentcaller": "0x7ff79bc8a0c8", "category": "misc", "api": "GetKeyboardLayout", "status": true, "return": "0x04090409", "arguments": [ { "name": "KeyboardLayout", "value": "0x00000409" }, { "name": "LanguageName", "value": "English (United States)" } ], "repeated": 0, "id": 3845 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4696", "caller": "0x7ff79bc801c8", "parentcaller": "0x7ff79bc8a0c8", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x0000104e" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 3846 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4696", "caller": "0x7ff79bc801c8", "parentcaller": "0x7ff79bc8a0c8", "category": "synchronization", "api": "NtOpenEvent", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "Handle", "value": "0x035cf0c0" }, { "name": "EventName", "value": "Local\\1ImmersiveFocusTrackingActiveEvent" } ], "repeated": 0, "id": 3847 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4696", "caller": "0x7ff79bc521d5", "parentcaller": "0x7ff79bc51a67", "category": "system", "api": "GetLastInputInfo", "status": true, "return": "0x00000001", "arguments": [], "repeated": 0, "id": 3848 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4696", "caller": "0x7ff79bc521fe", "parentcaller": "0x7ff79bc51a67", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af4" } ], "repeated": 0, "id": 3849 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4696", "caller": "0x7ff79bc521fe", "parentcaller": "0x7ff79bc51a67", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000255c" } ], "repeated": 0, "id": 3850 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4696", "caller": "0x7ff79bc521fe", "parentcaller": "0x7ff79bc51a67", "category": "device", "api": "NtPowerInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "InformationLevel", "value": "16" }, { "name": "InputBuffer", "value": "" }, { "name": "OutputBuffer", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3851 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4696", "caller": "0x7ff79bc521fe", "parentcaller": "0x7ff79bc51a67", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000255c" } ], "repeated": 0, "id": 3852 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "3424", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff557c3a98", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xfe\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00`\r\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "3424" } ], "repeated": 0, "id": 3853 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4696", "caller": "0x7ff79bc76bd8", "parentcaller": "0x7ff79bc8a0c8", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00010110" }, { "name": "Message", "value": "0x0000c028" } ], "repeated": 0, "id": 3854 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "3424", "caller": "0x7fff577d6785", "parentcaller": "0x7fff557c403a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000255c" } ], "repeated": 0, "id": 3855 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4696", "caller": "0x7ff79bc76bd8", "parentcaller": "0x7ff79bc8a0c8", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00010110" }, { "name": "Message", "value": "0x0000c028" } ], "repeated": 0, "id": 3856 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "misc", "api": "GetKeyboardLayout", "status": true, "return": "0x04090409", "arguments": [ { "name": "KeyboardLayout", "value": "0x00000409" }, { "name": "LanguageName", "value": "English (United States)" } ], "repeated": 0, "id": 3857 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "5000", "caller": "0x7fff57fc2eeb", "parentcaller": "0x7fff581ba00f", "category": "synchronization", "api": "NtFindAtom", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "AtomName", "value": "Windows.Internal.Shell.Holographic.Win32PortedView" }, { "name": "Atom", "value": "0x00000000" } ], "repeated": 1, "id": 3858 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff455848a6", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000255c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 3859 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "5000", "caller": "0x7fff57fc2eeb", "parentcaller": "0x7fff581ba00f", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "{9F4C2855-9F79-4B39-A8D0-E1D42DE1D5F3} 5" }, { "name": "Atom", "value": "0x0000c067" } ], "repeated": 0, "id": 3860 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "5000", "caller": "0x7fff5781026b", "parentcaller": "0x7fff45584920", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000255c" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002440" } ], "repeated": 0, "id": 3861 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "5000", "caller": "0x7fff45584c45", "parentcaller": "0x7fff45584941", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 3862 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "5000", "caller": "0x7fff45584ce5", "parentcaller": "0x7fff45584941", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00@\\x93\\xc6\\x0b\\x00\\x00\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00h\\x93\\xc6\\x0b\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x93\\xc6\\x0b\\x00\\x00\\x00\\x00T\\x00S\\x00A\\x00:\\x00/\\x00/\\x00P\\x00r\\x00o\\x00c\\x00U\\x00n\\x00i\\x00q\\x00u\\x00e\\x00W\\x00\\x00\\x00\\x00\\x00\\x00\\x00%\\xf1\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3863 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff45584956", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002440" } ], "repeated": 0, "id": 3864 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3865 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af4" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3866 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff455a1181", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000255c" } ], "repeated": 0, "id": 3867 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af4" } ], "repeated": 0, "id": 3868 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "5000", "caller": "0x7fff57fc2eeb", "parentcaller": "0x7fff581ba00f", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "MultimonitorActivationException" }, { "name": "Atom", "value": "0x0000c049" } ], "repeated": 0, "id": 3869 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "5000", "caller": "0x7fff425a9007", "parentcaller": "0x7fff425a8c10", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 3870 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "5000", "caller": "0x7fff57fc2eeb", "parentcaller": "0x7fff581ba00f", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "MultimonitorActivationException" }, { "name": "Atom", "value": "0x0000c049" } ], "repeated": 0, "id": 3871 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 3872 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 3873 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000100a8" }, { "name": "Message", "value": "0x00000060" } ], "repeated": 0, "id": 3874 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbd423", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000255c" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 3875 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4620", "caller": "0x7fff42568962", "parentcaller": "0x7fff42567e38", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001011a" }, { "name": "Message", "value": "0x00000401" } ], "repeated": 0, "id": 3876 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xd0\\xf1\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xa7=\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xaa\\x01\\x03I\\xff\\x7f\\x00\\x00\\xb0\\xef\\x08I\\xff\\x7f\\x00\\x00" } ], "repeated": 0, "id": 3877 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001af4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 3878 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00001af4" }, { "name": "SubKey", "value": "Software\\Policies\\Microsoft\\InputMethod\\Settings\\JPN" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\InputMethod\\Settings\\JPN" } ], "repeated": 0, "id": 3879 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af4" } ], "repeated": 0, "id": 3880 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\default\\TextInput\\ConfigureJapaneseIMEVersion" }, { "name": "Handle", "value": "0x00001af4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\TextInput\\ConfigureJapaneseIMEVersion" } ], "repeated": 0, "id": 3881 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af4" }, { "name": "ValueName", "value": "PolicyType" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\TextInput\\ConfigureJapaneseIMEVersion\\PolicyType" } ], "repeated": 0, "id": 3882 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af4" }, { "name": "ValueName", "value": "Behavior" }, { "name": "Data", "value": "73760" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\TextInput\\ConfigureJapaneseIMEVersion\\Behavior" } ], "repeated": 0, "id": 3883 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af4" }, { "name": "ValueName", "value": "MergeAlgorithm" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\TextInput\\ConfigureJapaneseIMEVersion\\MergeAlgorithm" } ], "repeated": 0, "id": 3884 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001af4" }, { "name": "ValueName", "value": "RegKeyPathRedirectMapped" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\TextInput\\ConfigureJapaneseIMEVersion\\RegKeyPathRedirectMapped" } ], "repeated": 0, "id": 3885 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001af4" }, { "name": "ValueName", "value": "RegKeyPathRedirect" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\TextInput\\ConfigureJapaneseIMEVersion\\RegKeyPathRedirect" } ], "repeated": 0, "id": 3886 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001af4" }, { "name": "ValueName", "value": "grouppolicyname" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\TextInput\\ConfigureJapaneseIMEVersion\\grouppolicyname" } ], "repeated": 0, "id": 3887 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001af4" }, { "name": "ValueName", "value": "ADMXMetadataUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\TextInput\\ConfigureJapaneseIMEVersion\\ADMXMetadataUser" } ], "repeated": 0, "id": 3888 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001af4" }, { "name": "ValueName", "value": "ADMXMetadataDevice" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\TextInput\\ConfigureJapaneseIMEVersion\\ADMXMetadataDevice" } ], "repeated": 0, "id": 3889 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001af4" }, { "name": "ValueName", "value": "ADMXMetadataBoth" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\TextInput\\ConfigureJapaneseIMEVersion\\ADMXMetadataBoth" } ], "repeated": 0, "id": 3890 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001af4" }, { "name": "ValueName", "value": "30Value" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\TextInput\\ConfigureJapaneseIMEVersion\\30Value" } ], "repeated": 0, "id": 3891 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af4" }, { "name": "ValueName", "value": "Value" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\TextInput\\ConfigureJapaneseIMEVersion\\Value" } ], "repeated": 0, "id": 3892 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af4" } ], "repeated": 0, "id": 3893 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\TextInput" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\TextInput" } ], "repeated": 0, "id": 3894 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "5000", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002560" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "6136" }, { "name": "ProcessName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe" } ], "repeated": 0, "id": 3895 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\TextInput" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\TextInput" } ], "repeated": 0, "id": 3896 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbddbb", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002570" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "5624" }, { "name": "ProcessName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe" } ], "repeated": 0, "id": 3897 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbddbb", "category": "process", "api": "NtOpenProcess", "status": false, "return": "0xffffffffc0000022", "pretty_return": "ACCESS_DENIED", "arguments": [ { "name": "ProcessHandle", "value": "0x00002570" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "1048" } ], "repeated": 0, "id": 3898 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbddbb", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002564" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 3899 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbddbb", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002568" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "5128" }, { "name": "ProcessName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe" } ], "repeated": 0, "id": 3900 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 3901 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbddbb", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002574" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "6400" }, { "name": "ProcessName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe" } ], "repeated": 0, "id": 3902 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 3903 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 3904 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 1, "id": 3905 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3906 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 3907 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 3908 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 4, "id": 3909 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 3910 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 1, "id": 3911 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 3912 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 1, "id": 3913 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 3914 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 4, "id": 3915 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 3916 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 1, "id": 3917 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 3918 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 1, "id": 3919 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 3920 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 1, "id": 3921 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 2, "id": 3922 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "5000", "caller": "0x7fff41dbe842", "parentcaller": "0x7fff41dbd62c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002554" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "\\Device\\Bam" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 3923 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 1, "id": 3924 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4696", "caller": "0x7ff79bc6b631", "parentcaller": "0x7ff79bc6b527", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "TaskbarMonitor" }, { "name": "Atom", "value": "0x0000c045" } ], "repeated": 0, "id": 3925 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 3926 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "5000", "caller": "0x7fff41dbe8a3", "parentcaller": "0x7fff41dbd62c", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002554" }, { "name": "HandleName", "value": "\\Device\\Bam" }, { "name": "IoControlCode", "value": "0x00220004" }, { "name": "InputBuffer", "value": "\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00`%\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9c\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00p%\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00d%\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00h%\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00t%\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 3927 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 3928 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc69953", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 3929 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff41dbe9a9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002560" } ], "repeated": 0, "id": 3930 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff41dbe9a9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002570" } ], "repeated": 0, "id": 3931 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 3932 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff41dbe9a9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002564" } ], "repeated": 0, "id": 3933 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff41dbe9a9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002568" } ], "repeated": 0, "id": 3934 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff41dbe9a9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002574" } ], "repeated": 0, "id": 3935 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4620", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 3936 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "5000", "caller": "0x7fff41dbe9d8", "parentcaller": "0x7fff41dbd62c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002554" } ], "repeated": 0, "id": 3937 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "5000", "caller": "0x7fff41dbd63b", "parentcaller": "0x7fff41dfc80c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002440" } ], "repeated": 0, "id": 3938 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 3939 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff41dbd64f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000255c" } ], "repeated": 0, "id": 3940 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 3941 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 3942 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "6160", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x18\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6160" } ], "repeated": 0, "id": 3943 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 3944 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4500", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xfe\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x94\\x11\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4500" } ], "repeated": 0, "id": 3945 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "6160", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x18\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6160" } ], "repeated": 0, "id": 3946 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 5, "id": 3947 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc68e6a", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 3948 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 3, "id": 3949 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001af4" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 3950 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 3951 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4696", "caller": "0x7ff79bc8a418", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af4" } ], "repeated": 0, "id": 3952 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 13, "id": 3953 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4500", "caller": "0x7fff5855dd9d", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001af4" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000430" }, { "name": "ObjectAttributesName", "value": "Windows.ApplicationModel.Internal.UserActivities.UserActivityHistoryPayload" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Internal.UserActivities.UserActivityHistoryPayload" } ], "repeated": 0, "id": 3954 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4500", "caller": "0x7fff5855ddf7", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001af4" }, { "name": "KeyInformation", "value": "\\xff97\\xfffc\\xffe7\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00\\xff96\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00A\\x00p\\x00p\\x00l\\x00i\\x00c\\x00a\\x00t\\x00i\\x00o\\x00n\\x00M\\x00o\\x00d\\x00e\\x00l\\x00.\\x00I\\x00n\\x00t\\x00e\\x00r\\x00n\\x00a\\x00l\\x00.\\x00U\\x00s\\x00e\\x00r\\x00A\\x00c\\x00t\\x00i\\x00v\\x00i\\x00t\\x00i\\x00e\\x00s\\x00.\\x00U\\x00s\\x00e\\x00r\\x00A\\x00c\\x00t\\x00i\\x00v\\x00i\\x00t\\x00y\\x00H\\x00i\\x00s\\x00t\\x00o\\x00r\\x00y\\x00P\\x00a\\x00y\\x00l\\x00o\\x00a\\x00d\\x00\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\xffc4\\x02%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0\r%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0EzX\\xffff\\x7f\\x00\\x00(c\\xffa4\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xffe2\\xffff\\x0b\\x00\\x00\\x00\\x00\\xff87\\xff9dNX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffe0\\xffc8\\xffc4\\x08\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00c\\xffa4\\x0c\\x00\\x00\\x00\\x00\\xffe0\\xffc8\\xffc4\\x08\\x00\\x00\\x00\\x00p\\x03\\xff80\\x0c\\x00\\x00\\x00\\x00\\xffc7\\xffb3\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\xfff6sNX\\xffff\\x7f\\x00\\x00\\x00!i\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffffp\\x03\\xff80\\x0c\\x00\\x00\\x00\\x00`\\xffde\\xffd8\\x08\\x00\\x00\\x00\\x00`\\xffde\\xffd8\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffe0\\xffc8\\xffc4\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x006\\xff8cYX\\xffff\\x7f\\x00\\x00\\x10?\\xffc8\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xffe3\\xffff\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xffe3\\xffff\\x0b\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 3955 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4500", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af4" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Internal.UserActivities.UserActivityHistoryPayload\\ActivationType" } ], "repeated": 0, "id": 3956 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4500", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001af4" }, { "name": "ValueName", "value": "Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Internal.UserActivities.UserActivityHistoryPayload\\Server" } ], "repeated": 0, "id": 3957 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4500", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff585700bb", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af4" }, { "name": "ValueName", "value": "DllPath" }, { "name": "Data", "value": "C:\\Windows\\System32\\cdprt.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Internal.UserActivities.UserActivityHistoryPayload\\DllPath" } ], "repeated": 0, "id": 3958 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4500", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af4" }, { "name": "ValueName", "value": "Threading" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Internal.UserActivities.UserActivityHistoryPayload\\Threading" } ], "repeated": 0, "id": 3959 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4500", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af4" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Internal.UserActivities.UserActivityHistoryPayload\\TrustLevel" } ], "repeated": 0, "id": 3960 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4500", "caller": "0x7fff584bc0fc", "parentcaller": "0x7fff58554170", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00001af4" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Internal.UserActivities.UserActivityHistoryPayload\\CustomAttributes" } ], "repeated": 0, "id": 3961 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4500", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001af4" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Internal.UserActivities.UserActivityHistoryPayload\\RemoteServer" } ], "repeated": 0, "id": 3962 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4500", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001af4" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Internal.UserActivities.UserActivityHistoryPayload\\ActivateAsUser" } ], "repeated": 0, "id": 3963 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4500", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001af4" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Internal.UserActivities.UserActivityHistoryPayload\\ActivateInSharedBroker" } ], "repeated": 0, "id": 3964 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4500", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001af4" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Internal.UserActivities.UserActivityHistoryPayload\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 3965 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4500", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58562222", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001af4" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Internal.UserActivities.UserActivityHistoryPayload\\Permissions" } ], "repeated": 0, "id": 3966 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4500", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001af4" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Internal.UserActivities.UserActivityHistoryPayload\\ActivateOnHostFlags" } ], "repeated": 0, "id": 3967 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4500", "caller": "0x7fff58557226", "parentcaller": "0x7fff5855ca23", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af4" } ], "repeated": 0, "id": 3968 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4500", "caller": "0x7fff584ccd6e", "parentcaller": "0x7fff584cc76f", "category": "system", "api": "IsDebuggerPresent", "status": false, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3969 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4500", "caller": "0x7fff5855dd9d", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001af4" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000430" }, { "name": "ObjectAttributesName", "value": "Windows.Data.Json.JsonObject" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Json.JsonObject" } ], "repeated": 0, "id": 3970 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4500", "caller": "0x7fff5855ddf7", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001af4" }, { "name": "KeyInformation", "value": "\\xff97\\xfffc\\xffe7\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x008\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00D\\x00a\\x00t\\x00a\\x00.\\x00J\\x00s\\x00o\\x00n\\x00.\\x00J\\x00s\\x00o\\x00n\\x00O\\x00b\\x00j\\x00e\\x00c\\x00t\\x00\\xffb0\r%\\x01\\x00\\x00\\x00\\x00\\x12\\x00\\x00\\x00\\x00\\x00\\x00\\x00k\\xffb8\\xfff7Y\\xffff\\x7f\\x00\\x00\\x11\\x00\\x16\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\xffc3\\x1a\\x01\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x15\\x01\\x00\\x00\\x00\\x00i\\xffdf\\xffff\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff8d%\\x01\\x00\\x00\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\xffc4\\x02%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0\r%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0EzX\\xffff\\x7f\\x00\\x00(c\\xffa4\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xffe0\\xffff\\x0b\\x00\\x00\\x00\\x00\\xff87\\xff9dNX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00PT\\xffa9\\x0c\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00c\\xffa4\\x0c\\x00\\x00\\x00\\x00PT\\xffa9\\x0c\\x00\\x00\\x00\\x00\\xfff0\\x0e\\xff80\\x0c\\x00\\x00\\x00\\x00\\xffc7\\xffb3\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\xfff6sNX\\xffff\\x7f\\x00\\x00\\x00!i\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xfff0\\x0e\\xff80\\x0c\\x00\\x00\\x00\\x00`\\xffde\\xffd8\\x08\\x00\\x00\\x00\\x00`\\xffde\\xffd8\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00PT\\xffa9\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x006\\xff8cYX\\xffff\\x7f\\x00\\x00\\x10?\\xffc8\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xffe1\\xffff\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xffe1\\xffff\\x0b\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 3971 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4500", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af4" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Json.JsonObject\\ActivationType" } ], "repeated": 0, "id": 3972 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4500", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001af4" }, { "name": "ValueName", "value": "Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Json.JsonObject\\Server" } ], "repeated": 0, "id": 3973 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4500", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff585700bb", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af4" }, { "name": "ValueName", "value": "DllPath" }, { "name": "Data", "value": "C:\\Windows\\System32\\Windows.Web.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Json.JsonObject\\DllPath" } ], "repeated": 0, "id": 3974 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4500", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af4" }, { "name": "ValueName", "value": "Threading" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Json.JsonObject\\Threading" } ], "repeated": 0, "id": 3975 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4500", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af4" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Json.JsonObject\\TrustLevel" } ], "repeated": 0, "id": 3976 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4500", "caller": "0x7fff584bc0fc", "parentcaller": "0x7fff58554170", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00001af4" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Json.JsonObject\\CustomAttributes" } ], "repeated": 0, "id": 3977 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4500", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001af4" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Json.JsonObject\\RemoteServer" } ], "repeated": 0, "id": 3978 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4500", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001af4" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Json.JsonObject\\ActivateAsUser" } ], "repeated": 0, "id": 3979 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4500", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001af4" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Json.JsonObject\\ActivateInSharedBroker" } ], "repeated": 0, "id": 3980 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4500", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001af4" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Json.JsonObject\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 3981 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4500", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58562222", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001af4" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Json.JsonObject\\Permissions" } ], "repeated": 0, "id": 3982 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4500", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001af4" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Json.JsonObject\\ActivateOnHostFlags" } ], "repeated": 0, "id": 3983 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4500", "caller": "0x7fff58557226", "parentcaller": "0x7fff5855ca23", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af4" } ], "repeated": 0, "id": 3984 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4500", "caller": "0x7fff584ccd6e", "parentcaller": "0x7fff584cc76f", "category": "system", "api": "IsDebuggerPresent", "status": false, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 3985 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4500", "caller": "0x7fff5855dd9d", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001af4" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000430" }, { "name": "ObjectAttributesName", "value": "Windows.Data.Json.JsonValue" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Json.JsonValue" } ], "repeated": 0, "id": 3986 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4500", "caller": "0x7fff5855ddf7", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001af4" }, { "name": "KeyInformation", "value": "\\xff97\\xfffc\\xffe7\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x006\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00D\\x00a\\x00t\\x00a\\x00.\\x00J\\x00s\\x00o\\x00n\\x00.\\x00J\\x00s\\x00o\\x00n\\x00V\\x00a\\x00l\\x00u\\x00e\\x00\\x00\\x00\\xffb0\r%\\x01\\x00\\x00\\x00\\x00\\x12\\x00\\x16\\x00\\x00\\x00\\x00\\x00k\\xffb8\\xfff7Y\\xffff\\x7f\\x00\\x00\\x11\\x00\\x16\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\xffc3\\x1a\\x01\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x15\\x01\\x00\\x00\\x00\\x00\\xff99\\xffe0\\xffff\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff8d%\\x01\\x00\\x00\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\xffc4\\x02%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0\r%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0EzX\\xffff\\x7f\\x00\\x00\\xffb8c\\xffa4\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xffe1\\xffff\\x0b\\x00\\x00\\x00\\x00\\xff87\\xff9dNX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0R\\xffa9\\x0c\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90c\\xffa4\\x0c\\x00\\x00\\x00\\x00\\xffd0R\\xffa9\\x0c\\x00\\x00\\x00\\x00p\\x08\\xff80\\x0c\\x00\\x00\\x00\\x00\\xffc7\\xffb3\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\xfff6sNX\\xffff\\x7f\\x00\\x00\\xff80\\x17i\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffffp\\x08\\xff80\\x0c\\x00\\x00\\x00\\x00\\xffa0\\xffe3\\xffd8\\x08\\x00\\x00\\x00\\x00\\xffa0\\xffe3\\xffd8\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0R\\xffa9\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x006\\xff8cYX\\xffff\\x7f\\x00\\x00pC\\xffc8\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xffe2\\xffff\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xffe2\\xffff\\x0b\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 3987 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4500", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af4" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Json.JsonValue\\ActivationType" } ], "repeated": 0, "id": 3988 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4500", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001af4" }, { "name": "ValueName", "value": "Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Json.JsonValue\\Server" } ], "repeated": 0, "id": 3989 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4500", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff585700bb", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af4" }, { "name": "ValueName", "value": "DllPath" }, { "name": "Data", "value": "C:\\Windows\\System32\\Windows.Web.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Json.JsonValue\\DllPath" } ], "repeated": 0, "id": 3990 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4500", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af4" }, { "name": "ValueName", "value": "Threading" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Json.JsonValue\\Threading" } ], "repeated": 0, "id": 3991 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4500", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af4" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Json.JsonValue\\TrustLevel" } ], "repeated": 0, "id": 3992 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4500", "caller": "0x7fff584bc0fc", "parentcaller": "0x7fff58554170", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00001af4" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Json.JsonValue\\CustomAttributes" } ], "repeated": 0, "id": 3993 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4500", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001af4" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Json.JsonValue\\RemoteServer" } ], "repeated": 0, "id": 3994 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4500", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001af4" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Json.JsonValue\\ActivateAsUser" } ], "repeated": 0, "id": 3995 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4500", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001af4" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Json.JsonValue\\ActivateInSharedBroker" } ], "repeated": 0, "id": 3996 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4500", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001af4" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Json.JsonValue\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 3997 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4500", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58562222", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001af4" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Json.JsonValue\\Permissions" } ], "repeated": 0, "id": 3998 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4500", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001af4" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Json.JsonValue\\ActivateOnHostFlags" } ], "repeated": 0, "id": 3999 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4500", "caller": "0x7fff58557226", "parentcaller": "0x7fff5855ca23", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af4" } ], "repeated": 0, "id": 4000 }, { "timestamp": "2026-05-29 01:05:21,633", "thread_id": "4500", "caller": "0x7fff584ccd6e", "parentcaller": "0x7fff584cc76f", "category": "system", "api": "IsDebuggerPresent", "status": false, "return": "0x00000000", "arguments": [], "repeated": 5, "id": 4001 }, { "timestamp": "2026-05-29 01:05:21,649", "thread_id": "4500", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff40c58e4b", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4002 }, { "timestamp": "2026-05-29 01:05:21,649", "thread_id": "4500", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff40c58e4b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af4" }, { "name": "Milliseconds", "value": "1000" } ], "repeated": 0, "id": 4003 }, { "timestamp": "2026-05-29 01:05:21,649", "thread_id": "4500", "caller": "0x7fff577d6785", "parentcaller": "0x7fff40b987fb", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af4" } ], "repeated": 0, "id": 4004 }, { "timestamp": "2026-05-29 01:05:21,649", "thread_id": "4500", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xfe\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x94\\x11\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4500" } ], "repeated": 0, "id": 4005 }, { "timestamp": "2026-05-29 01:05:21,649", "thread_id": "8568", "caller": "0x7fff40c07e93", "parentcaller": "0x7fff45dc916a", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4006 }, { "timestamp": "2026-05-29 01:05:21,649", "thread_id": "8568", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\xe3\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00x!\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "8568" } ], "repeated": 0, "id": 4007 }, { "timestamp": "2026-05-29 01:05:21,649", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 4008 }, { "timestamp": "2026-05-29 01:05:21,649", "thread_id": "4620", "caller": "0x7fff5781026b", "parentcaller": "0x7fff45dcb132", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00001af4" } ], "repeated": 0, "id": 4009 }, { "timestamp": "2026-05-29 01:05:21,649", "thread_id": "4620", "caller": "0x7fff577d6785", "parentcaller": "0x7fff45dcb190", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af4" } ], "repeated": 0, "id": 4010 }, { "timestamp": "2026-05-29 01:05:21,649", "thread_id": "4620", "caller": "0x7fff584d7b74", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000034a" }, { "name": "SubKey", "value": "CLSID\\{37987DB6-9D85-4381-8D7D-3189661223D1}" }, { "name": "Handle", "value": "0x00001af6" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{37987DB6-9D85-4381-8D7D-3189661223D1}" } ], "repeated": 0, "id": 4011 }, { "timestamp": "2026-05-29 01:05:21,649", "thread_id": "4620", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001af6" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{37987DB6-9D85-4381-8D7D-3189661223D1}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 4012 }, { "timestamp": "2026-05-29 01:05:21,649", "thread_id": "4620", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001af6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 4013 }, { "timestamp": "2026-05-29 01:05:21,649", "thread_id": "4620", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x00\\xd4 \\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\xf6\\x1a\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd5 \\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4014 }, { "timestamp": "2026-05-29 01:05:21,649", "thread_id": "4620", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{37987DB6-9D85-4381-8D7D-3189661223D1}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{37987DB6-9D85-4381-8D7D-3189661223D1}\\TreatAs" } ], "repeated": 0, "id": 4015 }, { "timestamp": "2026-05-29 01:05:21,649", "thread_id": "4620", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001af6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 4016 }, { "timestamp": "2026-05-29 01:05:21,649", "thread_id": "4620", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00001af6" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{37987DB6-9D85-4381-8D7D-3189661223D1}\\TreatAs" } ], "repeated": 0, "id": 4017 }, { "timestamp": "2026-05-29 01:05:21,649", "thread_id": "4620", "caller": "0x7fff585622e1", "parentcaller": "0x7fff584d7c1d", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001af6" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{37987DB6-9D85-4381-8D7D-3189661223D1}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 4018 }, { "timestamp": "2026-05-29 01:05:21,649", "thread_id": "4620", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d81f5", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af6" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{37987DB6-9D85-4381-8D7D-3189661223D1}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 4019 }, { "timestamp": "2026-05-29 01:05:21,649", "thread_id": "4620", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af6" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{37987DB6-9D85-4381-8D7D-3189661223D1}\\(Default)" } ], "repeated": 0, "id": 4020 }, { "timestamp": "2026-05-29 01:05:21,649", "thread_id": "4620", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af6" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "CDPComActivityStoreReader" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{37987DB6-9D85-4381-8D7D-3189661223D1}\\(Default)" } ], "repeated": 0, "id": 4021 }, { "timestamp": "2026-05-29 01:05:21,649", "thread_id": "4620", "caller": "0x7fff584d8485", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00001af6" }, { "name": "SubKey", "value": "InprocServer32" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{37987DB6-9D85-4381-8D7D-3189661223D1}\\InprocServer32" } ], "repeated": 0, "id": 4022 }, { "timestamp": "2026-05-29 01:05:21,649", "thread_id": "4620", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001af6" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{37987DB6-9D85-4381-8D7D-3189661223D1}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 4023 }, { "timestamp": "2026-05-29 01:05:21,649", "thread_id": "4620", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001af6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 4024 }, { "timestamp": "2026-05-29 01:05:21,649", "thread_id": "4620", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x90\\xd2 \\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\xf6\\x1a\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xd3 \\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4025 }, { "timestamp": "2026-05-29 01:05:21,649", "thread_id": "4620", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{37987DB6-9D85-4381-8D7D-3189661223D1}\\InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{37987DB6-9D85-4381-8D7D-3189661223D1}\\InprocHandler32" } ], "repeated": 0, "id": 4026 }, { "timestamp": "2026-05-29 01:05:21,649", "thread_id": "4620", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001af6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 4027 }, { "timestamp": "2026-05-29 01:05:21,649", "thread_id": "4620", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00001af6" }, { "name": "ObjectAttributesName", "value": "InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{37987DB6-9D85-4381-8D7D-3189661223D1}\\InprocHandler32" } ], "repeated": 0, "id": 4028 }, { "timestamp": "2026-05-29 01:05:21,649", "thread_id": "4620", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001af6" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{37987DB6-9D85-4381-8D7D-3189661223D1}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 4029 }, { "timestamp": "2026-05-29 01:05:21,649", "thread_id": "4620", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001af6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 4030 }, { "timestamp": "2026-05-29 01:05:21,649", "thread_id": "4620", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x90\\xd2 \\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\xf6\\x1a\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xd3 \\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4031 }, { "timestamp": "2026-05-29 01:05:21,649", "thread_id": "4620", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{37987DB6-9D85-4381-8D7D-3189661223D1}\\InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{37987DB6-9D85-4381-8D7D-3189661223D1}\\InprocHandler" } ], "repeated": 0, "id": 4032 }, { "timestamp": "2026-05-29 01:05:21,649", "thread_id": "4620", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001af6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 4033 }, { "timestamp": "2026-05-29 01:05:21,649", "thread_id": "4620", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00001af6" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{37987DB6-9D85-4381-8D7D-3189661223D1}\\InprocHandler" } ], "repeated": 0, "id": 4034 }, { "timestamp": "2026-05-29 01:05:21,649", "thread_id": "4620", "caller": "0x7fff584d8010", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af6" } ], "repeated": 0, "id": 4035 }, { "timestamp": "2026-05-29 01:05:21,649", "thread_id": "4620", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4036 }, { "timestamp": "2026-05-29 01:05:21,649", "thread_id": "4620", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000360" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 4037 }, { "timestamp": "2026-05-29 01:05:21,649", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 4038 }, { "timestamp": "2026-05-29 01:05:21,649", "thread_id": "4620", "caller": "0x7fff40c092ad", "parentcaller": "0x7fff40c0a354", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4039 }, { "timestamp": "2026-05-29 01:05:21,649", "thread_id": "4620", "caller": "0x7fff40c1e634", "parentcaller": "0x7fff40c1e545", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000011e4" }, { "name": "ValueName", "value": "02091777-C187-951A-0E4E-E98CEC442EC9" }, { "name": "Type", "value": "7", "pretty_value": "REG_MULTI_SZ" }, { "name": "Buffer", "value": "l" }, { "name": "BufferLength", "value": "268" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ActivityDataModel\\ReaderRevisionInfo\\02091777-C187-951A-0E4E-E98CEC442EC9" } ], "repeated": 0, "id": 4040 }, { "timestamp": "2026-05-29 01:05:21,649", "thread_id": "4620", "caller": "0x7fff5781026b", "parentcaller": "0x7fff45dcb132", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00001ab0" } ], "repeated": 0, "id": 4041 }, { "timestamp": "2026-05-29 01:05:21,649", "thread_id": "4620", "caller": "0x7fff577d6785", "parentcaller": "0x7fff45dcb190", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" } ], "repeated": 0, "id": 4042 }, { "timestamp": "2026-05-29 01:05:21,649", "thread_id": "4620", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4043 }, { "timestamp": "2026-05-29 01:05:21,649", "thread_id": "4620", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000360" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 4044 }, { "timestamp": "2026-05-29 01:05:21,649", "thread_id": "4620", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4045 }, { "timestamp": "2026-05-29 01:05:21,649", "thread_id": "4620", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000360" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 4046 }, { "timestamp": "2026-05-29 01:05:21,649", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 4047 }, { "timestamp": "2026-05-29 01:05:21,649", "thread_id": "4620", "caller": "0x7fff40c092ad", "parentcaller": "0x7fff40c0a354", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4048 }, { "timestamp": "2026-05-29 01:05:21,649", "thread_id": "4620", "caller": "0x7fff40c1e634", "parentcaller": "0x7fff40c1e545", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000011e4" }, { "name": "ValueName", "value": "02091777-C187-951A-0E4E-E98CEC442EC9" }, { "name": "Type", "value": "7", "pretty_value": "REG_MULTI_SZ" }, { "name": "Buffer", "value": "l" }, { "name": "BufferLength", "value": "268" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ActivityDataModel\\ReaderRevisionInfo\\02091777-C187-951A-0E4E-E98CEC442EC9" } ], "repeated": 0, "id": 4049 }, { "timestamp": "2026-05-29 01:05:21,649", "thread_id": "4620", "caller": "0x7fff5781026b", "parentcaller": "0x7fff45dcb132", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00001ab0" } ], "repeated": 0, "id": 4050 }, { "timestamp": "2026-05-29 01:05:21,649", "thread_id": "4620", "caller": "0x7fff577d6785", "parentcaller": "0x7fff45dcb190", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" } ], "repeated": 0, "id": 4051 }, { "timestamp": "2026-05-29 01:05:21,649", "thread_id": "4620", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4052 }, { "timestamp": "2026-05-29 01:05:21,649", "thread_id": "4620", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000360" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 4053 }, { "timestamp": "2026-05-29 01:05:21,649", "thread_id": "4620", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4054 }, { "timestamp": "2026-05-29 01:05:21,649", "thread_id": "4620", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000360" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 4055 }, { "timestamp": "2026-05-29 01:05:21,649", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 4056 }, { "timestamp": "2026-05-29 01:05:21,649", "thread_id": "4620", "caller": "0x7fff40c092ad", "parentcaller": "0x7fff40c0a354", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4057 }, { "timestamp": "2026-05-29 01:05:21,649", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 4058 }, { "timestamp": "2026-05-29 01:05:21,665", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc68e6a", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 2, "id": 4059 }, { "timestamp": "2026-05-29 01:05:21,665", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xdf\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x005\\x18\\xff\\x7f\\x00\\x00X\\xe0\\\\x03\\x00\\x00\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4060 }, { "timestamp": "2026-05-29 01:05:21,665", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab0" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 4061 }, { "timestamp": "2026-05-29 01:05:21,665", "thread_id": "4696", "caller": "0x7ff79bc8a418", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" } ], "repeated": 0, "id": 4062 }, { "timestamp": "2026-05-29 01:05:21,665", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "synchronization", "api": "NtOpenEvent", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "Handle", "value": "0x035cf7c0" }, { "name": "EventName", "value": "Local\\1ImmersiveFocusTrackingActiveEvent" } ], "repeated": 0, "id": 4063 }, { "timestamp": "2026-05-29 01:05:21,665", "thread_id": "4696", "caller": "0x7ff79bc220d4", "parentcaller": "0x7ff79bc2204d", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001680" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 4064 }, { "timestamp": "2026-05-29 01:05:21,665", "thread_id": "4696", "caller": "0x7ff79bc220d4", "parentcaller": "0x7ff79bc2204d", "category": "registry", "api": "NtCreateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001af4" }, { "name": "DesiredAccess", "value": "0x00000002", "pretty_value": "KEY_SET_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00001680" }, { "name": "ObjectAttributesName", "value": "TrayButtonClicked" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FeatureUsage\\TrayButtonClicked" }, { "name": "Class", "value": "" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 4065 }, { "timestamp": "2026-05-29 01:05:21,665", "thread_id": "4696", "caller": "0x7ff79bc220d4", "parentcaller": "0x7ff79bc2204d", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af4" }, { "name": "ValueName", "value": "StartButton" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Buffer", "value": "27" }, { "name": "BufferLength", "value": "4" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FeatureUsage\\TrayButtonClicked\\StartButton" } ], "repeated": 0, "id": 4066 }, { "timestamp": "2026-05-29 01:05:21,665", "thread_id": "4696", "caller": "0x7ff79bc220d4", "parentcaller": "0x7ff79bc2204d", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af4" } ], "repeated": 0, "id": 4067 }, { "timestamp": "2026-05-29 01:05:21,665", "thread_id": "4696", "caller": "0x7ff79be2974a", "parentcaller": "0x7ff79be29c11", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 4068 }, { "timestamp": "2026-05-29 01:05:21,665", "thread_id": "4696", "caller": "0x7ff79bc6b631", "parentcaller": "0x7ff79bc6b527", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "TaskbarMonitor" }, { "name": "Atom", "value": "0x0000c045" } ], "repeated": 0, "id": 4069 }, { "timestamp": "2026-05-29 01:05:21,665", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc69953", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 4070 }, { "timestamp": "2026-05-29 01:05:21,665", "thread_id": "4696", "caller": "0x7ff79be2976d", "parentcaller": "0x7ff79be29c11", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 4071 }, { "timestamp": "2026-05-29 01:05:21,665", "thread_id": "5000", "caller": "0x7fff42591d97", "parentcaller": "0x7fff42591e22", "category": "windows", "api": "FindWindowW", "status": false, "return": "0x00000000", "arguments": [ { "name": "ClassName", "value": "32768" }, { "name": "WindowName", "value": "" } ], "repeated": 0, "id": 4072 }, { "timestamp": "2026-05-29 01:05:21,665", "thread_id": "5000", "caller": "0x7fff42595b7f", "parentcaller": "0x7fff42595aa9", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CloudExperienceHost" }, { "name": "Handle", "value": "0x00001ab0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CloudExperienceHost" } ], "repeated": 0, "id": 4073 }, { "timestamp": "2026-05-29 01:05:21,665", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab0" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 4074 }, { "timestamp": "2026-05-29 01:05:21,665", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00001ab0" }, { "name": "ObjectAttributesName", "value": "Fullscreen" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CloudExperienceHost\\Fullscreen" } ], "repeated": 0, "id": 4075 }, { "timestamp": "2026-05-29 01:05:21,665", "thread_id": "5000", "caller": "0x7fff426bfce2", "parentcaller": "0x7fff42595aa9", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" } ], "repeated": 0, "id": 4076 }, { "timestamp": "2026-05-29 01:05:21,665", "thread_id": "5000", "caller": "0x7fff42595b7f", "parentcaller": "0x7fff42595aa9", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CloudExperienceHost" }, { "name": "Handle", "value": "0x00001ab0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CloudExperienceHost" } ], "repeated": 0, "id": 4077 }, { "timestamp": "2026-05-29 01:05:21,665", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab0" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 4078 }, { "timestamp": "2026-05-29 01:05:21,665", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00001ab0" }, { "name": "ObjectAttributesName", "value": "Fullscreen" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CloudExperienceHost\\Fullscreen" } ], "repeated": 0, "id": 4079 }, { "timestamp": "2026-05-29 01:05:21,665", "thread_id": "5000", "caller": "0x7fff426bfce2", "parentcaller": "0x7fff42595aa9", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" } ], "repeated": 0, "id": 4080 }, { "timestamp": "2026-05-29 01:05:21,665", "thread_id": "5000", "caller": "0x7fff4259fa9e", "parentcaller": "0x7fff425cea9e", "category": "windows", "api": "FindWindowW", "status": true, "return": "0x00010094", "arguments": [ { "name": "ClassName", "value": "Shell_TrayWnd" }, { "name": "WindowName", "value": "" } ], "repeated": 0, "id": 4081 }, { "timestamp": "2026-05-29 01:05:21,665", "thread_id": "5000", "caller": "0x7fff57fc2eeb", "parentcaller": "0x7fff581ba00f", "category": "synchronization", "api": "NtFindAtom", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "AtomName", "value": "IsAutoHideEnabled" }, { "name": "Atom", "value": "0x00000000" } ], "repeated": 0, "id": 4082 }, { "timestamp": "2026-05-29 01:05:21,665", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 4083 }, { "timestamp": "2026-05-29 01:05:21,665", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58085ee4", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002048" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 4084 }, { "timestamp": "2026-05-29 01:05:21,665", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 4085 }, { "timestamp": "2026-05-29 01:05:21,665", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 4086 }, { "timestamp": "2026-05-29 01:05:21,665", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58085ee4", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002048" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 4087 }, { "timestamp": "2026-05-29 01:05:21,665", "thread_id": "6160", "caller": "0x7fff584d7b74", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000034a" }, { "name": "SubKey", "value": "CLSID\\{11659A23-5884-4D1B-9CF6-67D6F4F90B36}" }, { "name": "Handle", "value": "0x00001ab2" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{11659A23-5884-4D1B-9CF6-67D6F4F90B36}" } ], "repeated": 0, "id": 4088 }, { "timestamp": "2026-05-29 01:05:21,665", "thread_id": "6160", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab2" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 4089 }, { "timestamp": "2026-05-29 01:05:21,665", "thread_id": "6160", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab2" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 4090 }, { "timestamp": "2026-05-29 01:05:21,665", "thread_id": "6160", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xc7i\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\xb2\\x1a\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\xc8i\r\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4091 }, { "timestamp": "2026-05-29 01:05:21,665", "thread_id": "6160", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\TreatAs" } ], "repeated": 0, "id": 4092 }, { "timestamp": "2026-05-29 01:05:21,665", "thread_id": "6160", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab2" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 4093 }, { "timestamp": "2026-05-29 01:05:21,665", "thread_id": "6160", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00001ab2" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\TreatAs" } ], "repeated": 0, "id": 4094 }, { "timestamp": "2026-05-29 01:05:21,665", "thread_id": "6160", "caller": "0x7fff585622e1", "parentcaller": "0x7fff584d7c1d", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab2" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 4095 }, { "timestamp": "2026-05-29 01:05:21,665", "thread_id": "6160", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d81f5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001ab2" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 4096 }, { "timestamp": "2026-05-29 01:05:21,665", "thread_id": "6160", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab2" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\(Default)" } ], "repeated": 0, "id": 4097 }, { "timestamp": "2026-05-29 01:05:21,665", "thread_id": "6160", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab2" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "Ptype_PSFactory" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\(Default)" } ], "repeated": 0, "id": 4098 }, { "timestamp": "2026-05-29 01:05:21,665", "thread_id": "6160", "caller": "0x7fff584d8485", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00001ab2" }, { "name": "SubKey", "value": "InprocServer32" }, { "name": "Handle", "value": "0x00001af2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\InprocServer32" } ], "repeated": 0, "id": 4099 }, { "timestamp": "2026-05-29 01:05:21,665", "thread_id": "6160", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001af2" }, { "name": "ValueName", "value": "InprocServer32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\InProcServer32\\InprocServer32" } ], "repeated": 0, "id": 4100 }, { "timestamp": "2026-05-29 01:05:21,665", "thread_id": "6160", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af2" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 4101 }, { "timestamp": "2026-05-29 01:05:21,665", "thread_id": "6160", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af2" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "C:\\Windows\\System32\\WinTypes.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 4102 }, { "timestamp": "2026-05-29 01:05:21,665", "thread_id": "6160", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d8d32", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af2" }, { "name": "ValueName", "value": "ThreadingModel" }, { "name": "Data", "value": "Both" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\InProcServer32\\ThreadingModel" } ], "repeated": 0, "id": 4103 }, { "timestamp": "2026-05-29 01:05:21,665", "thread_id": "6160", "caller": "0x7fff584d855f", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af2" } ], "repeated": 0, "id": 4104 }, { "timestamp": "2026-05-29 01:05:21,665", "thread_id": "6148", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff584fb0ca", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4105 }, { "timestamp": "2026-05-29 01:05:21,665", "thread_id": "6160", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab2" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 4106 }, { "timestamp": "2026-05-29 01:05:21,665", "thread_id": "6160", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab2" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 4107 }, { "timestamp": "2026-05-29 01:05:21,665", "thread_id": "6160", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\InprocHandler32" } ], "repeated": 0, "id": 4108 }, { "timestamp": "2026-05-29 01:05:21,665", "thread_id": "6160", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab2" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 4109 }, { "timestamp": "2026-05-29 01:05:21,665", "thread_id": "6160", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00001ab2" }, { "name": "ObjectAttributesName", "value": "InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\InprocHandler32" } ], "repeated": 0, "id": 4110 }, { "timestamp": "2026-05-29 01:05:21,665", "thread_id": "6160", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab2" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 4111 }, { "timestamp": "2026-05-29 01:05:21,665", "thread_id": "6148", "caller": "0x7fff584d7b74", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000034a" }, { "name": "SubKey", "value": "CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "Handle", "value": "0x00001af6" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" } ], "repeated": 0, "id": 4112 }, { "timestamp": "2026-05-29 01:05:21,665", "thread_id": "6160", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\InprocHandler" } ], "repeated": 0, "id": 4113 }, { "timestamp": "2026-05-29 01:05:21,665", "thread_id": "6148", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001af6" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 4114 }, { "timestamp": "2026-05-29 01:05:21,665", "thread_id": "6160", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab2" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 4115 }, { "timestamp": "2026-05-29 01:05:21,665", "thread_id": "6148", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001af6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 4116 }, { "timestamp": "2026-05-29 01:05:21,665", "thread_id": "6160", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00001ab2" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\InprocHandler" } ], "repeated": 0, "id": 4117 }, { "timestamp": "2026-05-29 01:05:21,665", "thread_id": "6148", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\TreatAs" } ], "repeated": 0, "id": 4118 }, { "timestamp": "2026-05-29 01:05:21,665", "thread_id": "6160", "caller": "0x7fff584d8010", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab2" } ], "repeated": 0, "id": 4119 }, { "timestamp": "2026-05-29 01:05:21,665", "thread_id": "6148", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001af6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 4120 }, { "timestamp": "2026-05-29 01:05:21,665", "thread_id": "6148", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00001af6" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\TreatAs" } ], "repeated": 0, "id": 4121 }, { "timestamp": "2026-05-29 01:05:21,665", "thread_id": "6148", "caller": "0x7fff585622e1", "parentcaller": "0x7fff584d7c1d", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001af6" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 4122 }, { "timestamp": "2026-05-29 01:05:21,665", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d81f5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001af6" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 4123 }, { "timestamp": "2026-05-29 01:05:21,665", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af6" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)" } ], "repeated": 0, "id": 4124 }, { "timestamp": "2026-05-29 01:05:21,665", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af6" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "PSFactoryBuffer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)" } ], "repeated": 0, "id": 4125 }, { "timestamp": "2026-05-29 01:05:21,665", "thread_id": "6160", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x18\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6160" } ], "repeated": 0, "id": 4126 }, { "timestamp": "2026-05-29 01:05:21,665", "thread_id": "6148", "caller": "0x7fff584d8485", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00001af6" }, { "name": "SubKey", "value": "InprocServer32" }, { "name": "Handle", "value": "0x0000255e" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocServer32" } ], "repeated": 0, "id": 4127 }, { "timestamp": "2026-05-29 01:05:21,665", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 4128 }, { "timestamp": "2026-05-29 01:05:21,665", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000255e" }, { "name": "ValueName", "value": "InprocServer32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\InprocServer32" } ], "repeated": 0, "id": 4129 }, { "timestamp": "2026-05-29 01:05:21,665", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000255e" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 4130 }, { "timestamp": "2026-05-29 01:05:21,665", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 4131 }, { "timestamp": "2026-05-29 01:05:21,665", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000255e" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "C:\\Windows\\System32\\OneCoreUAPCommonProxyStub.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 4132 }, { "timestamp": "2026-05-29 01:05:21,665", "thread_id": "6148", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d09b4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000255e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 4133 }, { "timestamp": "2026-05-29 01:05:21,665", "thread_id": "6148", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d09f7", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000255e" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 4134 }, { "timestamp": "2026-05-29 01:05:21,665", "thread_id": "6148", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xa0\\xb9Q\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00^%\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xbaQ\r\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4135 }, { "timestamp": "2026-05-29 01:05:21,665", "thread_id": "6148", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d09f7", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32" } ], "repeated": 0, "id": 4136 }, { "timestamp": "2026-05-29 01:05:21,665", "thread_id": "5000", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab2" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 4137 }, { "timestamp": "2026-05-29 01:05:21,665", "thread_id": "5000", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab2" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 4138 }, { "timestamp": "2026-05-29 01:05:21,665", "thread_id": "5000", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "p\\xc0\\x19\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\xb2\\x1a\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xc1\\x19\\x08\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4139 }, { "timestamp": "2026-05-29 01:05:21,665", "thread_id": "6148", "caller": "0x7fff577d3e41", "parentcaller": "0x7fff578543b9", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000255e" }, { "name": "ValueName", "value": "ThreadingModel" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "Both" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\ThreadingModel" } ], "repeated": 0, "id": 4140 }, { "timestamp": "2026-05-29 01:05:21,665", "thread_id": "5000", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\TreatAs" } ], "repeated": 0, "id": 4141 }, { "timestamp": "2026-05-29 01:05:21,665", "thread_id": "6148", "caller": "0x7fff584d855f", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000255e" } ], "repeated": 0, "id": 4142 }, { "timestamp": "2026-05-29 01:05:21,665", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab2" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 4143 }, { "timestamp": "2026-05-29 01:05:21,665", "thread_id": "6148", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001af6" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 4144 }, { "timestamp": "2026-05-29 01:05:21,665", "thread_id": "5000", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00001ab2" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\TreatAs" } ], "repeated": 0, "id": 4145 }, { "timestamp": "2026-05-29 01:05:21,665", "thread_id": "6148", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler32" } ], "repeated": 0, "id": 4146 }, { "timestamp": "2026-05-29 01:05:21,665", "thread_id": "6148", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001af6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 4147 }, { "timestamp": "2026-05-29 01:05:21,665", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d81f5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001ab2" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 4148 }, { "timestamp": "2026-05-29 01:05:21,665", "thread_id": "6148", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001af6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 4149 }, { "timestamp": "2026-05-29 01:05:21,665", "thread_id": "6148", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "p\\xbaQ\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\xf6\\x1a\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xbbQ\r\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4150 }, { "timestamp": "2026-05-29 01:05:21,665", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab2" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)" } ], "repeated": 0, "id": 4151 }, { "timestamp": "2026-05-29 01:05:21,665", "thread_id": "6148", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001af6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 4152 }, { "timestamp": "2026-05-29 01:05:21,665", "thread_id": "6148", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00001af6" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler" } ], "repeated": 0, "id": 4153 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "6148", "caller": "0x7fff584d8010", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af6" } ], "repeated": 0, "id": 4154 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab2" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "PSFactoryBuffer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)" } ], "repeated": 0, "id": 4155 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff584d8485", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00001ab2" }, { "name": "SubKey", "value": "InprocServer32" }, { "name": "Handle", "value": "0x00001af2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocServer32" } ], "repeated": 0, "id": 4156 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001af2" }, { "name": "ValueName", "value": "InprocServer32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\InprocServer32" } ], "repeated": 0, "id": 4157 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af2" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 4158 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af2" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "C:\\Windows\\System32\\OneCoreUAPCommonProxyStub.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 4159 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d8d32", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af2" }, { "name": "ValueName", "value": "ThreadingModel" }, { "name": "Data", "value": "Both" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\ThreadingModel" } ], "repeated": 0, "id": 4160 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff584d855f", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af2" } ], "repeated": 0, "id": 4161 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab2" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 4162 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab2" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 4163 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x00\\xbf\\x19\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\xb2\\x1a\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\x19\\x08\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4164 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler32" } ], "repeated": 0, "id": 4165 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab2" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 4166 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00001ab2" }, { "name": "ObjectAttributesName", "value": "InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler32" } ], "repeated": 0, "id": 4167 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "6148", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff584c6d2f", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000252c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 4168 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab2" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 4169 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab2" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 4170 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "6160", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x18\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6160" } ], "repeated": 0, "id": 4171 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x00\\xbf\\x19\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\xb2\\x1a\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\x19\\x08\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4172 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler" } ], "repeated": 0, "id": 4173 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab2" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 4174 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00001ab2" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler" } ], "repeated": 0, "id": 4175 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "6148", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4176 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "6148", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000360" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 4177 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff584d8010", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab2" } ], "repeated": 0, "id": 4178 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "6148", "caller": "0x7fff58552db5", "parentcaller": "0x7fff58552d47", "category": "registry", "api": "RegNotifyChangeKeyValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\" }, { "name": "NotifyFilter", "value": "0x10000005" }, { "name": "WatchSubtree", "value": "1" }, { "name": "Asynchronous", "value": "1" } ], "repeated": 0, "id": 4179 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "6148", "caller": "0x7fff584d7b74", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000034a" }, { "name": "SubKey", "value": "CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "Handle", "value": "0x00002552" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" } ], "repeated": 0, "id": 4180 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "6148", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002552" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 4181 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "6148", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002552" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 4182 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "6148", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xbeQ\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00R%\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\xbfQ\r\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4183 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58085ee4", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002048" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 4184 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 4185 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "6148", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\TreatAs" } ], "repeated": 0, "id": 4186 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "6148", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002552" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 4187 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "6148", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00002552" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\TreatAs" } ], "repeated": 0, "id": 4188 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "6148", "caller": "0x7fff585622e1", "parentcaller": "0x7fff584d7c1d", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002552" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 4189 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "6160", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x18\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6160" } ], "repeated": 0, "id": 4190 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d81f5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002552" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 4191 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002552" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)" } ], "repeated": 0, "id": 4192 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "6160", "caller": "0x7fff425966ba", "parentcaller": "0x7fff425c804a", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "25" }, { "name": "ProcessInformation", "value": "\\x01" } ], "repeated": 0, "id": 4193 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "6148", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002552" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 4194 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "6148", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000254c" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00002552" }, { "name": "ObjectAttributesName", "value": "InprocServer32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocServer32" } ], "repeated": 0, "id": 4195 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000254e" }, { "name": "ValueName", "value": "InprocServer32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\InprocServer32" } ], "repeated": 0, "id": 4196 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000254e" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 4197 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000254e" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "C:\\Windows\\System32\\OneCoreUAPCommonProxyStub.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 4198 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "6160", "caller": "0x7fff42597dbd", "parentcaller": "0x7fff425966d6", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "25" }, { "name": "ProcessInformation", "value": "\\x01" } ], "repeated": 0, "id": 4199 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "6160", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x18\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6160" } ], "repeated": 0, "id": 4200 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d8d32", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000254e" }, { "name": "ValueName", "value": "ThreadingModel" }, { "name": "Data", "value": "Both" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\ThreadingModel" } ], "repeated": 0, "id": 4201 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff42595b7f", "parentcaller": "0x7fff42595aa9", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CloudExperienceHost" }, { "name": "Handle", "value": "0x00001ab0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CloudExperienceHost" } ], "repeated": 0, "id": 4202 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "6148", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002552" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 4203 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab0" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 4204 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "6148", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler32" } ], "repeated": 0, "id": 4205 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00001ab0" }, { "name": "ObjectAttributesName", "value": "Fullscreen" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CloudExperienceHost\\Fullscreen" } ], "repeated": 0, "id": 4206 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff426bfce2", "parentcaller": "0x7fff42595aa9", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" } ], "repeated": 0, "id": 4207 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "6148", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00002552" }, { "name": "ObjectAttributesName", "value": "InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler32" } ], "repeated": 0, "id": 4208 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "6148", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002552" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 4209 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "6148", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002552" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 4210 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff4274356a", "parentcaller": "0x7fff42799839", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x00000002", "pretty_value": "KEY_SET_VALUE" }, { "name": "Handle", "value": "0x00001ab0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 4211 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff427435a9", "parentcaller": "0x7fff42799839", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" }, { "name": "ValueName", "value": "TraySearchBoxVisible" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Buffer", "value": "0" }, { "name": "BufferLength", "value": "4" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\TraySearchBoxVisible" } ], "repeated": 0, "id": 4212 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "6148", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00002552" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler" } ], "repeated": 0, "id": 4213 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "6148", "caller": "0x7fff584d8010", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002552" } ], "repeated": 0, "id": 4214 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 4215 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 4216 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab0" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced" } ], "repeated": 0, "id": 4217 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff425e8fa6", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001ab0" }, { "name": "ValueName", "value": "TaskbarSmallIcons" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\TaskbarSmallIcons" } ], "repeated": 0, "id": 4218 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff577d3018", "parentcaller": "0x7fff425e8fa6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" } ], "repeated": 0, "id": 4219 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 4220 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 4221 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" } ], "repeated": 0, "id": 4222 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 4223 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 4224 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "6148", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff584fb0ca", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4225 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab0" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" } ], "repeated": 0, "id": 4226 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001ab0" }, { "name": "ValueName", "value": "Current" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Current" } ], "repeated": 0, "id": 4227 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "6148", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4228 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "6148", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000360" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 4229 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff577d3018", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" } ], "repeated": 0, "id": 4230 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 4231 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 4232 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab0" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" } ], "repeated": 0, "id": 4233 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff425d8e48", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" }, { "name": "ValueName", "value": "ColorPrevalence" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\\ColorPrevalence" } ], "repeated": 0, "id": 4234 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff577d3018", "parentcaller": "0x7fff425d8e48", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" } ], "repeated": 0, "id": 4235 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 4236 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 4237 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab0" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" } ], "repeated": 0, "id": 4238 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff425d8ef6", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" }, { "name": "ValueName", "value": "AppsUseLightTheme" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\\AppsUseLightTheme" } ], "repeated": 0, "id": 4239 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff577d3018", "parentcaller": "0x7fff425d8ef6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" } ], "repeated": 0, "id": 4240 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 4241 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 4242 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab0" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced" } ], "repeated": 0, "id": 4243 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff425da184", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" }, { "name": "ValueName", "value": "HideFileExt" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\HideFileExt" } ], "repeated": 0, "id": 4244 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff577d3018", "parentcaller": "0x7fff425da184", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" } ], "repeated": 0, "id": 4245 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 4246 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 4247 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab0" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search" } ], "repeated": 0, "id": 4248 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff425940dd", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" }, { "name": "ValueName", "value": "SearchboxTaskbarMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\SearchboxTaskbarMode" } ], "repeated": 0, "id": 4249 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff577d3018", "parentcaller": "0x7fff425940dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" } ], "repeated": 0, "id": 4250 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff5855dd9d", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab0" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000430" }, { "name": "ObjectAttributesName", "value": "Windows.Foundation.Collections.ValueSet" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet" } ], "repeated": 0, "id": 4251 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff5855ddf7", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab0" }, { "name": "KeyInformation", "value": "\\xff97\\xfffc\\xffe7\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00N\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00F\\x00o\\x00u\\x00n\\x00d\\x00a\\x00t\\x00i\\x00o\\x00n\\x00.\\x00C\\x00o\\x00l\\x00l\\x00e\\x00c\\x00t\\x00i\\x00o\\x00n\\x00s\\x00.\\x00V\\x00a\\x00l\\x00u\\x00e\\x00S\\x00e\\x00t\\x00\\x00\\x00\\x12\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\xffc3\\x1a\\x01\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x15\\x01\\x00\\x00\\x00\\x00)\\xffd9\\x19\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff8d%\\x01\\x00\\x00\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\xffc4\\x02%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0\r%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0EzX\\xffff\\x7f\\x00\\x00\\xffd8[\\xffa4\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffda\\x19\\x08\\x00\\x00\\x00\\x00\\xff87\\xff9dNX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x17i\\x07\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0[\\xffa4\\x0c\\x00\\x00\\x00\\x00\\xff80\\x17i\\x07\\x00\\x00\\x00\\x000\\x0b\\xff80\\x0c\\x00\\x00\\x00\\x00\\xffc7\\xffb3\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\xfff6sNX\\xffff\\x7f\\x00\\x00\\x00!i\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff0\\x0b\\xff80\\x0c\\x00\\x00\\x00\\x000\\xffe3\\xffd8\\x08\\x00\\x00\\x00\\x000\\xffe3\\xffd8\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x17i\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x006\\xff8cYX\\xffff\\x7f\\x00\\x00\\xff90\\x1bz\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff0\\xffda\\x19\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff0\\xffda\\x19\\x08\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 4252 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\ActivationType" } ], "repeated": 0, "id": 4253 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001ab0" }, { "name": "ValueName", "value": "Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\Server" } ], "repeated": 0, "id": 4254 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff585700bb", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" }, { "name": "ValueName", "value": "DllPath" }, { "name": "Data", "value": "C:\\Windows\\System32\\WinTypes.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\DllPath" } ], "repeated": 0, "id": 4255 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" }, { "name": "ValueName", "value": "Threading" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\Threading" } ], "repeated": 0, "id": 4256 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\TrustLevel" } ], "repeated": 0, "id": 4257 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff584bc0fc", "parentcaller": "0x7fff58554170", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00001ab0" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\CustomAttributes" } ], "repeated": 0, "id": 4258 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001ab0" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\RemoteServer" } ], "repeated": 0, "id": 4259 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001ab0" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\ActivateAsUser" } ], "repeated": 0, "id": 4260 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001ab0" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\ActivateInSharedBroker" } ], "repeated": 0, "id": 4261 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001ab0" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 4262 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58562222", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001ab0" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\Permissions" } ], "repeated": 0, "id": 4263 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001ab0" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\ActivateOnHostFlags" } ], "repeated": 0, "id": 4264 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff58557226", "parentcaller": "0x7fff5855ca23", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" } ], "repeated": 0, "id": 4265 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff584ccd6e", "parentcaller": "0x7fff584cdb75", "category": "system", "api": "IsDebuggerPresent", "status": false, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4266 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff5855dd9d", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab0" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000430" }, { "name": "ObjectAttributesName", "value": "Windows.Foundation.PropertyValue" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue" } ], "repeated": 0, "id": 4267 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff5855ddf7", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab0" }, { "name": "KeyInformation", "value": "\\xff97\\xfffc\\xffe7\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00@\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00F\\x00o\\x00u\\x00n\\x00d\\x00a\\x00t\\x00i\\x00o\\x00n\\x00.\\x00P\\x00r\\x00o\\x00p\\x00e\\x00r\\x00t\\x00y\\x00V\\x00a\\x00l\\x00u\\x00e\\x00\\x13\\x00\\x08\\x00\\x00\\x00\\x00\\x00k\\xffb8\\xfff7Y\\xffff\\x7f\\x00\\x00\\x12\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\xffc3\\x1a\\x01\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x15\\x01\\x00\\x00\\x00\\x00\\xfff9\\xffd4\\x19\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff8d%\\x01\\x00\\x00\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\xffc4\\x02%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0\r%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0EzX\\xffff\\x7f\\x00\\x00(Z\\xffa4\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xffd5\\x19\\x08\\x00\\x00\\x00\\x00\\xff87\\xff9dNX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffa0\\xffe3\\xffd8\\x08\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00Z\\xffa4\\x0c\\x00\\x00\\x00\\x00\\xffa0\\xffe3\\xffd8\\x08\\x00\\x00\\x00\\x00\\xfff0\\x0e\\xff80\\x0c\\x00\\x00\\x00\\x00\\xffc7\\xffb3\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\xfff6sNX\\xffff\\x7f\\x00\\x00\\xff80\\x17i\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xfff0\\x0e\\xff80\\x0c\\x00\\x00\\x00\\x00`\\xffde\\xffd8\\x08\\x00\\x00\\x00\\x00`\\xffde\\xffd8\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffa0\\xffe3\\xffd8\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x006\\xff8cYX\\xffff\\x7f\\x00\\x00\\xffc0\\x13z\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffc0\\xffd6\\x19\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffc0\\xffd6\\x19\\x08\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 4268 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\ActivationType" } ], "repeated": 0, "id": 4269 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001ab0" }, { "name": "ValueName", "value": "Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\Server" } ], "repeated": 0, "id": 4270 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff585700bb", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" }, { "name": "ValueName", "value": "DllPath" }, { "name": "Data", "value": "C:\\Windows\\System32\\WinTypes.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\DllPath" } ], "repeated": 0, "id": 4271 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" }, { "name": "ValueName", "value": "Threading" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\Threading" } ], "repeated": 0, "id": 4272 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\TrustLevel" } ], "repeated": 0, "id": 4273 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff584bc0fc", "parentcaller": "0x7fff58554170", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00001ab0" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\CustomAttributes" } ], "repeated": 0, "id": 4274 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001ab0" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\RemoteServer" } ], "repeated": 0, "id": 4275 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001ab0" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\ActivateAsUser" } ], "repeated": 0, "id": 4276 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001ab0" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\ActivateInSharedBroker" } ], "repeated": 0, "id": 4277 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001ab0" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 4278 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58562222", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001ab0" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\Permissions" } ], "repeated": 0, "id": 4279 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001ab0" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\ActivateOnHostFlags" } ], "repeated": 0, "id": 4280 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff58557226", "parentcaller": "0x7fff5855ca23", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" } ], "repeated": 0, "id": 4281 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff584ccd6e", "parentcaller": "0x7fff584cc76f", "category": "system", "api": "IsDebuggerPresent", "status": false, "return": "0x00000000", "arguments": [ { "name": "Status", "value": "Log limit reached" } ], "repeated": 0, "id": 4282 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff5855dd9d", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002438" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000430" }, { "name": "ObjectAttributesName", "value": "Windows.Storage.Streams.DataWriter" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter" } ], "repeated": 0, "id": 4283 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff5855ddf7", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002438" }, { "name": "KeyInformation", "value": "N\\xffc1\\xffec\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00D\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00S\\x00t\\x00o\\x00r\\x00a\\x00g\\x00e\\x00.\\x00S\\x00t\\x00r\\x00e\\x00a\\x00m\\x00s\\x00.\\x00D\\x00a\\x00t\\x00a\\x00W\\x00r\\x00i\\x00t\\x00e\\x00r\\x00\\x00\\x00\\x00\\x00k\\xffb8\\xfff7Y\\xffff\\x7f\\x00\\x00\\x11\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\xffc3\\x1a\\x01\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x15\\x01\\x00\\x00\\x00\\x00\t\\xffd5\\x19\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff8d%\\x01\\x00\\x00\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\xffc4\\x02%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0\r%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0EzX\\xffff\\x7f\\x00\\x00\\x18g\\xffa4\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffe0\\xffd5\\x19\\x08\\x00\\x00\\x00\\x00\\xff87\\xff9dNX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffc0\\x18\\xff80\\x0c\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff0f\\xffa4\\x0c\\x00\\x00\\x00\\x00\\xffc0\\x18\\xff80\\x0c\\x00\\x00\\x00\\x00\\xfff0\\x02\\xff80\\x0c\\x00\\x00\\x00\\x00\\xffc7\\xffb3\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\xfff6sNX\\xffff\\x7f\\x00\\x00\\x00!i\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xfff0\\x02\\xff80\\x0c\\x00\\x00\\x00\\x00`\\x1b\\xff80\\x0c\\x00\\x00\\x00\\x00`\\x1b\\xff80\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffc0\\x18\\xff80\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00YB\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x006\\xff8cYX\\xffff\\x7f\\x00\\x00pC\\xffc8\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xffd6\\x19\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xffd6\\x19\\x08\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 4284 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivationType" } ], "repeated": 0, "id": 4285 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\Server" } ], "repeated": 0, "id": 4286 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff585700bb", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "DllPath" }, { "name": "Data", "value": "C:\\Windows\\System32\\WinTypes.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\DllPath" } ], "repeated": 0, "id": 4287 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "Threading" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\Threading" } ], "repeated": 0, "id": 4288 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\TrustLevel" } ], "repeated": 0, "id": 4289 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff584bc0fc", "parentcaller": "0x7fff58554170", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00002438" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\CustomAttributes" } ], "repeated": 0, "id": 4290 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\RemoteServer" } ], "repeated": 0, "id": 4291 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateAsUser" } ], "repeated": 0, "id": 4292 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateInSharedBroker" } ], "repeated": 0, "id": 4293 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 4294 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58562222", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\Permissions" } ], "repeated": 0, "id": 4295 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateOnHostFlags" } ], "repeated": 0, "id": 4296 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff58557226", "parentcaller": "0x7fff5855ca23", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 4297 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 1, "id": 4298 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58085ee4", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002048" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 4299 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "4620", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff517e2bd6", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000017d8" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "6136" }, { "name": "ProcessName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe" } ], "repeated": 0, "id": 4300 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "4620", "caller": "0x7fff5781026b", "parentcaller": "0x7fff517e2c2a", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000017d8" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00001838" } ], "repeated": 0, "id": 4301 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "4620", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff517e2c87", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 4302 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "4620", "caller": "0x7fff577d6785", "parentcaller": "0x7fff517e2cbb", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001838" } ], "repeated": 0, "id": 4303 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 4304 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58085ee4", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002048" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 4305 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "4696", "caller": "0x7ff79be2976d", "parentcaller": "0x7ff79be29c11", "category": "synchronization", "api": "NtOpenEvent", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "Handle", "value": "0x035cdb80" }, { "name": "EventName", "value": "Local\\1ImmersiveFocusTrackingActiveEvent" } ], "repeated": 0, "id": 4306 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "4696", "caller": "0x7ff79be2976d", "parentcaller": "0x7ff79be29c11", "category": "misc", "api": "GetKeyboardLayout", "status": true, "return": "0x04090409", "arguments": [ { "name": "KeyboardLayout", "value": "0x00000409" }, { "name": "LanguageName", "value": "English (United States)" } ], "repeated": 0, "id": 4307 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "4696", "caller": "0x7ff79be2976d", "parentcaller": "0x7ff79be29c11", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4308 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "4696", "caller": "0x7ff79be2976d", "parentcaller": "0x7ff79be29c11", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 4309 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "4696", "caller": "0x7ff79be2976d", "parentcaller": "0x7ff79be29c11", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" } ], "repeated": 0, "id": 4310 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "4620", "caller": "0x7fff577d6785", "parentcaller": "0x7fff517e2cd5", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000017d8" } ], "repeated": 0, "id": 4311 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "4620", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff517e29b1", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002438" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "6136" }, { "name": "ProcessName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe" } ], "repeated": 0, "id": 4312 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "4620", "caller": "0x7fff5781026b", "parentcaller": "0x7fff517e29fb", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002438" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000256c" } ], "repeated": 0, "id": 4313 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "4620", "caller": "0x7fff59f9413e", "parentcaller": "0x7fff517e2a39", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 4314 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "4620", "caller": "0x7fff59f9416d", "parentcaller": "0x7fff517e2a39", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "31" }, { "name": "TokenInformation", "value": "\\xd8\\xf3 \\x03\\x00\\x00\\x00\\x00\\x01\\x08\\x00\\x00\\x00\\x00\\x00\\x0f\\x02\\x00\\x00\\x00<\\xe6\\xf3\\x1f\\x8a.\\x82*u\\xa8\\x8a?\\x1b(\\xed\\xbf9\\x8fA\\x14\\x0c\\xfc9u]5\n`8$\\x00\\x00\\x00\\x00\\x00\\x00\\xc2Tc\\x1a\\xff\\x7f\\x00\\x008$\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4315 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "4620", "caller": "0x7fff59f941a8", "parentcaller": "0x7fff517e2a39", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "42" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4316 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "4620", "caller": "0x7fff59f941df", "parentcaller": "0x7fff517e2a39", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "12" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 4317 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "4620", "caller": "0x7fff59f94256", "parentcaller": "0x7fff517e2a39", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "44" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x1c*y^t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xc8\\xf9 \\x03\\x00\\x00\\x00\\x00\\xf8\\x17\\x00\\x00\\x00\\x00\\x00\\x000a\\x88\\x10\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4318 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "4620", "caller": "0x7fff577d6785", "parentcaller": "0x7fff517e2a5b", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 4319 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "4620", "caller": "0x7fff577d6785", "parentcaller": "0x7fff517e2a75", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 4320 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "4620", "caller": "0x7fff577cf588", "parentcaller": "0x7fff517ead8b", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002438" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "Global\\Session\\1\\AppContainerNamedObjects\\S-1-15-2-536077884-713174666-1066051701-3219990555-339840825-1966734348-1611281757\\17f8HWNDInterface:1019e" } ], "repeated": 0, "id": 4321 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "4620", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c232", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002438" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0b2d0000" }, { "name": "SectionOffset", "value": "0x0320f950" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4322 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "4620", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0cb2e000" }, { "name": "RegionSize", "value": "0x00011000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4323 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "4620", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff517eae5e", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0b2d0000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 4324 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "4620", "caller": "0x7fff577d6785", "parentcaller": "0x7fff517eae6d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 4325 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "4696", "caller": "0x7ff79be2976d", "parentcaller": "0x7ff79be29c11", "category": "misc", "api": "GetKeyboardLayout", "status": true, "return": "0x04090409", "arguments": [ { "name": "KeyboardLayout", "value": "0x00000409" }, { "name": "LanguageName", "value": "English (United States)" } ], "repeated": 0, "id": 4326 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "4696", "caller": "0x7ff79be2976d", "parentcaller": "0x7ff79be29c11", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000100a8" }, { "name": "Message", "value": "0x00000060" } ], "repeated": 0, "id": 4327 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "4696", "caller": "0x7ff79be2976d", "parentcaller": "0x7ff79be29c11", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xf0\\xd6\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xa7=\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xaa\\x01\\x03I\\xff\\x7f\\x00\\x00\\xb0\\xef\\x08I\\xff\\x7f\\x00\\x00" } ], "repeated": 0, "id": 4328 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "4696", "caller": "0x7ff79be2976d", "parentcaller": "0x7ff79be29c11", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab0" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 4329 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "4696", "caller": "0x7ff79be2976d", "parentcaller": "0x7ff79be29c11", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00001ab0" }, { "name": "SubKey", "value": "Software\\Policies\\Microsoft\\InputMethod\\Settings\\JPN" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\InputMethod\\Settings\\JPN" } ], "repeated": 0, "id": 4330 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "4696", "caller": "0x7ff79be2976d", "parentcaller": "0x7ff79be29c11", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" } ], "repeated": 0, "id": 4331 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "4696", "caller": "0x7ff79be2976d", "parentcaller": "0x7ff79be29c11", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\default\\TextInput\\ConfigureJapaneseIMEVersion" }, { "name": "Handle", "value": "0x00001ab0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\TextInput\\ConfigureJapaneseIMEVersion" } ], "repeated": 0, "id": 4332 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "4696", "caller": "0x7ff79be2976d", "parentcaller": "0x7ff79be29c11", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" }, { "name": "ValueName", "value": "PolicyType" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\TextInput\\ConfigureJapaneseIMEVersion\\PolicyType" } ], "repeated": 0, "id": 4333 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "4696", "caller": "0x7ff79be2976d", "parentcaller": "0x7ff79be29c11", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" }, { "name": "ValueName", "value": "Behavior" }, { "name": "Data", "value": "73760" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\TextInput\\ConfigureJapaneseIMEVersion\\Behavior" } ], "repeated": 0, "id": 4334 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "4696", "caller": "0x7ff79be2976d", "parentcaller": "0x7ff79be29c11", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" }, { "name": "ValueName", "value": "MergeAlgorithm" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\TextInput\\ConfigureJapaneseIMEVersion\\MergeAlgorithm" } ], "repeated": 0, "id": 4335 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "4696", "caller": "0x7ff79be2976d", "parentcaller": "0x7ff79be29c11", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001ab0" }, { "name": "ValueName", "value": "RegKeyPathRedirectMapped" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\TextInput\\ConfigureJapaneseIMEVersion\\RegKeyPathRedirectMapped" } ], "repeated": 0, "id": 4336 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "4696", "caller": "0x7ff79be2976d", "parentcaller": "0x7ff79be29c11", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001ab0" }, { "name": "ValueName", "value": "RegKeyPathRedirect" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\TextInput\\ConfigureJapaneseIMEVersion\\RegKeyPathRedirect" } ], "repeated": 0, "id": 4337 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "4696", "caller": "0x7ff79be2976d", "parentcaller": "0x7ff79be29c11", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001ab0" }, { "name": "ValueName", "value": "grouppolicyname" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\TextInput\\ConfigureJapaneseIMEVersion\\grouppolicyname" } ], "repeated": 0, "id": 4338 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "4696", "caller": "0x7ff79be2976d", "parentcaller": "0x7ff79be29c11", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001ab0" }, { "name": "ValueName", "value": "ADMXMetadataUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\TextInput\\ConfigureJapaneseIMEVersion\\ADMXMetadataUser" } ], "repeated": 0, "id": 4339 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "4696", "caller": "0x7ff79be2976d", "parentcaller": "0x7ff79be29c11", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001ab0" }, { "name": "ValueName", "value": "ADMXMetadataDevice" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\TextInput\\ConfigureJapaneseIMEVersion\\ADMXMetadataDevice" } ], "repeated": 0, "id": 4340 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "4696", "caller": "0x7ff79be2976d", "parentcaller": "0x7ff79be29c11", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001ab0" }, { "name": "ValueName", "value": "ADMXMetadataBoth" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\TextInput\\ConfigureJapaneseIMEVersion\\ADMXMetadataBoth" } ], "repeated": 0, "id": 4341 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "4696", "caller": "0x7ff79be2976d", "parentcaller": "0x7ff79be29c11", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001ab0" }, { "name": "ValueName", "value": "30Value" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\TextInput\\ConfigureJapaneseIMEVersion\\30Value" } ], "repeated": 0, "id": 4342 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "4696", "caller": "0x7ff79be2976d", "parentcaller": "0x7ff79be29c11", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" }, { "name": "ValueName", "value": "Value" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\TextInput\\ConfigureJapaneseIMEVersion\\Value" } ], "repeated": 0, "id": 4343 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "4696", "caller": "0x7ff79be2976d", "parentcaller": "0x7ff79be29c11", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" } ], "repeated": 0, "id": 4344 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "4696", "caller": "0x7ff79be2976d", "parentcaller": "0x7ff79be29c11", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\TextInput" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\TextInput" } ], "repeated": 1, "id": 4345 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "4696", "caller": "0x7ff79be2976d", "parentcaller": "0x7ff79be29c11", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 4346 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "4696", "caller": "0x7ff79be2976d", "parentcaller": "0x7ff79be29c11", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 4347 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "4696", "caller": "0x7ff79be2976d", "parentcaller": "0x7ff79be29c11", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Input\\TSF\\Tsf3Override\\{03b5835f-f03c-411b-9ce2-aa23e1171e36}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Input\\TSF\\Tsf3Override\\{03b5835f-f03c-411b-9ce2-aa23e1171e36}" } ], "repeated": 0, "id": 4348 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "4620", "caller": "0x7fff4cbd12d2", "parentcaller": "0x7fff577adc16", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache" }, { "name": "Handle", "value": "0x00001ab0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache" } ], "repeated": 0, "id": 4349 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "4620", "caller": "0x7fff4cbd1a81", "parentcaller": "0x7fff4cbd138a", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00001ab0" }, { "name": "SubKey", "value": "Metadata" }, { "name": "Handle", "value": "0x00001af0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Metadata" } ], "repeated": 0, "id": 4350 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577af579", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00001ab0" }, { "name": "SubKey", "value": "Package\\Index\\PackageFullName\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy" }, { "name": "Handle", "value": "0x00001ab4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Index\\PackageFullName\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy" } ], "repeated": 0, "id": 4351 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "4620", "caller": "0x7fff4cbd1732", "parentcaller": "0x7fff577af7dc", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab4" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "1a" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Index\\PackageFullName\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\\1a" } ], "repeated": 0, "id": 4352 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "4620", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577af5fd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab4" } ], "repeated": 0, "id": 4353 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577af308", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00001ab0" }, { "name": "SubKey", "value": "Package\\Data\\1a" }, { "name": "Handle", "value": "0x00001ab4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\1a" } ], "repeated": 0, "id": 4354 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "4620", "caller": "0x7fff4cbd16ad", "parentcaller": "0x7fff5781d320", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab4" }, { "name": "ValueName", "value": "PackageOrigin" }, { "name": "Data", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\1a\\PackageOrigin" } ], "repeated": 0, "id": 4355 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "4620", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577aed38", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab4" } ], "repeated": 0, "id": 4356 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "4620", "caller": "0x7fff4cbd17f2", "parentcaller": "0x7fff577adcce", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 4357 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "4620", "caller": "0x7fff4cbd180b", "parentcaller": "0x7fff577adcce", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" } ], "repeated": 0, "id": 4358 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "4620", "caller": "0x7fff59f93f7a", "parentcaller": "0x7fff59770ed7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4359 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "4620", "caller": "0x7fff59770cd1", "parentcaller": "0x7fff597a1530", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00001ab0" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 4360 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "4620", "caller": "0x7fff5781026b", "parentcaller": "0x7fff59770daf", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00001af0" } ], "repeated": 0, "id": 4361 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "4620", "caller": "0x7fff59f88cde", "parentcaller": "0x7fff59fc9c4e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": " \\xf1\\x02\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4362 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "4620", "caller": "0x7fff59fb6e46", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\xc8j\\xa7\\x0c\\x00\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x01\\x00r\\x00e\\x00-\\x00\\x80\\x9b\\xd9\\x0b\\x00\\x00\\x00\\x00=\\x00\\x00\\x00-\\x00m\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x01r\\x00-\\x00l\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4363 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "4620", "caller": "0x7fff59fb6e9b", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\x90t\\xa7\\x0c\\x00\\x00\\x00\\x00`\\x00\\x00\\x00\\xb2\\xe3,A\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\xeb\\x1c\\xc9\\x11\\x9f\\xe8\\x08\\x00+\\x10H`\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00-\\x00l\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4364 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "4620", "caller": "0x7fff59fb6ec0", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 4365 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "4620", "caller": "0x7fff59fb6f0e", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\x18\\x00\\xa7\\x0c\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 4366 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "4620", "caller": "0x7fff59fb6f37", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 4367 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "4620", "caller": "0x7fff59fb6f8f", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "H{\\xa7\\x0c\\x00\\x00\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 4368 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "4620", "caller": "0x7fff59fb7048", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x81\\x1a\\xff\\x7f\\x00\\x00\\xebPY\\x1a\\xff\\x7f\\x00\\x00\\x889*y^t\\x00\\x00(N}\\x1a\\xff\\x7f\\x00\\x00\\xd0\\xdc \\x03\\x00\\x00\\x00\\x00\\xc8\\xdc \\x03\\x00\\x00\\x00\\x00\\x98\\xdc \\x03\\x00\\x00\\x00\\x00\\xb8\\xdc \\x03" } ], "repeated": 0, "id": 4369 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "4620", "caller": "0x7fff59fb707b", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@{\\xa7\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8Z\\x1a\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xb8\\xda \\x03\\x00\\x00\\x00\\x00\\xf0\\x1a\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00$\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2}\\x1a" } ], "repeated": 0, "id": 4370 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "4620", "caller": "0x7fff59f88cde", "parentcaller": "0x7fff59f8953a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": " \\xf1\\x02\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4371 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "4620", "caller": "0x7fff59fb6e46", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\xa8i\\xa7\\x0c\\x00\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x01\\x01r\\x00e\\x00-\\x00\\x00\\x96\\xd9\\x0b\\x00\\x00\\x00\\x00I\\x00\\x00\\x00-\\x00f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00e\\x00r\\x00-\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00" } ], "repeated": 0, "id": 4372 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "4620", "caller": "0x7fff59fb6e9b", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xd0v\\xa7\\x0c\\x00\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\xeb\\x1c\\xc9\\x11\\x00\\x96\\xd9\\x0b\\x00\\x00\\x00\\x00U\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4373 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "4620", "caller": "0x7fff59fb6ec0", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 4374 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "4620", "caller": "0x7fff59fb6f0e", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\x08\\xfe\\xa6\\x0c\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 4375 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "4620", "caller": "0x7fff59fb6f37", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 4376 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "4620", "caller": "0x7fff59fb6f8f", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xa8~\\xa7\\x0c\\x00\\x00\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 4377 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "4620", "caller": "0x7fff59fb7048", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x81\\x1a\\xff\\x7f\\x00\\x00\\xebPY\\x1a\\xff\\x7f\\x00\\x00h=*y^t\\x00\\x00(N}\\x1a\\xff\\x7f\\x00\\x000\\xd9 \\x03\\x00\\x00\\x00\\x00(\\xd9 \\x03\\x00\\x00\\x00\\x00\\xf8\\xd8 \\x03\\x00\\x00\\x00\\x00\\x18\\xd9 \\x03" } ], "repeated": 0, "id": 4378 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "4620", "caller": "0x7fff59fb707b", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0~\\xa7\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8Z\\x1a\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x18\\xd7 \\x03\\x00\\x00\\x00\\x00\\xf0\\x1a\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00$\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2}\\x1a" } ], "repeated": 0, "id": 4379 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "4620", "caller": "0x7fff577d6785", "parentcaller": "0x7fff59770e27", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" } ], "repeated": 0, "id": 4380 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "4620", "caller": "0x7fff577d6785", "parentcaller": "0x7fff59770e49", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 4381 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "4620", "caller": "0x7fff597a1630", "parentcaller": "0x7fff597a12cd", "category": "system", "api": "NtQuerySystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4382 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "6160", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x18\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6160" } ], "repeated": 0, "id": 4383 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 4384 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58085ee4", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002048" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 4385 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "6160", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x18\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6160" } ], "repeated": 0, "id": 4386 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "4500", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xfe\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x94\\x11\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4500" } ], "repeated": 0, "id": 4387 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "4500", "caller": "0x7fff425966ba", "parentcaller": "0x7fff425c804a", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "25" }, { "name": "ProcessInformation", "value": "\\x01" } ], "repeated": 1, "id": 4388 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "4500", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xfe\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x94\\x11\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4500" } ], "repeated": 0, "id": 4389 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 4390 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58085ee4", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002048" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 4391 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "6160", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x18\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6160" } ], "repeated": 0, "id": 4392 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff4274356a", "parentcaller": "0x7fff42799839", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x00000002", "pretty_value": "KEY_SET_VALUE" }, { "name": "Handle", "value": "0x00001af0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 4393 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff427435a9", "parentcaller": "0x7fff42799839", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "ValueName", "value": "TraySearchBoxVisible" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Buffer", "value": "0" }, { "name": "BufferLength", "value": "4" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\TraySearchBoxVisible" } ], "repeated": 0, "id": 4394 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff427435c1", "parentcaller": "0x7fff42799839", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 4395 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 4396 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 4397 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001af0" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced" } ], "repeated": 0, "id": 4398 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff425e8fa6", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "ValueName", "value": "TaskbarSmallIcons" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\TaskbarSmallIcons" } ], "repeated": 0, "id": 4399 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff577d3018", "parentcaller": "0x7fff425e8fa6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 4400 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 4401 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 4402 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" } ], "repeated": 0, "id": 4403 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 4404 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 4405 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001af0" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" } ], "repeated": 0, "id": 4406 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "ValueName", "value": "Current" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Current" } ], "repeated": 0, "id": 4407 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff577d3018", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 4408 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 4409 }, { "timestamp": "2026-05-29 01:05:21,680", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58085ee4", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002048" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 4410 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "5108", "caller": "0x7fff426da250", "parentcaller": "0x7fff57fc7344", "category": "system", "api": "GetSystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4411 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6148", "caller": "0x7fff58520e98", "parentcaller": "0x7fff5859b785", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 4412 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6160", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x18\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6160" } ], "repeated": 0, "id": 4413 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "4696", "caller": "0x7ff79bc77b46", "parentcaller": "0x7ff79bc1ade7", "category": "synchronization", "api": "NtFindAtom", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "AtomName", "value": "Microsoft.Windows.ShellManagedWindowAsNormalWindow" }, { "name": "Atom", "value": "0x00000000" } ], "repeated": 0, "id": 4414 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "4696", "caller": "0x7ff79bc521d5", "parentcaller": "0x7ff79bc51a67", "category": "system", "api": "GetLastInputInfo", "status": true, "return": "0x00000001", "arguments": [], "repeated": 0, "id": 4415 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "4696", "caller": "0x7ff79bc521fe", "parentcaller": "0x7ff79bc51a67", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" } ], "repeated": 0, "id": 4416 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "4696", "caller": "0x7ff79bc521fe", "parentcaller": "0x7ff79bc51a67", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 4417 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "4696", "caller": "0x7ff79bc521fe", "parentcaller": "0x7ff79bc51a67", "category": "device", "api": "NtPowerInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "InformationLevel", "value": "16" }, { "name": "InputBuffer", "value": "" }, { "name": "OutputBuffer", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4418 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "4696", "caller": "0x7ff79bc521fe", "parentcaller": "0x7ff79bc51a67", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 4419 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 4420 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 4421 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000017d8" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Input" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Input" } ], "repeated": 0, "id": 4422 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "5000", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff42900714", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000017d8" }, { "name": "ValueName", "value": "InputAppId" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Input\\InputAppId" } ], "repeated": 0, "id": 4423 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "5000", "caller": "0x7fff577d3018", "parentcaller": "0x7fff42900714", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000017d8" } ], "repeated": 0, "id": 4424 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "4696", "caller": "0x7ff79bc76bd8", "parentcaller": "0x7ff79bc8a0c8", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00010110" }, { "name": "Message", "value": "0x0000c028" } ], "repeated": 0, "id": 4425 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "4696", "caller": "0x7ff79bc76b70", "parentcaller": "0x7ff79bc8a0c8", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "WindowShouldReportLayoutCompletedTelemetryProp" }, { "name": "Atom", "value": "0x0000c058" } ], "repeated": 0, "id": 4426 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "4696", "caller": "0x7ff79bc76bd8", "parentcaller": "0x7ff79bc8a0c8", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00010110" }, { "name": "Message", "value": "0x0000c028" } ], "repeated": 0, "id": 4427 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff4258f854", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000017d8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 4428 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000100a8" }, { "name": "Message", "value": "0x00000060" } ], "repeated": 0, "id": 4429 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "3424", "caller": "0x7ff79bc79d10", "parentcaller": "0x7ff79bc79c74", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 4430 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "CLSID\\{56AD4C5D-B908-4F85-8FF1-7940C29B3BCF}\\Instance" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\CLSID\\{56AD4C5D-B908-4F85-8FF1-7940C29B3BCF}\\Instance" } ], "repeated": 0, "id": 4431 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6148", "caller": "0x7fff5781026b", "parentcaller": "0x7fff43953518", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x0000000a" }, { "name": "TokenHandle", "value": "0x00002548" } ], "repeated": 0, "id": 4432 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 4433 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff58be0000", "arguments": [ { "name": "lpLibFileName", "value": "shell32.dll" }, { "name": "dwFlags", "value": "0x00004000" } ], "repeated": 0, "id": 4434 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "SHELL32.dll" }, { "name": "ModuleHandle", "value": "0x7fff58be0000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff58c378f0" } ], "repeated": 0, "id": 4435 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6148", "caller": "0x7fff59f8fd9e", "parentcaller": "0x7fff5992d7d3", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002548" }, { "name": "DesiredAccess", "value": "0x80000000", "pretty_value": "0x80000000" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\SecurityManager\\AdminCapabilities" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SecurityManager\\AdminCapabilities" } ], "repeated": 0, "id": 4436 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6148", "caller": "0x7fff59f8fdc8", "parentcaller": "0x7fff5992d7d3", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00002548" }, { "name": "ValueName", "value": "packageQuery" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\AdminCapabilities\\packageQuery" } ], "repeated": 0, "id": 4437 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6148", "caller": "0x7fff59f8c6d8", "parentcaller": "0x7fff59f8fed4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xeaQ\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00 \\x02\\x00\\x00^{\t)\\xdd\\x82\\xdf\\xd4\\xceAI\\xd8\\x0eg\\xd6/\\xe3\\xe1\\x97r8\\x8aJ\\x0cy\\x0b\\xd0\\xc6\\x00\\x00\\x18\\x00\\x01\\x00\\x00\\x00\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 4438 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6148", "caller": "0x7fff59f8ff10", "parentcaller": "0x7fff5992d7d3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002548" } ], "repeated": 0, "id": 4439 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002550" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "6136" }, { "name": "ProcessName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe" } ], "repeated": 0, "id": 4440 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6148", "caller": "0x7fff577d6785", "parentcaller": "0x7fff439535ce", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002540" } ], "repeated": 0, "id": 4441 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6148", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff43954325", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 4442 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002550" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000254c" } ], "repeated": 0, "id": 4443 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6148", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff43954373", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "`()\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x85k\\xdeA\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00" } ], "repeated": 0, "id": 4444 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 4445 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6148", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x18\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6148" } ], "repeated": 0, "id": 4446 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\xa0\\xff\\xa8\\x0c\\x00\\x00\\x00\\x00\\x1c\\x00\\x1c\\x00\\x00\\x00\\x00\\x00@\\x00\\xa9\\x0c\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\x00\\xa9\\x0c\\x00\\x00\\x00\\x00\\x12\\x00\\x12\\x00\\x00\\x00\\x00\\x00v\\x01\\xa9\\x0c\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x01\\xa9\\x0c\\x00\\x00\\x00\\x00\\x1e\\x00\\x1e\\x00\\x00\\x00\\x00\\x00\\x90\\x01\\xa9\\x0c\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\x01\\xa9\\x0c\\x00\\x00\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00\\xb8\\x01\\xa9\\x0c\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd8\\x01\\xa9\\x0c\\x00\\x00\\x00\\x00W\\x00I\\x00N\\x00:\\x00/\\x00/\\x00S\\x00Y\\x00S\\x00A\\x00P\\x00P\\x00I\\x00D\\x00\\x00\\x00\\x00\\x00\\x88\\x00\\x88\\x00\\x00\\x00\\x00\\x00\\x90\\x00\\xa9\\x0c\\x00\\x00\\x00\\x00\\x12\\x00\\x12\\x00\\x00\\x00\\x00\\x00\\x18\\x01\\xa9\\x0c\\x00\\x00\\x00\\x00L\\x00L\\x00\\x00\\x00\\x00\\x00*\\x01\\xa9\\x0c\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4447 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6160", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x18\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6160" } ], "repeated": 0, "id": 4448 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000254c" } ], "repeated": 0, "id": 4449 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6148", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff404373a8", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002548" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 4450 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6160", "caller": "0x7fff5855dd9d", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001838" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000430" }, { "name": "ObjectAttributesName", "value": "Windows.Internal.StateRepository.AppExtension" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.AppExtension" } ], "repeated": 0, "id": 4451 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "3424", "caller": "0x7ff79bc79e89", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "CreateTimerQueueTimer", "status": true, "return": "0x00000001", "arguments": [ { "name": "phNewTimer", "value": "0x0c8012a0" }, { "name": "TimerQueue", "value": "0x00000000" }, { "name": "Callback", "value": "0x9bc79ab0" }, { "name": "Parameter", "value": "0x07622ee0" }, { "name": "DueTime", "value": "3000" }, { "name": "Period", "value": "0" }, { "name": "Flags", "value": "8" } ], "repeated": 0, "id": 4452 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6160", "caller": "0x7fff5855ddf7", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001838" }, { "name": "KeyInformation", "value": "y\\x1f\\x10\\xffd4\\xffde\\xffac\\xffd5\\x01\\x00\\x00\\x00\\x00Z\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00I\\x00n\\x00t\\x00e\\x00r\\x00n\\x00a\\x00l\\x00.\\x00S\\x00t\\x00a\\x00t\\x00e\\x00R\\x00e\\x00p\\x00o\\x00s\\x00i\\x00t\\x00o\\x00r\\x00y\\x00.\\x00A\\x00p\\x00p\\x00E\\x00x\\x00t\\x00e\\x00n\\x00s\\x00i\\x00o\\x00n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffe0\\xffdd\\xffa3\\x0c\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x15\\x01\\x00\\x00\\x00\\x00\\x19\\xffe8i\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xff8c%\\x01\\x00\\x00\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\xffc4\\x02%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\r%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0EzX\\xffff\\x7f\\x00\\x00\\xffa8\\x0fp\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff0\\xffe8i\r\\x00\\x00\\x00\\x00\\xff87\\xff9dNX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\x1cp\\x0c\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x0fp\\x0c\\x00\\x00\\x00\\x00p\\x1cp\\x0c\\x00\\x00\\x00\\x00Pj\\xffc8\\x0b\\x00\\x00\\x00\\x00\\xffc7\\xffb3\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\xfff6sNX\\xffff\\x7f\\x00\\x00\\xff90\\xffe6\\xffa7\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffffPj\\xffc8\\x0b\\x00\\x00\\x00\\x00\\xffe0\\xfff1\\xffaa\\x0c\\x00\\x00\\x00\\x00\\xffe0\\xfff1\\xffaa\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\x1cp\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x006\\xff8cYX\\xffff\\x7f\\x00\\x00P&\\xff85\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffe0\\xffe9i\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffe0\\xffe9i\r\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 4453 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "3424", "caller": "0x7fff577d6785", "parentcaller": "0x7fff557c403a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 4454 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6160", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001838" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.AppExtension\\ActivationType" } ], "repeated": 0, "id": 4455 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6160", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001838" }, { "name": "ValueName", "value": "Server" }, { "name": "Data", "value": "StateRepository" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.AppExtension\\Server" } ], "repeated": 0, "id": 4456 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6160", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff585700bb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001838" }, { "name": "ValueName", "value": "DllPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.AppExtension\\DllPath" } ], "repeated": 0, "id": 4457 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "5108", "caller": "0x7fff5781026b", "parentcaller": "0x7fff42570dc8", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002438" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000256c" } ], "repeated": 0, "id": 4458 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "5108", "caller": "0x7fff42570e03", "parentcaller": "0x7fff42570a6b", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 4459 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6160", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001838" }, { "name": "ValueName", "value": "Threading" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.AppExtension\\Threading" } ], "repeated": 0, "id": 4460 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "5108", "caller": "0x7fff577d6785", "parentcaller": "0x7fff42570a7d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 4461 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "5108", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff426da18b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000ea0" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 4462 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6160", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001838" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.AppExtension\\TrustLevel" } ], "repeated": 0, "id": 4463 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6160", "caller": "0x7fff584bc0fc", "parentcaller": "0x7fff58554170", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00001838" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.AppExtension\\CustomAttributes" } ], "repeated": 0, "id": 4464 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6160", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001838" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.AppExtension\\RemoteServer" } ], "repeated": 0, "id": 4465 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6160", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001838" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.AppExtension\\ActivateAsUser" } ], "repeated": 0, "id": 4466 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6160", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001838" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.AppExtension\\ActivateInSharedBroker" } ], "repeated": 0, "id": 4467 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6160", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001838" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.AppExtension\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 4468 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6160", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58562222", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001838" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.AppExtension\\Permissions" } ], "repeated": 0, "id": 4469 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6160", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001838" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.AppExtension\\ActivateOnHostFlags" } ], "repeated": 0, "id": 4470 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6160", "caller": "0x7fff5855dd9d", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab0" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000434" }, { "name": "ObjectAttributesName", "value": "StateRepository" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository" } ], "repeated": 0, "id": 4471 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6160", "caller": "0x7fff5855ddf7", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab0" }, { "name": "KeyInformation", "value": "\\xffcek|\\xffd3\\xffde\\xffac\\xffd5\\x01\\x00\\x00\\x00\\x00\\x1e\\x00\\x00\\x00S\\x00t\\x00a\\x00t\\x00e\\x00R\\x00e\\x00p\\x00o\\x00s\\x00i\\x00t\\x00o\\x00r\\x00y\\x00\\x00\\x00h\\x00\\x00\\x00\\x00\\x00\\x00\\x00k\\xffb8\\xfff7Y\\xffff\\x7f\\x00\\x00\\x0b\\x00\\x14\\x00\\x02\\x00\\x00\\x00C\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffe0\\xffdd\\xffa3\\x0c\\x00\\x00\\x00\\x00\\xffc7\\xffb3\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xff8c%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\xffc4\\x02%\\x01\\x00\\x00\\x00\\x00\\x00c%\\x01\\x00\\x00\\x00\\x00\\xff90\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\r%\\x01\\x00\\x00\\x00\\x00\\xffc0\\x02%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0CzX\\xffff\\x7f\\x00\\x00h(p\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xffe5i\r\\x00\\x00\\x00\\x00\\xff87\\xff9dNX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10*\\xff85\\x0c\\x00\\x00\\x00\\x00\\xff90\\xffed\\xffa7\\x0c\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@(p\\x0c\\x00\\x00\\x00\\x00\\x10*\\xff85\\x0c\\x00\\x00\\x00\\x00\\x10l\\xffc8\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\xffed\\xffa7\\x0c\\x00\\x00\\x00\\x00kjNX\\xffff\\x7f\\x00\\x00\\xff90l\\xffc8\\x0b\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xffe4\\xffaa\\x0c\\x00\\x00\\x00\\x00\\x10l\\xffc8\\x0b\\x00\\x00\\x00\\x00P\\xffe4\\xffaa\\x0c\\x00\\x00\\x00\\x00P\\xffe4\\xffaa\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10*\\xff85\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\xffe4\\xffaa\\x0c\\x00\\x00\\x00\\x00\\xffe3rNX\\xffff\\x7f\\x00\\x00@(p\\x0c\\x00\\x00\\x00\\x00\\xff88\\xffe6i\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xffe4\\xffaa\\x0c\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00E\\xffaeVX\\xffff\\x7f\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 4472 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6160", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff585700bb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001ab0" }, { "name": "ValueName", "value": "ExePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ExePath" } ], "repeated": 0, "id": 4473 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6160", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff585700bb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001ab0" }, { "name": "ValueName", "value": "CommandLine" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\CommandLine" } ], "repeated": 0, "id": 4474 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6160", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" }, { "name": "ValueName", "value": "IdentityType" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\IdentityType" } ], "repeated": 0, "id": 4475 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6160", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58562222", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x000000ea", "arguments": [ { "name": "Handle", "value": "0x00001ab0" }, { "name": "ValueName", "value": "Permissions" }, { "name": "Type", "value": "0x7fff00000003" }, { "name": "DataLength", "value": "184" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Permissions" } ], "repeated": 0, "id": 4476 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6160", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58562222", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" }, { "name": "ValueName", "value": "Permissions" }, { "name": "Data", "value": "\\x01\\x00\\x14\\x80\\x9c\\x00\\x00\\x00\\xa8\\x00\\x00\\x00\\x14\\x00\\x00\\x000\\x00\\x00\\x00\\x02\\x00\\x1c\\x00\\x01\\x00\\x00\\x00\\x11\\x00\\x14\\x00\\x04\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x10\\x00\\x00\\x02\\x00l\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x1f\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x1f\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x0f\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x008\\x00\\x1f\\x00\\x00\\x00\\x01\n\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\xceJ\\x93Y\\xb9\\xcf\\x0buu\\xc0\\xf2\\x9b\\xb2\\xb4\\xc2\\x98\\xd4F\\xdd\\xf9\\x02z\\x87\\xec\\x14e\\x11w\\xd6\\xe9\\x96U\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\n\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00!\\x02\\x00\\x00" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Permissions" } ], "repeated": 0, "id": 4477 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6160", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58579d80", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001ab0" }, { "name": "ValueName", "value": "ActivatableClasses" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ActivatableClasses" } ], "repeated": 0, "id": 4478 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6160", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" }, { "name": "ValueName", "value": "ServerType" }, { "name": "Data", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ServerType" } ], "repeated": 0, "id": 4479 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6160", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001ab0" }, { "name": "ValueName", "value": "AppId" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\AppId" } ], "repeated": 0, "id": 4480 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6160", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" }, { "name": "ValueName", "value": "Identity" }, { "name": "Data", "value": "nt authority\\system" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Identity" } ], "repeated": 0, "id": 4481 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6160", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" }, { "name": "ValueName", "value": "ServiceName" }, { "name": "Data", "value": "StateRepository" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ServiceName" } ], "repeated": 0, "id": 4482 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6160", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001ab0" }, { "name": "ValueName", "value": "ExplicitPsmActivationType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ExplicitPsmActivationType" } ], "repeated": 0, "id": 4483 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6160", "caller": "0x7fff584bc0fc", "parentcaller": "0x7fff58554170", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00001ab0" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\CustomAttributes" } ], "repeated": 0, "id": 4484 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6160", "caller": "0x7fff58557226", "parentcaller": "0x7fff5855ca23", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" } ], "repeated": 0, "id": 4485 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6160", "caller": "0x7fff58557226", "parentcaller": "0x7fff5855ca23", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001838" } ], "repeated": 0, "id": 4486 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6160", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 4487 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6160", "caller": "0x7fff584d7b74", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000034a" }, { "name": "SubKey", "value": "CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}" }, { "name": "Handle", "value": "0x00001ab6" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}" } ], "repeated": 0, "id": 4488 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6160", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab6" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 4489 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6160", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 4490 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6160", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xc0i\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\xb6\\x1a\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\xc1i\r\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4491 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6160", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\TreatAs" } ], "repeated": 0, "id": 4492 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6160", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 4493 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6160", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00001ab6" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\TreatAs" } ], "repeated": 0, "id": 4494 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6160", "caller": "0x7fff585622e1", "parentcaller": "0x7fff584d7c1d", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab6" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 4495 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6160", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d81f5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001ab6" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 4496 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6160", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab6" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\(Default)" } ], "repeated": 0, "id": 4497 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6160", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab6" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "PSFactoryBuffer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\(Default)" } ], "repeated": 0, "id": 4498 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6160", "caller": "0x7fff584d8485", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00001ab6" }, { "name": "SubKey", "value": "InprocServer32" }, { "name": "Handle", "value": "0x00001aba" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocServer32" } ], "repeated": 0, "id": 4499 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6160", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001aba" }, { "name": "ValueName", "value": "InprocServer32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\InprocServer32" } ], "repeated": 0, "id": 4500 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6160", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001aba" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 4501 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6160", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001aba" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "C:\\Windows\\System32\\\\Windows.StateRepositoryPS.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 4502 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6160", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d8d32", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001aba" }, { "name": "ValueName", "value": "ThreadingModel" }, { "name": "Data", "value": "Both" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\ThreadingModel" } ], "repeated": 0, "id": 4503 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6160", "caller": "0x7fff584d855f", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001aba" } ], "repeated": 0, "id": 4504 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6160", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab6" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 4505 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6160", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 4506 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6160", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "@\\xbfi\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\xb6\\x1a\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xc0i\r\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4507 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6160", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler32" } ], "repeated": 0, "id": 4508 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6160", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 4509 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6160", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00001ab6" }, { "name": "ObjectAttributesName", "value": "InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler32" } ], "repeated": 0, "id": 4510 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6160", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab6" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 4511 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6160", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 4512 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6160", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "@\\xbfi\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\xb6\\x1a\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xc0i\r\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4513 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6160", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler" } ], "repeated": 0, "id": 4514 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6160", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 4515 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6160", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00001ab6" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler" } ], "repeated": 0, "id": 4516 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6160", "caller": "0x7fff584d8010", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab6" } ], "repeated": 0, "id": 4517 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6160", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4518 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6160", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000360" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 4519 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6160", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4520 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6160", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000360" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 4521 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6160", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 4522 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6160", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 4523 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6160", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateChange\\PackageList\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateChange\\PackageList\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" } ], "repeated": 0, "id": 4524 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6148", "caller": "0x7fff577d6785", "parentcaller": "0x7fff4043cf2d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002548" } ], "repeated": 0, "id": 4525 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6160", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x18\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6160" } ], "repeated": 0, "id": 4526 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6148", "caller": "0x7fff5855dd9d", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002548" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000430" }, { "name": "ObjectAttributesName", "value": "Windows.Internal.StateRepository.Package" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package" } ], "repeated": 0, "id": 4527 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6148", "caller": "0x7fff5855ddf7", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002548" }, { "name": "KeyInformation", "value": "\\xfffci\\x0e\\xffd4\\xffde\\xffac\\xffd5\\x01\\x00\\x00\\x00\\x00P\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00I\\x00n\\x00t\\x00e\\x00r\\x00n\\x00a\\x00l\\x00.\\x00S\\x00t\\x00a\\x00t\\x00e\\x00R\\x00e\\x00p\\x00o\\x00s\\x00i\\x00t\\x00o\\x00r\\x00y\\x00.\\x00P\\x00a\\x00c\\x00k\\x00a\\x00g\\x00e\\x00\\x07\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xffa3\\xff89\\x0b\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x15\\x01\\x00\\x00\\x00\\x00\t\\xffe2Q\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff8a%\\x01\\x00\\x00\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\xffc4\\x02%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff0\\x0c%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0EzX\\xffff\\x7f\\x00\\x00\\xffe8\\x1fy\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffe0\\xffe2Q\r\\x00\\x00\\x00\\x00\\xff87\\xff9dNX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xff82\\xffd7\\x08\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffc0\\x1fy\\x0c\\x00\\x00\\x00\\x00p\\xff82\\xffd7\\x08\\x00\\x00\\x00\\x00\\xffe0&\\xffeb\\x08\\x00\\x00\\x00\\x00\\xffc7\\xffb3\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\xfff6sNX\\xffff\\x7f\\x00\\x00ps\\xffd7\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffe0&\\xffeb\\x08\\x00\\x00\\x00\\x00\\xff90>\\xffe5\\x08\\x00\\x00\\x00\\x00\\xff90>\\xffe5\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xff82\\xffd7\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x006\\xff8cYX\\xffff\\x7f\\x00\\x00\\xffc0\\xffe6y\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xffe3Q\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xffe3Q\r\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 4528 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002548" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\ActivationType" } ], "repeated": 0, "id": 4529 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6148", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002548" }, { "name": "ValueName", "value": "Server" }, { "name": "Data", "value": "StateRepository" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\Server" } ], "repeated": 0, "id": 4530 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6148", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff585700bb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002548" }, { "name": "ValueName", "value": "DllPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\DllPath" } ], "repeated": 0, "id": 4531 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002548" }, { "name": "ValueName", "value": "Threading" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\Threading" } ], "repeated": 0, "id": 4532 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002548" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\TrustLevel" } ], "repeated": 0, "id": 4533 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6148", "caller": "0x7fff584bc0fc", "parentcaller": "0x7fff58554170", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00002548" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\CustomAttributes" } ], "repeated": 0, "id": 4534 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6148", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002548" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\RemoteServer" } ], "repeated": 0, "id": 4535 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002548" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\ActivateAsUser" } ], "repeated": 0, "id": 4536 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002548" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\ActivateInSharedBroker" } ], "repeated": 0, "id": 4537 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002548" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 4538 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58562222", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002548" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\Permissions" } ], "repeated": 0, "id": 4539 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002548" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\ActivateOnHostFlags" } ], "repeated": 0, "id": 4540 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6148", "caller": "0x7fff58557226", "parentcaller": "0x7fff5855ca23", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002548" } ], "repeated": 0, "id": 4541 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6148", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 4542 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6148", "caller": "0x7fff5855dd9d", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab4" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000430" }, { "name": "ObjectAttributesName", "value": "Windows.Internal.StateRepository.PackageLocation" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.PackageLocation" } ], "repeated": 0, "id": 4543 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6148", "caller": "0x7fff5855ddf7", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab4" }, { "name": "KeyInformation", "value": "\\xfffci\\x0e\\xffd4\\xffde\\xffac\\xffd5\\x01\\x00\\x00\\x00\\x00`\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00I\\x00n\\x00t\\x00e\\x00r\\x00n\\x00a\\x00l\\x00.\\x00S\\x00t\\x00a\\x00t\\x00e\\x00R\\x00e\\x00p\\x00o\\x00s\\x00i\\x00t\\x00o\\x00r\\x00y\\x00.\\x00P\\x00a\\x00c\\x00k\\x00a\\x00g\\x00e\\x00L\\x00o\\x00c\\x00a\\x00t\\x00i\\x00o\\x00n\\x00@\\xffa3\\xff89\\x0b\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x15\\x01\\x00\\x00\\x00\\x00\t\\xffe2Q\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff8a%\\x01\\x00\\x00\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\xffc4\\x02%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff0\\x0c%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0EzX\\xffff\\x7f\\x00\\x00\\x08!y\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffe0\\xffe2Q\r\\x00\\x00\\x00\\x00\\xff87\\xff9dNX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff0\\x1cy\\x0c\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffe0 y\\x0c\\x00\\x00\\x00\\x00\\xfff0\\x1cy\\x0c\\x00\\x00\\x00\\x00`\\x1b\\xffeb\\x08\\x00\\x00\\x00\\x00\\xffc7\\xffb3\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\xfff6sNX\\xffff\\x7f\\x00\\x00pw\\xffd7\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff`\\x1b\\xffeb\\x08\\x00\\x00\\x00\\x000\\xffc4\\xffe7\\x08\\x00\\x00\\x00\\x000\\xffc4\\xffe7\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff0\\x1cy\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x15\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x006\\xff8cYX\\xffff\\x7f\\x00\\x00\\xffc0\\xffe6y\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xffe3Q\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xffe3Q\r\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 4544 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab4" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.PackageLocation\\ActivationType" } ], "repeated": 0, "id": 4545 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6148", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab4" }, { "name": "ValueName", "value": "Server" }, { "name": "Data", "value": "StateRepository" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.PackageLocation\\Server" } ], "repeated": 0, "id": 4546 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6148", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff585700bb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001ab4" }, { "name": "ValueName", "value": "DllPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.PackageLocation\\DllPath" } ], "repeated": 0, "id": 4547 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001ab4" }, { "name": "ValueName", "value": "Threading" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.PackageLocation\\Threading" } ], "repeated": 0, "id": 4548 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab4" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.PackageLocation\\TrustLevel" } ], "repeated": 0, "id": 4549 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6148", "caller": "0x7fff584bc0fc", "parentcaller": "0x7fff58554170", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00001ab4" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.PackageLocation\\CustomAttributes" } ], "repeated": 0, "id": 4550 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6148", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001ab4" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.PackageLocation\\RemoteServer" } ], "repeated": 0, "id": 4551 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001ab4" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.PackageLocation\\ActivateAsUser" } ], "repeated": 0, "id": 4552 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001ab4" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.PackageLocation\\ActivateInSharedBroker" } ], "repeated": 0, "id": 4553 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001ab4" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.PackageLocation\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 4554 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58562222", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001ab4" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.PackageLocation\\Permissions" } ], "repeated": 0, "id": 4555 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001ab4" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.PackageLocation\\ActivateOnHostFlags" } ], "repeated": 0, "id": 4556 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6148", "caller": "0x7fff58557226", "parentcaller": "0x7fff5855ca23", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab4" } ], "repeated": 0, "id": 4557 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6148", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 4558 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6148", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4559 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6148", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000360" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 4560 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6148", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4561 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6148", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000360" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 4562 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6148", "caller": "0x7fff5855dd9d", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab4" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000430" }, { "name": "ObjectAttributesName", "value": "Windows.ApplicationModel.Package" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Package" } ], "repeated": 0, "id": 4563 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6148", "caller": "0x7fff5855ddf7", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab4" }, { "name": "KeyInformation", "value": "\\xff97\\xfffc\\xffe7\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00@\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00A\\x00p\\x00p\\x00l\\x00i\\x00c\\x00a\\x00t\\x00i\\x00o\\x00n\\x00M\\x00o\\x00d\\x00e\\x00l\\x00.\\x00P\\x00a\\x00c\\x00k\\x00a\\x00g\\x00e\\x00\\x07\\x00\\x14\\x00\\x00\\x00\\x00\\x00k\\xffb8\\xfff7Y\\xffff\\x7f\\x00\\x00\\x06\\x00\\x16\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xffa3\\xff89\\x0b\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x15\\x01\\x00\\x00\\x00\\x00\t\\xffe2Q\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff8a%\\x01\\x00\\x00\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\xffc4\\x02%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff0\\x0c%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0EzX\\xffff\\x7f\\x00\\x00\\xffc8\\x1ey\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffe0\\xffe2Q\r\\x00\\x00\\x00\\x00\\xff87\\xff9dNX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0\\xff9e\\xffea\\x08\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffa0\\x1ey\\x0c\\x00\\x00\\x00\\x00\\xffb0\\xff9e\\xffea\\x08\\x00\\x00\\x00\\x00`\\x1b\\xffeb\\x08\\x00\\x00\\x00\\x00\\xffc7\\xffb3\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\xfff6sNX\\xffff\\x7f\\x00\\x00Pe\\xffe1\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff`\\x1b\\xffeb\\x08\\x00\\x00\\x00\\x00\\xff90\\xff9f\\xffea\\x08\\x00\\x00\\x00\\x00\\xff90\\xff9f\\xffea\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0\\xff9e\\xffea\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00Q\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x006\\xff8cYX\\xffff\\x7f\\x00\\x00`\\xffd8y\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xffe3Q\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xffe3Q\r\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 4564 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab4" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Package\\ActivationType" } ], "repeated": 0, "id": 4565 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6148", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001ab4" }, { "name": "ValueName", "value": "Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Package\\Server" } ], "repeated": 0, "id": 4566 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6148", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff585700bb", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab4" }, { "name": "ValueName", "value": "DllPath" }, { "name": "Data", "value": "C:\\Windows\\System32\\Windows.ApplicationModel.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Package\\DllPath" } ], "repeated": 0, "id": 4567 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab4" }, { "name": "ValueName", "value": "Threading" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Package\\Threading" } ], "repeated": 0, "id": 4568 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab4" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Package\\TrustLevel" } ], "repeated": 0, "id": 4569 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6148", "caller": "0x7fff584bc0fc", "parentcaller": "0x7fff58554170", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00001ab4" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Package\\CustomAttributes" } ], "repeated": 0, "id": 4570 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6148", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001ab4" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Package\\RemoteServer" } ], "repeated": 0, "id": 4571 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001ab4" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Package\\ActivateAsUser" } ], "repeated": 0, "id": 4572 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001ab4" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Package\\ActivateInSharedBroker" } ], "repeated": 0, "id": 4573 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001ab4" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Package\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 4574 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58562222", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001ab4" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Package\\Permissions" } ], "repeated": 0, "id": 4575 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001ab4" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Package\\ActivateOnHostFlags" } ], "repeated": 0, "id": 4576 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6148", "caller": "0x7fff58557226", "parentcaller": "0x7fff5855ca23", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab4" } ], "repeated": 0, "id": 4577 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6148", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 4578 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6148", "caller": "0x7fff5855dd9d", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002548" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000430" }, { "name": "ObjectAttributesName", "value": "Windows.Internal.StateRepository.PackageUser" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.PackageUser" } ], "repeated": 0, "id": 4579 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6148", "caller": "0x7fff5855ddf7", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002548" }, { "name": "KeyInformation", "value": "\\xfffci\\x0e\\xffd4\\xffde\\xffac\\xffd5\\x01\\x00\\x00\\x00\\x00X\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00I\\x00n\\x00t\\x00e\\x00r\\x00n\\x00a\\x00l\\x00.\\x00S\\x00t\\x00a\\x00t\\x00e\\x00R\\x00e\\x00p\\x00o\\x00s\\x00i\\x00t\\x00o\\x00r\\x00y\\x00.\\x00P\\x00a\\x00c\\x00k\\x00a\\x00g\\x00e\\x00U\\x00s\\x00e\\x00r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xffa3\\xff89\\x0b\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x15\\x01\\x00\\x00\\x00\\x00\\xffc9\\xffe3Q\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff8a%\\x01\\x00\\x00\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\xffc4\\x02%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff0\\x0c%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0EzX\\xffff\\x7f\\x00\\x00\\x08!y\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffa0\\xffe4Q\r\\x00\\x00\\x00\\x00\\xff87\\xff9dNX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00Pb\\xffe1\\x08\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffe0 y\\x0c\\x00\\x00\\x00\\x00Pb\\xffe1\\x08\\x00\\x00\\x00\\x00 !\\xffeb\\x08\\x00\\x00\\x00\\x00\\xffc7\\xffb3\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\xfff6sNX\\xffff\\x7f\\x00\\x00\\xffd0g\\xffe1\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff !\\xffeb\\x08\\x00\\x00\\x00\\x00p1\\xffe5\\x08\\x00\\x00\\x00\\x00p1\\xffe5\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00Pb\\xffe1\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00pX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x006\\xff8cYX\\xffff\\x7f\\x00\\x00 \\xffe6y\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\xffe5Q\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\xffe5Q\r\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 4580 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002548" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.PackageUser\\ActivationType" } ], "repeated": 0, "id": 4581 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6148", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002548" }, { "name": "ValueName", "value": "Server" }, { "name": "Data", "value": "StateRepository" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.PackageUser\\Server" } ], "repeated": 0, "id": 4582 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6148", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff585700bb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002548" }, { "name": "ValueName", "value": "DllPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.PackageUser\\DllPath" } ], "repeated": 0, "id": 4583 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002548" }, { "name": "ValueName", "value": "Threading" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.PackageUser\\Threading" } ], "repeated": 0, "id": 4584 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002548" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.PackageUser\\TrustLevel" } ], "repeated": 0, "id": 4585 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6148", "caller": "0x7fff584bc0fc", "parentcaller": "0x7fff58554170", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00002548" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.PackageUser\\CustomAttributes" } ], "repeated": 0, "id": 4586 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6148", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002548" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.PackageUser\\RemoteServer" } ], "repeated": 0, "id": 4587 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002548" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.PackageUser\\ActivateAsUser" } ], "repeated": 0, "id": 4588 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002548" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.PackageUser\\ActivateInSharedBroker" } ], "repeated": 0, "id": 4589 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002548" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.PackageUser\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 4590 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58562222", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002548" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.PackageUser\\Permissions" } ], "repeated": 0, "id": 4591 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002548" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.PackageUser\\ActivateOnHostFlags" } ], "repeated": 0, "id": 4592 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6148", "caller": "0x7fff58557226", "parentcaller": "0x7fff5855ca23", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002548" } ], "repeated": 0, "id": 4593 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6148", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 4594 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6148", "caller": "0x7fff4cbd12d2", "parentcaller": "0x7fff577adc16", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache" }, { "name": "Handle", "value": "0x00002548" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache" } ], "repeated": 0, "id": 4595 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6148", "caller": "0x7fff4cbd1a81", "parentcaller": "0x7fff4cbd138a", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002548" }, { "name": "SubKey", "value": "Metadata" }, { "name": "Handle", "value": "0x00001838" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Metadata" } ], "repeated": 0, "id": 4596 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6148", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577af579", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002548" }, { "name": "SubKey", "value": "Package\\Index\\PackageFullName\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" }, { "name": "Handle", "value": "0x00001ab0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Index\\PackageFullName\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" } ], "repeated": 0, "id": 4597 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6148", "caller": "0x7fff4cbd1732", "parentcaller": "0x7fff577af7dc", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "22" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Index\\PackageFullName\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\22" } ], "repeated": 0, "id": 4598 }, { "timestamp": "2026-05-29 01:05:21,696", "thread_id": "6148", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577af5fd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" } ], "repeated": 0, "id": 4599 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577af308", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002548" }, { "name": "SubKey", "value": "Package\\Data\\22" }, { "name": "Handle", "value": "0x00001ab0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\22" } ], "repeated": 0, "id": 4600 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff4cbd16ad", "parentcaller": "0x7fff5781d320", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" }, { "name": "ValueName", "value": "PackageOrigin" }, { "name": "Data", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\22\\PackageOrigin" } ], "repeated": 0, "id": 4601 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577aed38", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" } ], "repeated": 0, "id": 4602 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff4cbd17f2", "parentcaller": "0x7fff577adcce", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001838" } ], "repeated": 0, "id": 4603 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff4cbd180b", "parentcaller": "0x7fff577adcce", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002548" } ], "repeated": 0, "id": 4604 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff5855dd9d", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab8" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000430" }, { "name": "ObjectAttributesName", "value": "Windows.ApplicationModel.AppInfo" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.AppInfo" } ], "repeated": 0, "id": 4605 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff5855ddf7", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab8" }, { "name": "KeyInformation", "value": "[\\xff9a\\xffe5\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00@\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00A\\x00p\\x00p\\x00l\\x00i\\x00c\\x00a\\x00t\\x00i\\x00o\\x00n\\x00M\\x00o\\x00d\\x00e\\x00l\\x00.\\x00A\\x00p\\x00p\\x00I\\x00n\\x00f\\x00o\\x00\\x05\\x00\\x16\\x00\\x00\\x00\\x00\\x00k\\xffb8\\xfff7Y\\xffff\\x7f\\x00\\x00\\x04\\x00\\x16\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xffa3\\xff89\\x0b\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x15\\x01\\x00\\x00\\x00\\x00\\xffd9\\xffe3Q\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff8a%\\x01\\x00\\x00\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\xffc4\\x02%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff0\\x0c%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0EzX\\xffff\\x7f\\x00\\x00\\x08!y\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0\\xffe4Q\r\\x00\\x00\\x00\\x00\\xff87\\xff9dNX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@6\\xffe5\\x08\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffe0 y\\x0c\\x00\\x00\\x00\\x00@6\\xffe5\\x08\\x00\\x00\\x00\\x00\\xffe0&\\xffeb\\x08\\x00\\x00\\x00\\x00\\xffc7\\xffb3\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\xfff6sNX\\xffff\\x7f\\x00\\x00p\\xff82\\xffd7\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffe0&\\xffeb\\x08\\x00\\x00\\x00\\x00p?\\xffe5\\x08\\x00\\x00\\x00\\x00p?\\xffe5\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@6\\xffe5\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff83Y\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x006\\xff8cYX\\xffff\\x7f\\x00\\x00\\xff90\\xffd5y\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffa0\\xffe5Q\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffa0\\xffe5Q\r\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 4606 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab8" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.AppInfo\\ActivationType" } ], "repeated": 0, "id": 4607 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001ab8" }, { "name": "ValueName", "value": "Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.AppInfo\\Server" } ], "repeated": 0, "id": 4608 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff585700bb", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab8" }, { "name": "ValueName", "value": "DllPath" }, { "name": "Data", "value": "C:\\Windows\\System32\\Windows.StateRepositoryClient.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.AppInfo\\DllPath" } ], "repeated": 0, "id": 4609 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab8" }, { "name": "ValueName", "value": "Threading" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.AppInfo\\Threading" } ], "repeated": 0, "id": 4610 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab8" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.AppInfo\\TrustLevel" } ], "repeated": 0, "id": 4611 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff584bc0fc", "parentcaller": "0x7fff58554170", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00001ab8" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.AppInfo\\CustomAttributes" } ], "repeated": 0, "id": 4612 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001ab8" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.AppInfo\\RemoteServer" } ], "repeated": 0, "id": 4613 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001ab8" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.AppInfo\\ActivateAsUser" } ], "repeated": 0, "id": 4614 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001ab8" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.AppInfo\\ActivateInSharedBroker" } ], "repeated": 0, "id": 4615 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001ab8" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.AppInfo\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 4616 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58562222", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001ab8" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.AppInfo\\Permissions" } ], "repeated": 0, "id": 4617 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001ab8" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.AppInfo\\ActivateOnHostFlags" } ], "repeated": 0, "id": 4618 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff58557226", "parentcaller": "0x7fff5855ca23", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab8" } ], "repeated": 0, "id": 4619 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff5855dd9d", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab8" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000430" }, { "name": "ObjectAttributesName", "value": "Windows.Internal.StateRepository.Application" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application" } ], "repeated": 0, "id": 4620 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff5855ddf7", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab8" }, { "name": "KeyInformation", "value": "y\\x1f\\x10\\xffd4\\xffde\\xffac\\xffd5\\x01\\x00\\x00\\x00\\x00X\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00I\\x00n\\x00t\\x00e\\x00r\\x00n\\x00a\\x00l\\x00.\\x00S\\x00t\\x00a\\x00t\\x00e\\x00R\\x00e\\x00p\\x00o\\x00s\\x00i\\x00t\\x00o\\x00r\\x00y\\x00.\\x00A\\x00p\\x00p\\x00l\\x00i\\x00c\\x00a\\x00t\\x00i\\x00o\\x00n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xffa3\\xff89\\x0b\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x15\\x01\\x00\\x00\\x00\\x00\\xff89\\xffe2Q\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff8a%\\x01\\x00\\x00\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\xffc4\\x02%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff0\\x0c%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0EzX\\xffff\\x7f\\x00\\x00\\x08!y\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xffe3Q\r\\x00\\x00\\x00\\x00\\xff87\\xff9dNX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xff82\\xffd7\\x08\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffe0 y\\x0c\\x00\\x00\\x00\\x00p\\xff82\\xffd7\\x08\\x00\\x00\\x00\\x00\\xffe0&\\xffeb\\x08\\x00\\x00\\x00\\x00\\xffc7\\xffb3\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\xfff6sNX\\xffff\\x7f\\x00\\x00\\xfff0t\\xffd7\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffe0&\\xffeb\\x08\\x00\\x00\\x00\\x00@6\\xffe5\\x08\\x00\\x00\\x00\\x00@6\\xffe5\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xff82\\xffd7\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x006\\xff8cYX\\xffff\\x7f\\x00\\x00\\xfff0\\xffdey\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xffe4Q\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xffe4Q\r\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 4621 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab8" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\ActivationType" } ], "repeated": 0, "id": 4622 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab8" }, { "name": "ValueName", "value": "Server" }, { "name": "Data", "value": "StateRepository" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\Server" } ], "repeated": 0, "id": 4623 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff585700bb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001ab8" }, { "name": "ValueName", "value": "DllPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\DllPath" } ], "repeated": 0, "id": 4624 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001ab8" }, { "name": "ValueName", "value": "Threading" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\Threading" } ], "repeated": 0, "id": 4625 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab8" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\TrustLevel" } ], "repeated": 0, "id": 4626 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff584bc0fc", "parentcaller": "0x7fff58554170", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00001ab8" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\CustomAttributes" } ], "repeated": 0, "id": 4627 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001ab8" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\RemoteServer" } ], "repeated": 0, "id": 4628 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001ab8" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\ActivateAsUser" } ], "repeated": 0, "id": 4629 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001ab8" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\ActivateInSharedBroker" } ], "repeated": 0, "id": 4630 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001ab8" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 4631 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58562222", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001ab8" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\Permissions" } ], "repeated": 0, "id": 4632 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001ab8" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\ActivateOnHostFlags" } ], "repeated": 0, "id": 4633 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff58557226", "parentcaller": "0x7fff5855ca23", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab8" } ], "repeated": 0, "id": 4634 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 4635 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff5855dd9d", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002548" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000430" }, { "name": "ObjectAttributesName", "value": "Windows.ApplicationModel.AppDisplayInfo" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.AppDisplayInfo" } ], "repeated": 0, "id": 4636 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff5855ddf7", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002548" }, { "name": "KeyInformation", "value": "[\\xff9a\\xffe5\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00N\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00A\\x00p\\x00p\\x00l\\x00i\\x00c\\x00a\\x00t\\x00i\\x00o\\x00n\\x00M\\x00o\\x00d\\x00e\\x00l\\x00.\\x00A\\x00p\\x00p\\x00D\\x00i\\x00s\\x00p\\x00l\\x00a\\x00y\\x00I\\x00n\\x00f\\x00o\\x00\\x00\\x00\\x03\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xffa3\\xff89\\x0b\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x15\\x01\\x00\\x00\\x00\\x00\\xff89\\xffe2Q\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff8a%\\x01\\x00\\x00\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\xffc4\\x02%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff0\\x0c%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0EzX\\xffff\\x7f\\x00\\x00\\xff98!y\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xffe3Q\r\\x00\\x00\\x00\\x00\\xff87\\xff9dNX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xffa6R\\x07\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00p!y\\x0c\\x00\\x00\\x00\\x000\\xffa6R\\x07\\x00\\x00\\x00\\x00\\xffa0\"\\xffeb\\x08\\x00\\x00\\x00\\x00\\xffc7\\xffb3\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\xfff6sNX\\xffff\\x7f\\x00\\x00P^\\xffe1\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffa0\"\\xffeb\\x08\\x00\\x00\\x00\\x00@\\xffc0\\xffe7\\x08\\x00\\x00\\x00\\x00@\\xffc0\\xffe7\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xffa6R\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00f\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x006\\xff8cYX\\xffff\\x7f\\x00\\x00P\\xffdey\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xffe4Q\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xffe4Q\r\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 4637 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002548" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.AppDisplayInfo\\ActivationType" } ], "repeated": 0, "id": 4638 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002548" }, { "name": "ValueName", "value": "Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.AppDisplayInfo\\Server" } ], "repeated": 0, "id": 4639 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff585700bb", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002548" }, { "name": "ValueName", "value": "DllPath" }, { "name": "Data", "value": "C:\\Windows\\System32\\Windows.StateRepositoryClient.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.AppDisplayInfo\\DllPath" } ], "repeated": 0, "id": 4640 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002548" }, { "name": "ValueName", "value": "Threading" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.AppDisplayInfo\\Threading" } ], "repeated": 0, "id": 4641 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002548" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.AppDisplayInfo\\TrustLevel" } ], "repeated": 0, "id": 4642 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff584bc0fc", "parentcaller": "0x7fff58554170", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00002548" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.AppDisplayInfo\\CustomAttributes" } ], "repeated": 0, "id": 4643 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002548" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.AppDisplayInfo\\RemoteServer" } ], "repeated": 0, "id": 4644 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002548" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.AppDisplayInfo\\ActivateAsUser" } ], "repeated": 0, "id": 4645 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002548" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.AppDisplayInfo\\ActivateInSharedBroker" } ], "repeated": 0, "id": 4646 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002548" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.AppDisplayInfo\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 4647 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58562222", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002548" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.AppDisplayInfo\\Permissions" } ], "repeated": 0, "id": 4648 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002548" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.AppDisplayInfo\\ActivateOnHostFlags" } ], "repeated": 0, "id": 4649 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff58557226", "parentcaller": "0x7fff5855ca23", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002548" } ], "repeated": 0, "id": 4650 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 4651 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff5855dd9d", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001abc" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000430" }, { "name": "ObjectAttributesName", "value": "Windows.Internal.StateRepository.ApplicationResourceResolver" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.ApplicationResourceResolver" } ], "repeated": 0, "id": 4652 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff5855ddf7", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001abc" }, { "name": "KeyInformation", "value": "7_\\xffea\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00x\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00I\\x00n\\x00t\\x00e\\x00r\\x00n\\x00a\\x00l\\x00.\\x00S\\x00t\\x00a\\x00t\\x00e\\x00R\\x00e\\x00p\\x00o\\x00s\\x00i\\x00t\\x00o\\x00r\\x00y\\x00.\\x00A\\x00p\\x00p\\x00l\\x00i\\x00c\\x00a\\x00t\\x00i\\x00o\\x00n\\x00R\\x00e\\x00s\\x00o\\x00u\\x00r\\x00c\\x00e\\x00R\\x00e\\x00s\\x00o\\x00l\\x00v\\x00e\\x00r\\x00\\xff99\\xffe1Q\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff8a%\\x01\\x00\\x00\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\xffc4\\x02%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff0\\x0c%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0EzX\\xffff\\x7f\\x00\\x00\\xff98!y\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xffe2Q\r\\x00\\x00\\x00\\x00\\xff87\\xff9dNX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000-\\xff83\\x0c\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00p!y\\x0c\\x00\\x00\\x00\\x000-\\xff83\\x0c\\x00\\x00\\x00\\x00\\xffa0\"\\xffeb\\x08\\x00\\x00\\x00\\x00\\xffc7\\xffb3\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\xfff6sNX\\xffff\\x7f\\x00\\x00\\xffc0\\xff94\\xffa7\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffa0\"\\xffeb\\x08\\x00\\x00\\x00\\x00`\\xff9bq\\x07\\x00\\x00\\x00\\x00`\\xff9bq\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000-\\xff83\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x15\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x006\\xff8cYX\\xffff\\x7f\\x00\\x00\\xff80\\xffe5y\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xffe3Q\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xffe3Q\r\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 4653 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001abc" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.ApplicationResourceResolver\\ActivationType" } ], "repeated": 0, "id": 4654 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001abc" }, { "name": "ValueName", "value": "Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.ApplicationResourceResolver\\Server" } ], "repeated": 0, "id": 4655 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff585700bb", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001abc" }, { "name": "ValueName", "value": "DllPath" }, { "name": "Data", "value": "C:\\Windows\\System32\\Windows.StateRepositoryBroker.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.ApplicationResourceResolver\\DllPath" } ], "repeated": 0, "id": 4656 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001abc" }, { "name": "ValueName", "value": "Threading" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.ApplicationResourceResolver\\Threading" } ], "repeated": 0, "id": 4657 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001abc" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.ApplicationResourceResolver\\TrustLevel" } ], "repeated": 0, "id": 4658 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff584bc0fc", "parentcaller": "0x7fff58554170", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00001abc" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.ApplicationResourceResolver\\CustomAttributes" } ], "repeated": 0, "id": 4659 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001abc" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.ApplicationResourceResolver\\RemoteServer" } ], "repeated": 0, "id": 4660 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001abc" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.ApplicationResourceResolver\\ActivateAsUser" } ], "repeated": 0, "id": 4661 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001abc" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.ApplicationResourceResolver\\ActivateInSharedBroker" } ], "repeated": 0, "id": 4662 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001abc" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.ApplicationResourceResolver\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 4663 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58562222", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001abc" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.ApplicationResourceResolver\\Permissions" } ], "repeated": 0, "id": 4664 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001abc" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.ApplicationResourceResolver\\ActivateOnHostFlags" } ], "repeated": 0, "id": 4665 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff58557226", "parentcaller": "0x7fff5855ca23", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001abc" } ], "repeated": 0, "id": 4666 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff5855dd9d", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002548" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000430" }, { "name": "ObjectAttributesName", "value": "Windows.Internal.StateRepository.MrtApplication" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.MrtApplication" } ], "repeated": 0, "id": 4667 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff5855ddf7", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002548" }, { "name": "KeyInformation", "value": "y\\x1f\\x10\\xffd4\\xffde\\xffac\\xffd5\\x01\\x00\\x00\\x00\\x00^\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00I\\x00n\\x00t\\x00e\\x00r\\x00n\\x00a\\x00l\\x00.\\x00S\\x00t\\x00a\\x00t\\x00e\\x00R\\x00e\\x00p\\x00o\\x00s\\x00i\\x00t\\x00o\\x00r\\x00y\\x00.\\x00M\\x00r\\x00t\\x00A\\x00p\\x00p\\x00l\\x00i\\x00c\\x00a\\x00t\\x00i\\x00o\\x00n\\x00\\x00\\x00@\\xffa3\\xff89\\x0b\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x15\\x01\\x00\\x00\\x00\\x00\\xffd9\\xffe0Q\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff8a%\\x01\\x00\\x00\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\xffc4\\x02%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff0\\x0c%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0EzX\\xffff\\x7f\\x00\\x00(\"y\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0\\xffe1Q\r\\x00\\x00\\x00\\x00\\xff87\\xff9dNX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffe0 y\\x0c\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"y\\x0c\\x00\\x00\\x00\\x00\\xffe0 y\\x0c\\x00\\x00\\x00\\x00\\xffa0\"\\xffeb\\x08\\x00\\x00\\x00\\x00\\xffc7\\xffb3\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\xfff6sNX\\xffff\\x7f\\x00\\x00@\\xff9e\\xffa7\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffa0\"\\xffeb\\x08\\x00\\x00\\x00\\x00P\\xff98q\\x07\\x00\\x00\\x00\\x00P\\xff98q\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffe0 y\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00Q\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x006\\xff8cYX\\xffff\\x7f\\x00\\x000\\xffe5y\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffa0\\xffe2Q\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffa0\\xffe2Q\r\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 4668 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002548" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.MrtApplication\\ActivationType" } ], "repeated": 0, "id": 4669 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002548" }, { "name": "ValueName", "value": "Server" }, { "name": "Data", "value": "StateRepository" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.MrtApplication\\Server" } ], "repeated": 0, "id": 4670 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff585700bb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002548" }, { "name": "ValueName", "value": "DllPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.MrtApplication\\DllPath" } ], "repeated": 0, "id": 4671 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002548" }, { "name": "ValueName", "value": "Threading" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.MrtApplication\\Threading" } ], "repeated": 0, "id": 4672 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002548" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.MrtApplication\\TrustLevel" } ], "repeated": 0, "id": 4673 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff584bc0fc", "parentcaller": "0x7fff58554170", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00002548" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.MrtApplication\\CustomAttributes" } ], "repeated": 0, "id": 4674 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002548" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.MrtApplication\\RemoteServer" } ], "repeated": 0, "id": 4675 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002548" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.MrtApplication\\ActivateAsUser" } ], "repeated": 0, "id": 4676 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002548" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.MrtApplication\\ActivateInSharedBroker" } ], "repeated": 0, "id": 4677 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002548" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.MrtApplication\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 4678 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58562222", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002548" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.MrtApplication\\Permissions" } ], "repeated": 0, "id": 4679 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002548" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.MrtApplication\\ActivateOnHostFlags" } ], "repeated": 0, "id": 4680 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff58557226", "parentcaller": "0x7fff5855ca23", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002548" } ], "repeated": 0, "id": 4681 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 4682 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4683 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000360" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 4684 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4685 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000360" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 4686 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 4687 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 4688 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateChange\\PackageList\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateChange\\PackageList\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" } ], "repeated": 0, "id": 4689 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff577b26e8", "parentcaller": "0x7fff577b279b", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x90\\xecQ\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00c\\x00r\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00l\\x00i\\x00e\\x00n\\x00t\\x00.\\x00C\\x00B\\x00S\\x00_\\x001\\x000\\x000\\x000\\x00.\\x001\\x009\\x000\\x005\\x003\\x00" } ], "repeated": 0, "id": 4690 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 4691 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001258" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 4692 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001838" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00001258" }, { "name": "ObjectAttributesName", "value": "S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 4693 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001838" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 4694 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab0" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00001838" }, { "name": "ObjectAttributesName", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" } ], "repeated": 0, "id": 4695 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff577b4086", "parentcaller": "0x7fff577b27b6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001838" } ], "repeated": 0, "id": 4696 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff577b40c3", "parentcaller": "0x7fff577b27b6", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001ab0" }, { "name": "ValueName", "value": "PackageStatus" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\PackageStatus" } ], "repeated": 0, "id": 4697 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff577b40d4", "parentcaller": "0x7fff577b27b6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" } ], "repeated": 0, "id": 4698 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x18\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6148" } ], "repeated": 0, "id": 4699 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6160", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x18\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6160" } ], "repeated": 0, "id": 4700 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff40432de3", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 4701 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff577d6785", "parentcaller": "0x7fff4043e6eb", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab0" } ], "repeated": 0, "id": 4702 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6160", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x18\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6160" } ], "repeated": 0, "id": 4703 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff577d6785", "parentcaller": "0x7fff43952d08", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002540" } ], "repeated": 0, "id": 4704 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff42625c3d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000017d8" } ], "repeated": 0, "id": 4705 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "5000", "caller": "0x7fff428ef240", "parentcaller": "0x7fff428eb9c1", "category": "misc", "api": "GetSystemMetrics", "status": false, "return": "0x00000000", "arguments": [ { "name": "SystemMetricIndex", "value": "8192" } ], "repeated": 0, "id": 4706 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 4707 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6160", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x18\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6160" } ], "repeated": 0, "id": 4708 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6160", "caller": "0x7fff428ef240", "parentcaller": "0x7fff4260a2a2", "category": "misc", "api": "GetSystemMetrics", "status": false, "return": "0x00000000", "arguments": [ { "name": "SystemMetricIndex", "value": "8192" } ], "repeated": 0, "id": 4709 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc686b4", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 4710 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "5000", "caller": "0x7fff58519794", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "F6C29334-47DC-4397-9150-F549CF1D4861" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 4711 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xdf\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x005\\x18\\xff\\x7f\\x00\\x00X\\xe0\\\\x03\\x00\\x00\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4712 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab4" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 4713 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "5000", "caller": "0x7fff5855dd9d", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000017d8" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000430" }, { "name": "ObjectAttributesName", "value": "Windows.Storage.Streams.DataReader" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader" } ], "repeated": 0, "id": 4714 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "4696", "caller": "0x7ff79bc8a418", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab4" } ], "repeated": 0, "id": 4715 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "5000", "caller": "0x7fff5855ddf7", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000017d8" }, { "name": "KeyInformation", "value": "N\\xffc1\\xffec\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00D\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00S\\x00t\\x00o\\x00r\\x00a\\x00g\\x00e\\x00.\\x00S\\x00t\\x00r\\x00e\\x00a\\x00m\\x00s\\x00.\\x00D\\x00a\\x00t\\x00a\\x00R\\x00e\\x00a\\x00d\\x00e\\x00r\\x00\\x00\\x00\\x00\\x00k\\xffb8\\xfff7Y\\xffff\\x7f\\x00\\x00\r\\x00\\x1c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffe0\\xffdd\\xffa3\\x0c\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x15\\x01\\x00\\x00\\x00\\x00\\xff99\\xffdb\\x19\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xff8c%\\x01\\x00\\x00\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\xffc4\\x02%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\r%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0EzX\\xffff\\x7f\\x00\\x00h(p\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xffdc\\x19\\x08\\x00\\x00\\x00\\x00\\xff87\\xff9dNX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xffdc\\xffaa\\x0c\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@(p\\x0c\\x00\\x00\\x00\\x00p\\xffdc\\xffaa\\x0c\\x00\\x00\\x00\\x00\\xffd0^\\xffc8\\x0b\\x00\\x00\\x00\\x00\\xffc7\\xffb3\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\xfff6sNX\\xffff\\x7f\\x00\\x00\\x10\\xffea\\xffa7\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffd0^\\xffc8\\x0b\\x00\\x00\\x00\\x00\\xff90\\xffe9\\xffaa\\x0c\\x00\\x00\\x00\\x00\\xff90\\xffe9\\xffaa\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xffdc\\xffaa\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x006\\xff8cYX\\xffff\\x7f\\x00\\x00P&\\xff85\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xffdd\\x19\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xffdd\\x19\\x08\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 4716 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000017d8" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\ActivationType" } ], "repeated": 0, "id": 4717 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6160", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x18\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6160" } ], "repeated": 0, "id": 4718 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "5000", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000017d8" }, { "name": "ValueName", "value": "Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\Server" } ], "repeated": 0, "id": 4719 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "5000", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff585700bb", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000017d8" }, { "name": "ValueName", "value": "DllPath" }, { "name": "Data", "value": "C:\\Windows\\System32\\WinTypes.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\DllPath" } ], "repeated": 0, "id": 4720 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000017d8" }, { "name": "ValueName", "value": "Threading" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\Threading" } ], "repeated": 0, "id": 4721 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "5368", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xe4\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\\x14\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5368" } ], "repeated": 0, "id": 4722 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000017d8" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\TrustLevel" } ], "repeated": 0, "id": 4723 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "5000", "caller": "0x7fff584bc0fc", "parentcaller": "0x7fff58554170", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000017d8" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\CustomAttributes" } ], "repeated": 0, "id": 4724 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "5000", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000017d8" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\RemoteServer" } ], "repeated": 0, "id": 4725 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000017d8" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\ActivateAsUser" } ], "repeated": 0, "id": 4726 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000017d8" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\ActivateInSharedBroker" } ], "repeated": 0, "id": 4727 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000017d8" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 4728 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58562222", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000017d8" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\Permissions" } ], "repeated": 0, "id": 4729 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000017d8" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\ActivateOnHostFlags" } ], "repeated": 0, "id": 4730 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "5000", "caller": "0x7fff58557226", "parentcaller": "0x7fff5855ca23", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000017d8" } ], "repeated": 0, "id": 4731 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 4732 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "5000", "caller": "0x7fff57fc2eeb", "parentcaller": "0x7fff581ba00f", "category": "synchronization", "api": "NtFindAtom", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "AtomName", "value": "Windows.Internal.Shell.Holographic.Win32PortedView" }, { "name": "Atom", "value": "0x00000000" } ], "repeated": 1, "id": 4733 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff455848a6", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000017d8" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "6136" }, { "name": "ProcessName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe" } ], "repeated": 0, "id": 4734 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "5000", "caller": "0x7fff5781026b", "parentcaller": "0x7fff45584920", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000017d8" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00001af4" } ], "repeated": 0, "id": 4735 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "5000", "caller": "0x7fff45584c45", "parentcaller": "0x7fff45584941", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 4736 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "5000", "caller": "0x7fff45584ce5", "parentcaller": "0x7fff45584941", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\xa0\\xff\\xa8\\x0c\\x00\\x00\\x00\\x00\\x1c\\x00\\x1c\\x00\\x00\\x00\\x00\\x00@\\x00\\xa9\\x0c\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\x00\\xa9\\x0c\\x00\\x00\\x00\\x00\\x12\\x00\\x12\\x00\\x00\\x00\\x00\\x00v\\x01\\xa9\\x0c\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x01\\xa9\\x0c\\x00\\x00\\x00\\x00\\x1e\\x00\\x1e\\x00\\x00\\x00\\x00\\x00\\x90\\x01\\xa9\\x0c\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\x01\\xa9\\x0c\\x00\\x00\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00\\xb8\\x01\\xa9\\x0c\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd8\\x01\\xa9\\x0c\\x00\\x00\\x00\\x00W\\x00I\\x00N\\x00:\\x00/\\x00/\\x00S\\x00Y\\x00S\\x00A\\x00P\\x00P\\x00I\\x00D\\x00\\x00\\x00\\x00\\x00\\x88\\x00\\x88\\x00\\x00\\x00\\x00\\x00\\x90\\x00\\xa9\\x0c\\x00\\x00\\x00\\x00\\x12\\x00\\x12\\x00\\x00\\x00\\x00\\x00\\x18\\x01\\xa9\\x0c\\x00\\x00\\x00\\x00L\\x00L\\x00\\x00\\x00\\x00\\x00*\\x01\\xa9\\x0c\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4737 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "4500", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 4738 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff45584ab8", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000017d8" } ], "repeated": 0, "id": 4739 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "5000", "caller": "0x7fff425ce2da", "parentcaller": "0x7fff4257d46e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4740 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "5000", "caller": "0x7fff57fc2eeb", "parentcaller": "0x7fff581ba00f", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "MultimonitorActivationException" }, { "name": "Atom", "value": "0x0000c049" } ], "repeated": 0, "id": 4741 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 1, "id": 4742 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6164", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x18\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6164" } ], "repeated": 0, "id": 4743 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "4344", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xfc\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\\x10\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4344" } ], "repeated": 0, "id": 4744 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "10916", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xa4*\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "10916" } ], "repeated": 0, "id": 4745 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58085ee4", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002048" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 4746 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x18\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6148" } ], "repeated": 0, "id": 4747 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "10916", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000100c4" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 4748 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "4344", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 4749 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6148", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x18\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6148" } ], "repeated": 0, "id": 4750 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbd423", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001abc" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "6136" }, { "name": "ProcessName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe" } ], "repeated": 0, "id": 4751 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "5000", "caller": "0x7fff41dbd59f", "parentcaller": "0x7fff41dfc80c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001ac0" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "\\Device\\Bam" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 4752 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "5000", "caller": "0x7fff41dbd603", "parentcaller": "0x7fff41dfc80c", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001ac0" }, { "name": "HandleName", "value": "\\Device\\Bam" }, { "name": "IoControlCode", "value": "0x00220004" }, { "name": "InputBuffer", "value": "\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xbc\\x1a\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 4753 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbddbb", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001ac4" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "6136" }, { "name": "ProcessName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe" } ], "repeated": 0, "id": 4754 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbddbb", "category": "process", "api": "NtOpenProcess", "status": false, "return": "0xffffffffc0000022", "pretty_return": "ACCESS_DENIED", "arguments": [ { "name": "ProcessHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "1180" } ], "repeated": 0, "id": 4755 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbddbb", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001ac8" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "5624" }, { "name": "ProcessName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe" } ], "repeated": 0, "id": 4756 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbddbb", "category": "process", "api": "NtOpenProcess", "status": false, "return": "0xffffffffc0000022", "pretty_return": "ACCESS_DENIED", "arguments": [ { "name": "ProcessHandle", "value": "0x00001ac8" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "1048" } ], "repeated": 0, "id": 4757 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbddbb", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001acc" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 4758 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbddbb", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001ad0" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "5128" }, { "name": "ProcessName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe" } ], "repeated": 0, "id": 4759 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbddbb", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001ad4" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "6400" }, { "name": "ProcessName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe" } ], "repeated": 0, "id": 4760 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 21, "id": 4761 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6164", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x18\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6164" } ], "repeated": 0, "id": 4762 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 1, "id": 4763 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "5000", "caller": "0x7fff41dbe842", "parentcaller": "0x7fff41dbd62c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001ab4" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "\\Device\\Bam" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 4764 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "5000", "caller": "0x7fff41dbe8a3", "parentcaller": "0x7fff41dbd62c", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001ab4" }, { "name": "HandleName", "value": "\\Device\\Bam" }, { "name": "IoControlCode", "value": "0x00220004" }, { "name": "InputBuffer", "value": "\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc4\\x1a\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9c\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc8\\x1a\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xcc\\x1a\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\x1a\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd4\\x1a\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 4765 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff41dbe9a9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ac4" } ], "repeated": 0, "id": 4766 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff41dbe9a9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ac8" } ], "repeated": 0, "id": 4767 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff41dbe9a9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" } ], "repeated": 0, "id": 4768 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff41dbe9a9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ad0" } ], "repeated": 0, "id": 4769 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff41dbe9a9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ad4" } ], "repeated": 0, "id": 4770 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "5000", "caller": "0x7fff41dbe9d8", "parentcaller": "0x7fff41dbd62c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab4" } ], "repeated": 0, "id": 4771 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "5000", "caller": "0x7fff41dbd63b", "parentcaller": "0x7fff41dfc80c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ac0" } ], "repeated": 0, "id": 4772 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff41dbd64f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001abc" } ], "repeated": 0, "id": 4773 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "5000", "caller": "0x7fff57fc2eeb", "parentcaller": "0x7fff581ba00f", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "WindowShouldReportLayoutCompletedTelemetryProp" }, { "name": "Atom", "value": "0x0000c058" } ], "repeated": 0, "id": 4774 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 4775 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "5000", "caller": "0x7fff57fcb8ed", "parentcaller": "0x7fff58085341", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x00001ab4", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x7fff580853d0" }, { "name": "Parameter", "value": "0x04b8c630" }, { "name": "CreationFlags", "value": "0x00000004" }, { "name": "ThreadId", "value": "9572" }, { "name": "ProcessId", "value": "4484" } ], "repeated": 0, "id": 4776 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "5000", "caller": "0x7fff5781f430", "parentcaller": "0x7fff58085379", "category": "threading", "api": "NtResumeThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00001ab4" }, { "name": "SuspendCount", "value": "1" }, { "name": "ThreadId", "value": "9572" }, { "name": "ProcessId", "value": "4484" } ], "repeated": 0, "id": 4777 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff58085394", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab4" } ], "repeated": 0, "id": 4778 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58085f99", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ac0" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 4779 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "6164", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x18\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6164" } ], "repeated": 46, "id": 4780 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "10916", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000100c4" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 2, "id": 4781 }, { "timestamp": "2026-05-29 01:05:21,712", "thread_id": "10916", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xa4*\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "10916" } ], "repeated": 0, "id": 4782 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6156", "caller": "0x7fff58520e98", "parentcaller": "0x7fff5859b785", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 4783 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "9572", "caller": "0x7fff59fc507d", "parentcaller": "0x7fff59fc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4784 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "9572", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7fff580853d0" }, { "name": "Parameter", "value": "0x04b8c630" } ], "repeated": 0, "id": 4785 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "9572", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00d%\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "9572" } ], "repeated": 0, "id": 4786 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "4500", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 4787 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff57fc2755", "parentcaller": "0x7fff57fc2699", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "{\\x00C\\x005\\x006\\x00C\\x005\\x007\\x009\\x009\\x00-\\x004\\x00B\\x00B\\x003\\x00-\\x007\\x00F\\x00A\\x00E\\x00-\\x007\\x00F\\x00A\\x00D\\x00-\\x004\\x00D\\x00B\\x002\\x00F\\x006\\x00A\\x005\\x003\\x00E\\x00F\\x00F\\x00}\\x00" }, { "name": "Size", "value": "76" }, { "name": "Atom", "value": "0x0000c05f" } ], "repeated": 0, "id": 4788 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "4344", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 4789 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff57fc2755", "parentcaller": "0x7fff57fc2699", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "{\\x00C\\x005\\x006\\x00C\\x005\\x007\\x009\\x009\\x00-\\x004\\x00B\\x00B\\x003\\x00-\\x007\\x00F\\x00A\\x00E\\x00-\\x007\\x00F\\x00A\\x00D\\x00-\\x004\\x00D\\x00B\\x002\\x00F\\x006\\x00A\\x005\\x003\\x00E\\x00F\\x00F\\x00}\\x00" }, { "name": "Size", "value": "76" }, { "name": "Atom", "value": "0x0000c05f" } ], "repeated": 0, "id": 4790 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff517e2bd6", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001ad8" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "6136" }, { "name": "ProcessName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe" } ], "repeated": 0, "id": 4791 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 4792 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff517e2c87", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 4793 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff517e2cbb", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001adc" } ], "repeated": 0, "id": 4794 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff517e29b1", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001ad8" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "6136" }, { "name": "ProcessName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe" } ], "repeated": 0, "id": 4795 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff5781026b", "parentcaller": "0x7fff517e29fb", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001ad8" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00001adc" } ], "repeated": 0, "id": 4796 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff59f9413e", "parentcaller": "0x7fff517e2a39", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 4797 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff59f9416d", "parentcaller": "0x7fff517e2a39", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "31" }, { "name": "TokenInformation", "value": "\\x98\\xdf\\x19\\x08\\x00\\x00\\x00\\x00\\x01\\x08\\x00\\x00\\x00\\x00\\x00\\x0f\\x02\\x00\\x00\\x00<\\xe6\\xf3\\x1f\\x8a.\\x82*u\\xa8\\x8a?\\x1b(\\xed\\xbf9\\x8fA\\x14\\x0c\\xfc9u]5\n`\\xd8\\x1a\\x00\\x00\\x00\\x00\\x00\\x00\\xc2Tc\\x1a\\xff\\x7f\\x00\\x00\\xd8\\x1a\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4798 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff59f941a8", "parentcaller": "0x7fff517e2a39", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "42" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4799 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff59f941df", "parentcaller": "0x7fff517e2a39", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "12" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 4800 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff59f94256", "parentcaller": "0x7fff517e2a39", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "44" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb1&\\xfaY\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x880\\x13r^t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\xe5\\x19\\x08\\x00\\x00\\x00\\x00\\xf8\\x17\\x00\\x00\\x00\\x00\\x00\\x000a\\x88\\x10\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4801 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff517e2a5b", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001adc" } ], "repeated": 0, "id": 4802 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff517e2a75", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ad8" } ], "repeated": 0, "id": 4803 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577cf588", "parentcaller": "0x7fff517ead8b", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001ad8" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "Global\\Session\\1\\AppContainerNamedObjects\\S-1-15-2-536077884-713174666-1066051701-3219990555-339840825-1966734348-1611281757\\17f8HWNDInterface:1019e" } ], "repeated": 0, "id": 4804 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c232", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001ad8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0b2d0000" }, { "name": "SectionOffset", "value": "0x0819e510" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4805 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff517eae5e", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0b2d0000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 4806 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff517eae6d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ad8" } ], "repeated": 0, "id": 4807 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff46713ec2", "parentcaller": "0x7fff584cb8f1", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "6C3EE638-B588-4D7D-B30A-E7E36759305D" }, { "name": "ClsContext", "value": "0x00000004", "pretty_value": "CLSCTX_LOCAL_SERVER" }, { "name": "riid", "value": "54E4C428-D1D4-47D4-ADE6-46C829114A7D" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 4808 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff58519794", "parentcaller": "0x7fff517eb1dd", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "F6C29334-47DC-4397-9150-F549CF1D4861" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 4809 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 4810 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "4500", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 1, "id": 4811 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff5489080f", "parentcaller": "0x7fff5486709a", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00010128" }, { "name": "Message", "value": "0x00000060" } ], "repeated": 0, "id": 4812 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6156", "caller": "0x7fff58520e98", "parentcaller": "0x7fff5859b785", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 4813 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff425c54ef", "parentcaller": "0x7fff425c5361", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "45BA127D-10A8-46EA-8AB7-56EA9078943C" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "54E4C428-D1D4-47D4-ADE6-46C829114A7D" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 4814 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff42595b7f", "parentcaller": "0x7fff42595b24", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CloudExperienceHost" }, { "name": "Handle", "value": "0x00001ad0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CloudExperienceHost" } ], "repeated": 0, "id": 4815 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ad0" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 4816 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00001ad0" }, { "name": "ObjectAttributesName", "value": "Fullscreen" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CloudExperienceHost\\Fullscreen" } ], "repeated": 0, "id": 4817 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "4500", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 4818 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "9572", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5978ef53", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001ab8" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 4819 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff584d7b74", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000034a" }, { "name": "SubKey", "value": "CLSID\\{B03C2205-F02E-4D77-80DF-E1747AFDD39C}" }, { "name": "Handle", "value": "0x00001ab6" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{B03C2205-F02E-4D77-80DF-E1747AFDD39C}" } ], "repeated": 0, "id": 4820 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff42595b7f", "parentcaller": "0x7fff42595b24", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CloudExperienceHost" }, { "name": "Handle", "value": "0x00001ad0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CloudExperienceHost" } ], "repeated": 0, "id": 4821 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab6" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 4822 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ad0" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 4823 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xa0\\xd2i\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00{\\x00\\x00\\x00\\x00\\x00\\x00\\xfe\\xb6\\x1a\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xd3i\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4824 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00001ad0" }, { "name": "ObjectAttributesName", "value": "Fullscreen" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CloudExperienceHost\\Fullscreen" } ], "repeated": 0, "id": 4825 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 4826 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff426bfce2", "parentcaller": "0x7fff42595b24", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ad0" } ], "repeated": 0, "id": 4827 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00001ab6" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\TreatAs" } ], "repeated": 0, "id": 4828 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff585622e1", "parentcaller": "0x7fff584d7c1d", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab6" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 4829 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff42595b7f", "parentcaller": "0x7fff42595b24", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CloudExperienceHost" }, { "name": "Handle", "value": "0x00001ad0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CloudExperienceHost" } ], "repeated": 0, "id": 4830 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ad0" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 4831 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00001ad0" }, { "name": "ObjectAttributesName", "value": "Fullscreen" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CloudExperienceHost\\Fullscreen" } ], "repeated": 0, "id": 4832 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff426bfce2", "parentcaller": "0x7fff42595b24", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ad0" } ], "repeated": 0, "id": 4833 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab6" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\(Default)" } ], "repeated": 0, "id": 4834 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ad0" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 4835 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00001ad0" }, { "name": "ObjectAttributesName", "value": "Fullscreen" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CloudExperienceHost\\Fullscreen" } ], "repeated": 0, "id": 4836 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff426bfce2", "parentcaller": "0x7fff42595b24", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ad0" } ], "repeated": 0, "id": 4837 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab6" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "ExecModelProxy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\(Default)" } ], "repeated": 0, "id": 4838 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff42595b7f", "parentcaller": "0x7fff42595b24", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CloudExperienceHost" }, { "name": "Handle", "value": "0x00001ad0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CloudExperienceHost" } ], "repeated": 0, "id": 4839 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ad0" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 4840 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00001ad0" }, { "name": "ObjectAttributesName", "value": "Fullscreen" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CloudExperienceHost\\Fullscreen" } ], "repeated": 0, "id": 4841 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff584d8485", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00001ab6" }, { "name": "SubKey", "value": "InprocServer32" }, { "name": "Handle", "value": "0x00001af6" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocServer32" } ], "repeated": 0, "id": 4842 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 4843 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001af6" }, { "name": "ValueName", "value": "InprocServer32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocServer32\\InprocServer32" } ], "repeated": 0, "id": 4844 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af6" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocServer32\\(Default)" } ], "repeated": 0, "id": 4845 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff577f4aa9", "parentcaller": "0x7fff577d31c6", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af6" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "%systemroot%\\system32\\execmodelproxy.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocServer32\\(Default)" } ], "repeated": 1, "id": 4846 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d8d32", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af6" }, { "name": "ValueName", "value": "ThreadingModel" }, { "name": "Data", "value": "Both" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocServer32\\ThreadingModel" } ], "repeated": 0, "id": 4847 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff584d855f", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af6" } ], "repeated": 0, "id": 4848 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab6" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 4849 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 4850 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "0\\xd1i\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\xb6\\x1a\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xd2i\r\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4851 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocHandler32" } ], "repeated": 0, "id": 4852 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 4853 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00001ab6" }, { "name": "ObjectAttributesName", "value": "InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocHandler32" } ], "repeated": 0, "id": 4854 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab6" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 4855 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 4856 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "0\\xd1i\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\xb6\\x1a\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xd2i\r\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4857 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocHandler" } ], "repeated": 0, "id": 4858 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 4859 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00001ab6" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocHandler" } ], "repeated": 0, "id": 4860 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff584d8010", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab6" } ], "repeated": 0, "id": 4861 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "9572", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 1, "id": 4862 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 4863 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "4500", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 4864 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58085ee4", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002048" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 4865 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6164", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x18\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6164" } ], "repeated": 0, "id": 4866 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6156", "caller": "0x7fff58520e98", "parentcaller": "0x7fff5859b785", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 4867 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6164", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x18\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6164" } ], "repeated": 0, "id": 4868 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff57fc2a0e", "parentcaller": "0x7fff581d409e", "category": "synchronization", "api": "NtAddAtomEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "CrossProcessParentHWND" }, { "name": "Atom", "value": "0x0000c07d" } ], "repeated": 0, "id": 4869 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff57fc2a0e", "parentcaller": "0x7fff581d409e", "category": "synchronization", "api": "NtAddAtomEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "CrossProcessChildHWND" }, { "name": "Atom", "value": "0x0000c066" } ], "repeated": 0, "id": 4870 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff57fc2a0e", "parentcaller": "0x7fff581d409e", "category": "synchronization", "api": "NtAddAtomEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "NonComponentUIWindow" }, { "name": "Atom", "value": "0x0000c071" } ], "repeated": 0, "id": 4871 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff57fc2eeb", "parentcaller": "0x7fff581d609e", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "UIA_WindowPatternEnabled" }, { "name": "Atom", "value": "0x0000c057" } ], "repeated": 0, "id": 4872 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff4259fa9e", "parentcaller": "0x7fff425937e3", "category": "windows", "api": "FindWindowW", "status": true, "return": "0x00010094", "arguments": [ { "name": "ClassName", "value": "Shell_TrayWnd" }, { "name": "WindowName", "value": "" } ], "repeated": 0, "id": 4873 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff57fc2eeb", "parentcaller": "0x7fff581ba00f", "category": "synchronization", "api": "NtFindAtom", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "AtomName", "value": "IsAutoHideEnabled" }, { "name": "Atom", "value": "0x00000000" } ], "repeated": 0, "id": 4874 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 4875 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff4274356a", "parentcaller": "0x7fff42799839", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x00000002", "pretty_value": "KEY_SET_VALUE" }, { "name": "Handle", "value": "0x00001ad0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 4876 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff427435a9", "parentcaller": "0x7fff42799839", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ad0" }, { "name": "ValueName", "value": "TraySearchBoxVisible" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Buffer", "value": "0" }, { "name": "BufferLength", "value": "4" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\TraySearchBoxVisible" } ], "repeated": 0, "id": 4877 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff427435c1", "parentcaller": "0x7fff42799839", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ad0" } ], "repeated": 0, "id": 4878 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 4879 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 4880 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ad0" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced" } ], "repeated": 0, "id": 4881 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff425e8fa6", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001ad0" }, { "name": "ValueName", "value": "TaskbarSmallIcons" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\TaskbarSmallIcons" } ], "repeated": 0, "id": 4882 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d3018", "parentcaller": "0x7fff425e8fa6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ad0" } ], "repeated": 0, "id": 4883 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 4884 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 4885 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" } ], "repeated": 0, "id": 4886 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 4887 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 4888 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ad0" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" } ], "repeated": 0, "id": 4889 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001ad0" }, { "name": "ValueName", "value": "Current" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Current" } ], "repeated": 0, "id": 4890 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d3018", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ad0" } ], "repeated": 0, "id": 4891 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff5855dd9d", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ad0" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000430" }, { "name": "ObjectAttributesName", "value": "Windows.UI.ViewManagement.UISettings" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.ViewManagement.UISettings" } ], "repeated": 0, "id": 4892 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff5855ddf7", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ad0" }, { "name": "KeyInformation", "value": "N\\xffc1\\xffec\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00H\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00U\\x00I\\x00.\\x00V\\x00i\\x00e\\x00w\\x00M\\x00a\\x00n\\x00a\\x00g\\x00e\\x00m\\x00e\\x00n\\x00t\\x00.\\x00U\\x00I\\x00S\\x00e\\x00t\\x00t\\x00i\\x00n\\x00g\\x00s\\x00k\\xffb8\\xfff7Y\\xffff\\x7f\\x00\\x00\\x01\\x00\\x19\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0\\xff81\\xffd9\\x08\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x15\\x01\\x00\\x00\\x00\\x00i\\xffd4\\x19\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\xff8b%\\x01\\x00\\x00\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\xffc4\\x02%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\r%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0EzX\\xffff\\x7f\\x00\\x00X6t\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xffd5\\x19\\x08\\x00\\x00\\x00\\x00\\xff87\\xff9dNX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\xffd9s\\x0c\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0006t\\x0c\\x00\\x00\\x00\\x00\\xff80\\xffd9s\\x0c\\x00\\x00\\x00\\x00@yy\\x0c\\x00\\x00\\x00\\x00\\xffc7\\xffb3\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\xfff6sNX\\xffff\\x7f\\x00\\x00 \\xffc5\\xffac\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff@yy\\x0c\\x00\\x00\\x00\\x00`\\xffdas\\x0c\\x00\\x00\\x00\\x00`\\xffdas\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\xffd9s\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x006\\xff8cYX\\xffff\\x7f\\x00\\x00\\x10<|\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xffd6\\x19\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xffd6\\x19\\x08\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 4893 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ad0" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.ViewManagement.UISettings\\ActivationType" } ], "repeated": 0, "id": 4894 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001ad0" }, { "name": "ValueName", "value": "Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.ViewManagement.UISettings\\Server" } ], "repeated": 0, "id": 4895 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff585700bb", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ad0" }, { "name": "ValueName", "value": "DllPath" }, { "name": "Data", "value": "C:\\Windows\\System32\\Windows.UI.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.ViewManagement.UISettings\\DllPath" } ], "repeated": 0, "id": 4896 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ad0" }, { "name": "ValueName", "value": "Threading" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.ViewManagement.UISettings\\Threading" } ], "repeated": 0, "id": 4897 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ad0" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.ViewManagement.UISettings\\TrustLevel" } ], "repeated": 0, "id": 4898 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff584bc0fc", "parentcaller": "0x7fff58554170", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00001ad0" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.ViewManagement.UISettings\\CustomAttributes" } ], "repeated": 0, "id": 4899 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff4f752c16", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 4900 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff4f752c7a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "`i\\xc8\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00" } ], "repeated": 0, "id": 4901 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001ad0" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.ViewManagement.UISettings\\RemoteServer" } ], "repeated": 0, "id": 4902 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001ad0" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.ViewManagement.UISettings\\ActivateAsUser" } ], "repeated": 0, "id": 4903 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001ad0" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.ViewManagement.UISettings\\ActivateInSharedBroker" } ], "repeated": 0, "id": 4904 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001ad0" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.ViewManagement.UISettings\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 4905 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58562222", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001ad0" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.ViewManagement.UISettings\\Permissions" } ], "repeated": 0, "id": 4906 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001ad0" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.ViewManagement.UISettings\\ActivateOnHostFlags" } ], "repeated": 0, "id": 4907 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f7492f1", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": false, "return": "0x000000ea", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\" } ], "repeated": 0, "id": 4908 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f74950e", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001acc" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "87" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 4909 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f7492f1", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "1527c705-839a-4832-9118-54d4Bd6a0c89_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy" } ], "repeated": 0, "id": 4910 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff4bfd299f", "parentcaller": "0x7fff425e9098", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Accessibility" }, { "name": "Handle", "value": "0x00001ad0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Accessibility" } ], "repeated": 0, "id": 4911 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "1" }, { "name": "Name", "value": "c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy" } ], "repeated": 0, "id": 4912 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff4bfd2a6a", "parentcaller": "0x7fff425e9098", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ad0" } ], "repeated": 0, "id": 4913 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 4914 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "2" }, { "name": "Name", "value": "E2A4F912-2574-4A75-9BB0-0D023378592B_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\E2A4F912-2574-4A75-9BB0-0D023378592B_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy" } ], "repeated": 0, "id": 4915 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" } ], "repeated": 0, "id": 4916 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 4917 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "4" }, { "name": "Name", "value": "Microsoft.549981C3F5F10_1.1911.21713.0_neutral_~_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.549981C3F5F10_1.1911.21713.0_neutral_~_8wekyb3d8bbwe" } ], "repeated": 0, "id": 4918 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ad0" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" } ], "repeated": 0, "id": 4919 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001ad0" }, { "name": "ValueName", "value": "Current" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Current" } ], "repeated": 0, "id": 4920 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "7" }, { "name": "Name", "value": "Microsoft.AccountsControl_10.0.19041.3636_neutral__cw5n1h2txyewy" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.AccountsControl_10.0.19041.3636_neutral__cw5n1h2txyewy" } ], "repeated": 0, "id": 4921 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d3b20", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 4922 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 4923 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "8" }, { "name": "Name", "value": "Microsoft.Advertising.Xaml_10.1808.3.0_x64__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.Advertising.Xaml_10.1808.3.0_x64__8wekyb3d8bbwe" } ], "repeated": 0, "id": 4924 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 4925 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "9" }, { "name": "Name", "value": "Microsoft.AsyncTextService_10.0.19041.3636_neutral__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.AsyncTextService_10.0.19041.3636_neutral__8wekyb3d8bbwe" } ], "repeated": 0, "id": 4926 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d3018", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ad0" } ], "repeated": 0, "id": 4927 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "10" }, { "name": "Name", "value": "Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-100_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-100_8wekyb3d8bbwe" } ], "repeated": 0, "id": 4928 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 4929 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "11" }, { "name": "Name", "value": "Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-150_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-150_8wekyb3d8bbwe" } ], "repeated": 0, "id": 4930 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 4931 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "12" }, { "name": "Name", "value": "Microsoft.BingWeather_4.25.20211.0_neutral_~_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.BingWeather_4.25.20211.0_neutral_~_8wekyb3d8bbwe" } ], "repeated": 0, "id": 4932 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" } ], "repeated": 0, "id": 4933 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "13" }, { "name": "Name", "value": "Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe" } ], "repeated": 0, "id": 4934 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 4935 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ad0" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" } ], "repeated": 0, "id": 4936 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "15" }, { "name": "Name", "value": "Microsoft.CredDialogHost_10.0.19041.3636_neutral__cw5n1h2txyewy" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.CredDialogHost_10.0.19041.3636_neutral__cw5n1h2txyewy" } ], "repeated": 0, "id": 4937 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d3018", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ad0" } ], "repeated": 0, "id": 4938 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "16" }, { "name": "Name", "value": "Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe" } ], "repeated": 0, "id": 4939 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "17" }, { "name": "Name", "value": "Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe" } ], "repeated": 0, "id": 4940 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff4bfd2a24", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001ad0" }, { "name": "ValueName", "value": "TextScaleFactor" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Accessibility\\TextScaleFactor" } ], "repeated": 0, "id": 4941 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff4bfd2a6a", "parentcaller": "0x7fff425e9098", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ad0" } ], "repeated": 0, "id": 4942 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 4943 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "18" }, { "name": "Name", "value": "Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe" } ], "repeated": 0, "id": 4944 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" } ], "repeated": 0, "id": 4945 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 4946 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "20" }, { "name": "Name", "value": "Microsoft.ECApp_10.0.19041.3636_neutral__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.ECApp_10.0.19041.3636_neutral__8wekyb3d8bbwe" } ], "repeated": 0, "id": 4947 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ad0" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" } ], "repeated": 0, "id": 4948 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "21" }, { "name": "Name", "value": "Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-100_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-100_8wekyb3d8bbwe" } ], "repeated": 0, "id": 4949 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d3018", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ad0" } ], "repeated": 0, "id": 4950 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 4951 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "22" }, { "name": "Name", "value": "Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-125_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-125_8wekyb3d8bbwe" } ], "repeated": 0, "id": 4952 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" } ], "repeated": 0, "id": 4953 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 4954 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "24" }, { "name": "Name", "value": "Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe" } ], "repeated": 0, "id": 4955 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ad0" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" } ], "repeated": 0, "id": 4956 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "26" }, { "name": "Name", "value": "Microsoft.Getstarted_8.2.22942.0_neutral_~_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.Getstarted_8.2.22942.0_neutral_~_8wekyb3d8bbwe" } ], "repeated": 0, "id": 4957 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d3018", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ad0" } ], "repeated": 0, "id": 4958 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "27" }, { "name": "Name", "value": "Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe" } ], "repeated": 0, "id": 4959 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 4960 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" } ], "repeated": 0, "id": 4961 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "29" }, { "name": "Name", "value": "Microsoft.LockApp_10.0.19041.3636_neutral__cw5n1h2txyewy" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.LockApp_10.0.19041.3636_neutral__cw5n1h2txyewy" } ], "repeated": 0, "id": 4962 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d3b20", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 4963 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 4964 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "30" }, { "name": "Name", "value": "Microsoft.Microsoft3DViewer_6.1908.2042.0_neutral_~_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.Microsoft3DViewer_6.1908.2042.0_neutral_~_8wekyb3d8bbwe" } ], "repeated": 0, "id": 4965 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ad0" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" } ], "repeated": 0, "id": 4966 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "32" }, { "name": "Name", "value": "Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe" } ], "repeated": 0, "id": 4967 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d3018", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ad0" } ], "repeated": 0, "id": 4968 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "33" }, { "name": "Name", "value": "Microsoft.MicrosoftEdgeDevToolsClient_1000.19041.3636.0_neutral_neutral_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.MicrosoftEdgeDevToolsClient_1000.19041.3636.0_neutral_neutral_8wekyb3d8bbwe" } ], "repeated": 0, "id": 4969 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "34" }, { "name": "Name", "value": "Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_split.scale-100_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_split.scale-100_8wekyb3d8bbwe" } ], "repeated": 0, "id": 4970 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff57fc2a0e", "parentcaller": "0x7fff581d409e", "category": "synchronization", "api": "NtAddAtomEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "UIA_WindowVisibilityOverridden" }, { "name": "Atom", "value": "0x0000c042" } ], "repeated": 0, "id": 4971 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "36" }, { "name": "Name", "value": "Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_~_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_~_8wekyb3d8bbwe" } ], "repeated": 0, "id": 4972 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 4973 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "10916", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xa4*\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "10916" } ], "repeated": 0, "id": 4974 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "37" }, { "name": "Name", "value": "Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe" } ], "repeated": 0, "id": 4975 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "38" }, { "name": "Name", "value": "Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-125_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-125_8wekyb3d8bbwe" } ], "repeated": 0, "id": 4976 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "39" }, { "name": "Name", "value": "Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-200_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-200_8wekyb3d8bbwe" } ], "repeated": 0, "id": 4977 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "40" }, { "name": "Name", "value": "Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_~_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_~_8wekyb3d8bbwe" } ], "repeated": 0, "id": 4978 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6156", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x18\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6156" } ], "repeated": 0, "id": 4979 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff426be995", "parentcaller": "0x7fff425c65cb", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00010094" }, { "name": "Message", "value": "0x000005d1" } ], "repeated": 0, "id": 4980 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 4981 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58085ee4", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002048" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 4982 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "42" }, { "name": "Name", "value": "Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-100_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-100_8wekyb3d8bbwe" } ], "repeated": 0, "id": 4983 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "4696", "caller": "0x7ff79bc21348", "parentcaller": "0x7ff79bc2129c", "category": "misc", "api": "GetCursorPos", "status": true, "return": "0x00000001", "arguments": [ { "name": "x", "value": "24" }, { "name": "y", "value": "1064" } ], "repeated": 0, "id": 4984 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "43" }, { "name": "Name", "value": "Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-125_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-125_8wekyb3d8bbwe" } ], "repeated": 0, "id": 4985 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "44" }, { "name": "Name", "value": "Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_~_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_~_8wekyb3d8bbwe" } ], "repeated": 0, "id": 4986 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "45" }, { "name": "Name", "value": "Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe" } ], "repeated": 0, "id": 4987 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "46" }, { "name": "Name", "value": "Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-100_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-100_8wekyb3d8bbwe" } ], "repeated": 0, "id": 4988 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "47" }, { "name": "Name", "value": "Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-125_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-125_8wekyb3d8bbwe" } ], "repeated": 0, "id": 4989 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "48" }, { "name": "Name", "value": "Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_~_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_~_8wekyb3d8bbwe" } ], "repeated": 0, "id": 4990 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "4696", "caller": "0x7ff79bc2151a", "parentcaller": "0x7ff79bc213ca", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 4991 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "49" }, { "name": "Name", "value": "Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe" } ], "repeated": 0, "id": 4992 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6152", "caller": "0x7fff58520e98", "parentcaller": "0x7fff5855be33", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 4993 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff578553d6", "parentcaller": "0x7fff577d2048", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001acc" }, { "name": "Index", "value": "50" } ], "repeated": 0, "id": 4994 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "4560", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\x11\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4560" } ], "repeated": 0, "id": 4995 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "51" }, { "name": "Name", "value": "Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe" } ], "repeated": 0, "id": 4996 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "52" }, { "name": "Name", "value": "Microsoft.NET.Native.Framework.1.7_1.7.25531.0_x64__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.NET.Native.Framework.1.7_1.7.25531.0_x64__8wekyb3d8bbwe" } ], "repeated": 0, "id": 4997 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "53" }, { "name": "Name", "value": "Microsoft.NET.Native.Framework.2.2_2.2.27405.0_x64__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.NET.Native.Framework.2.2_2.2.27405.0_x64__8wekyb3d8bbwe" } ], "repeated": 0, "id": 4998 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "54" }, { "name": "Name", "value": "Microsoft.NET.Native.Runtime.1.7_1.7.25531.0_x64__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.NET.Native.Runtime.1.7_1.7.25531.0_x64__8wekyb3d8bbwe" } ], "repeated": 0, "id": 4999 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "55" }, { "name": "Name", "value": "Microsoft.NET.Native.Runtime.2.2_2.2.27328.0_x64__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.NET.Native.Runtime.2.2_2.2.27328.0_x64__8wekyb3d8bbwe" } ], "repeated": 0, "id": 5000 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "56" }, { "name": "Name", "value": "Microsoft.Office.OneNote_16001.12026.20112.0_neutral_~_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.Office.OneNote_16001.12026.20112.0_neutral_~_8wekyb3d8bbwe" } ], "repeated": 0, "id": 5001 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "57" }, { "name": "Name", "value": "Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe" } ], "repeated": 0, "id": 5002 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "58" }, { "name": "Name", "value": "Microsoft.People_10.1902.633.0_neutral_split.scale-100_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.People_10.1902.633.0_neutral_split.scale-100_8wekyb3d8bbwe" } ], "repeated": 0, "id": 5003 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "59" }, { "name": "Name", "value": "Microsoft.People_10.1902.633.0_neutral_split.scale-125_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.People_10.1902.633.0_neutral_split.scale-125_8wekyb3d8bbwe" } ], "repeated": 0, "id": 5004 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "60" }, { "name": "Name", "value": "Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe" } ], "repeated": 0, "id": 5005 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "61" }, { "name": "Name", "value": "Microsoft.People_2019.305.632.0_neutral_~_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.People_2019.305.632.0_neutral_~_8wekyb3d8bbwe" } ], "repeated": 0, "id": 5006 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "62" }, { "name": "Name", "value": "Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-100_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-100_8wekyb3d8bbwe" } ], "repeated": 0, "id": 5007 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "63" }, { "name": "Name", "value": "Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-125_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-125_8wekyb3d8bbwe" } ], "repeated": 0, "id": 5008 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "64" }, { "name": "Name", "value": "Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe" } ], "repeated": 0, "id": 5009 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "65" }, { "name": "Name", "value": "Microsoft.ScreenSketch_2019.904.1644.0_neutral_~_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.ScreenSketch_2019.904.1644.0_neutral_~_8wekyb3d8bbwe" } ], "repeated": 0, "id": 5010 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "66" }, { "name": "Name", "value": "Microsoft.Services.Store.Engagement_10.0.18101.0_x64__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.Services.Store.Engagement_10.0.18101.0_x64__8wekyb3d8bbwe" } ], "repeated": 0, "id": 5011 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "67" }, { "name": "Name", "value": "Microsoft.Services.Store.Engagement_10.0.18101.0_x86__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.Services.Store.Engagement_10.0.18101.0_x86__8wekyb3d8bbwe" } ], "repeated": 0, "id": 5012 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "68" }, { "name": "Name", "value": "Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-100_kzf8qxf38zg5c" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-100_kzf8qxf38zg5c" } ], "repeated": 0, "id": 5013 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "69" }, { "name": "Name", "value": "Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-125_kzf8qxf38zg5c" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-125_kzf8qxf38zg5c" } ], "repeated": 0, "id": 5014 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "70" }, { "name": "Name", "value": "Microsoft.SkypeApp_14.53.77.0_neutral_~_kzf8qxf38zg5c" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.SkypeApp_14.53.77.0_neutral_~_kzf8qxf38zg5c" } ], "repeated": 0, "id": 5015 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "71" }, { "name": "Name", "value": "Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c" } ], "repeated": 0, "id": 5016 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "72" }, { "name": "Name", "value": "Microsoft.StorePurchaseApp_11811.1001.18.0_neutral_split.scale-100_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.StorePurchaseApp_11811.1001.18.0_neutral_split.scale-100_8wekyb3d8bbwe" } ], "repeated": 0, "id": 5017 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "73" }, { "name": "Name", "value": "Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe" } ], "repeated": 0, "id": 5018 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "74" }, { "name": "Name", "value": "Microsoft.StorePurchaseApp_11811.1001.1813.0_neutral_~_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.StorePurchaseApp_11811.1001.1813.0_neutral_~_8wekyb3d8bbwe" } ], "repeated": 0, "id": 5019 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "75" }, { "name": "Name", "value": "Microsoft.UI.Xaml.2.0_2.1810.18004.0_x64__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.UI.Xaml.2.0_2.1810.18004.0_x64__8wekyb3d8bbwe" } ], "repeated": 0, "id": 5020 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "76" }, { "name": "Name", "value": "Microsoft.VCLibs.140.00.UWPDesktop_14.0.27629.0_x64__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.VCLibs.140.00.UWPDesktop_14.0.27629.0_x64__8wekyb3d8bbwe" } ], "repeated": 0, "id": 5021 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "77" }, { "name": "Name", "value": "Microsoft.VCLibs.140.00_14.0.27323.0_x64__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.VCLibs.140.00_14.0.27323.0_x64__8wekyb3d8bbwe" } ], "repeated": 0, "id": 5022 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "78" }, { "name": "Name", "value": "Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe" } ], "repeated": 0, "id": 5023 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "79" }, { "name": "Name", "value": "Microsoft.Wallet_2.4.18324.0_neutral_~_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.Wallet_2.4.18324.0_neutral_~_8wekyb3d8bbwe" } ], "repeated": 0, "id": 5024 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "80" }, { "name": "Name", "value": "Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe" } ], "repeated": 0, "id": 5025 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "81" }, { "name": "Name", "value": "Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-100_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-100_8wekyb3d8bbwe" } ], "repeated": 0, "id": 5026 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "82" }, { "name": "Name", "value": "Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-125_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-125_8wekyb3d8bbwe" } ], "repeated": 0, "id": 5027 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "83" }, { "name": "Name", "value": "Microsoft.WebMediaExtensions_1.0.20875.0_neutral_~_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_~_8wekyb3d8bbwe" } ], "repeated": 0, "id": 5028 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "84" }, { "name": "Name", "value": "Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe" } ], "repeated": 0, "id": 5029 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "85" }, { "name": "Name", "value": "Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe" } ], "repeated": 0, "id": 5030 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "86" }, { "name": "Name", "value": "Microsoft.Win32WebViewHost_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.Win32WebViewHost_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy" } ], "repeated": 0, "id": 5031 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "87" }, { "name": "Name", "value": "Microsoft.Windows.Apprep.ChxApp_1000.19041.3636.0_neutral_neutral_cw5n1h2txyewy" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.Windows.Apprep.ChxApp_1000.19041.3636.0_neutral_neutral_cw5n1h2txyewy" } ], "repeated": 0, "id": 5032 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "88" }, { "name": "Name", "value": "Microsoft.Windows.AssignedAccessLockApp_1000.19041.3636.0_neutral_neutral_cw5n1h2txyewy" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.Windows.AssignedAccessLockApp_1000.19041.3636.0_neutral_neutral_cw5n1h2txyewy" } ], "repeated": 0, "id": 5033 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "89" }, { "name": "Name", "value": "Microsoft.Windows.CallingShellApp_1000.19041.3636.0_neutral_neutral_cw5n1h2txyewy" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.Windows.CallingShellApp_1000.19041.3636.0_neutral_neutral_cw5n1h2txyewy" } ], "repeated": 0, "id": 5034 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "90" }, { "name": "Name", "value": "Microsoft.Windows.CapturePicker_10.0.19041.3636_neutral__cw5n1h2txyewy" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.Windows.CapturePicker_10.0.19041.3636_neutral__cw5n1h2txyewy" } ], "repeated": 0, "id": 5035 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "91" }, { "name": "Name", "value": "Microsoft.Windows.CloudExperienceHost_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.Windows.CloudExperienceHost_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy" } ], "repeated": 0, "id": 5036 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "92" }, { "name": "Name", "value": "Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy" } ], "repeated": 0, "id": 5037 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "93" }, { "name": "Name", "value": "Microsoft.Windows.NarratorQuickStart_10.0.19041.3636_neutral_neutral_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.Windows.NarratorQuickStart_10.0.19041.3636_neutral_neutral_8wekyb3d8bbwe" } ], "repeated": 0, "id": 5038 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "94" }, { "name": "Name", "value": "Microsoft.Windows.OOBENetworkCaptivePortal_10.0.19041.3636_neutral__cw5n1h2txyewy" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.Windows.OOBENetworkCaptivePortal_10.0.19041.3636_neutral__cw5n1h2txyewy" } ], "repeated": 0, "id": 5039 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "95" }, { "name": "Name", "value": "Microsoft.Windows.OOBENetworkConnectionFlow_10.0.19041.3636_neutral__cw5n1h2txyewy" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.Windows.OOBENetworkConnectionFlow_10.0.19041.3636_neutral__cw5n1h2txyewy" } ], "repeated": 0, "id": 5040 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "96" }, { "name": "Name", "value": "Microsoft.Windows.ParentalControls_1000.19041.3636.0_neutral_neutral_cw5n1h2txyewy" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.Windows.ParentalControls_1000.19041.3636.0_neutral_neutral_cw5n1h2txyewy" } ], "repeated": 0, "id": 5041 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "97" }, { "name": "Name", "value": "Microsoft.Windows.PeopleExperienceHost_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.Windows.PeopleExperienceHost_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy" } ], "repeated": 0, "id": 5042 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "98" }, { "name": "Name", "value": "Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-100_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-100_8wekyb3d8bbwe" } ], "repeated": 0, "id": 5043 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "4560", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5978ef53", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001ad8" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 5044 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "99" }, { "name": "Name", "value": "Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-125_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-125_8wekyb3d8bbwe" } ], "repeated": 0, "id": 5045 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "4560", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff584c6d2f", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001adc" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 5046 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "100" }, { "name": "Name", "value": "Microsoft.Windows.Photos_2019.19071.12548.0_neutral_~_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_~_8wekyb3d8bbwe" } ], "repeated": 0, "id": 5047 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "101" }, { "name": "Name", "value": "Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe" } ], "repeated": 0, "id": 5048 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "4560", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\x11\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4560" } ], "repeated": 0, "id": 5049 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "9572", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 1, "id": 5050 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff4274356a", "parentcaller": "0x7fff42799839", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x00000002", "pretty_value": "KEY_SET_VALUE" }, { "name": "Handle", "value": "0x00001af4" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 5051 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "102" }, { "name": "Name", "value": "Microsoft.Windows.PinningConfirmationDialog_1000.19041.3636.0_neutral__cw5n1h2txyewy" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.Windows.PinningConfirmationDialog_1000.19041.3636.0_neutral__cw5n1h2txyewy" } ], "repeated": 0, "id": 5052 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff427435a9", "parentcaller": "0x7fff42799839", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af4" }, { "name": "ValueName", "value": "TraySearchBoxVisible" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Buffer", "value": "0" }, { "name": "BufferLength", "value": "4" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\TraySearchBoxVisible" } ], "repeated": 0, "id": 5053 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "103" }, { "name": "Name", "value": "Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy" } ], "repeated": 0, "id": 5054 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff427435c1", "parentcaller": "0x7fff42799839", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af4" } ], "repeated": 0, "id": 5055 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 5056 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5057 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001af4" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced" } ], "repeated": 0, "id": 5058 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "105" }, { "name": "Name", "value": "Microsoft.Windows.SecureAssessmentBrowser_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.Windows.SecureAssessmentBrowser_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy" } ], "repeated": 0, "id": 5059 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d3018", "parentcaller": "0x7fff425e8fa6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af4" } ], "repeated": 0, "id": 5060 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 5061 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "106" }, { "name": "Name", "value": "Microsoft.Windows.ShellExperienceHost_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.Windows.ShellExperienceHost_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy" } ], "repeated": 0, "id": 5062 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5063 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "107" }, { "name": "Name", "value": "Microsoft.Windows.StartMenuExperienceHost_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.Windows.StartMenuExperienceHost_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy" } ], "repeated": 0, "id": 5064 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d3b20", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 5065 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff578553d6", "parentcaller": "0x7fff577d2048", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001acc" }, { "name": "Index", "value": "108" } ], "repeated": 0, "id": 5066 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5067 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "109" }, { "name": "Name", "value": "Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-100_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-100_8wekyb3d8bbwe" } ], "repeated": 0, "id": 5068 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001af4" }, { "name": "ValueName", "value": "Current" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Current" } ], "repeated": 0, "id": 5069 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "111" }, { "name": "Name", "value": "Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe" } ], "repeated": 0, "id": 5070 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "112" }, { "name": "Name", "value": "Microsoft.WindowsAlarms_2019.807.41.0_neutral_~_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.WindowsAlarms_2019.807.41.0_neutral_~_8wekyb3d8bbwe" } ], "repeated": 0, "id": 5071 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "113" }, { "name": "Name", "value": "Microsoft.WindowsCalculator_10.1906.55.0_neutral_split.scale-100_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.WindowsCalculator_10.1906.55.0_neutral_split.scale-100_8wekyb3d8bbwe" } ], "repeated": 0, "id": 5072 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff4bfd299f", "parentcaller": "0x7fff425e9098", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Accessibility" }, { "name": "Handle", "value": "0x00001af4" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Accessibility" } ], "repeated": 0, "id": 5073 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff4bfd2a24", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001af4" }, { "name": "ValueName", "value": "TextScaleFactor" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Accessibility\\TextScaleFactor" } ], "repeated": 0, "id": 5074 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "115" }, { "name": "Name", "value": "Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe" } ], "repeated": 0, "id": 5075 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 5076 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5077 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "116" }, { "name": "Name", "value": "Microsoft.WindowsCalculator_2020.1906.55.0_neutral_~_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.WindowsCalculator_2020.1906.55.0_neutral_~_8wekyb3d8bbwe" } ], "repeated": 0, "id": 5078 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 5079 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "117" }, { "name": "Name", "value": "Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-125_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-125_8wekyb3d8bbwe" } ], "repeated": 0, "id": 5080 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001af4" }, { "name": "ValueName", "value": "Current" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Current" } ], "repeated": 0, "id": 5081 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d3018", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af4" } ], "repeated": 0, "id": 5082 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "118" }, { "name": "Name", "value": "Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-200_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-200_8wekyb3d8bbwe" } ], "repeated": 0, "id": 5083 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d3b20", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 5084 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5085 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" } ], "repeated": 0, "id": 5086 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 5087 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "120" }, { "name": "Name", "value": "Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe" } ], "repeated": 0, "id": 5088 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5089 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001af4" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" } ], "repeated": 0, "id": 5090 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "121" }, { "name": "Name", "value": "microsoft.windowscommunicationsapps_16005.11629.20316.0_neutral_~_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\microsoft.windowscommunicationsapps_16005.11629.20316.0_neutral_~_8wekyb3d8bbwe" } ], "repeated": 0, "id": 5091 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001af4" }, { "name": "ValueName", "value": "Current" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Current" } ], "repeated": 0, "id": 5092 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "122" }, { "name": "Name", "value": "microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe" } ], "repeated": 0, "id": 5093 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 5094 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5095 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" } ], "repeated": 0, "id": 5096 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 5097 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "125" }, { "name": "Name", "value": "Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe" } ], "repeated": 0, "id": 5098 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d3b20", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 5099 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5100 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "126" }, { "name": "Name", "value": "Microsoft.WindowsFeedbackHub_2019.1111.2029.0_neutral_~_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.WindowsFeedbackHub_2019.1111.2029.0_neutral_~_8wekyb3d8bbwe" } ], "repeated": 0, "id": 5101 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001af4" }, { "name": "ValueName", "value": "Current" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Current" } ], "repeated": 0, "id": 5102 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d3018", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af4" } ], "repeated": 0, "id": 5103 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "128" }, { "name": "Name", "value": "Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe" } ], "repeated": 0, "id": 5104 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "129" }, { "name": "Name", "value": "Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe" } ], "repeated": 0, "id": 5105 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff4bfd2a6a", "parentcaller": "0x7fff425e9098", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af4" } ], "repeated": 0, "id": 5106 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 5107 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "130" }, { "name": "Name", "value": "Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe" } ], "repeated": 0, "id": 5108 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5109 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" } ], "repeated": 0, "id": 5110 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "131" }, { "name": "Name", "value": "Microsoft.WindowsSoundRecorder_10.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.WindowsSoundRecorder_10.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe" } ], "repeated": 0, "id": 5111 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 5112 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5113 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001af4" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" } ], "repeated": 0, "id": 5114 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001af4" }, { "name": "ValueName", "value": "Current" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Current" } ], "repeated": 0, "id": 5115 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d3018", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af4" } ], "repeated": 0, "id": 5116 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 5117 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5118 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" } ], "repeated": 0, "id": 5119 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 5120 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "133" }, { "name": "Name", "value": "Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe" } ], "repeated": 0, "id": 5121 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001af4" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" } ], "repeated": 0, "id": 5122 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001af4" }, { "name": "ValueName", "value": "Current" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Current" } ], "repeated": 0, "id": 5123 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d3018", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af4" } ], "repeated": 0, "id": 5124 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 5125 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5126 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" } ], "repeated": 0, "id": 5127 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 5128 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "137" }, { "name": "Name", "value": "Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe" } ], "repeated": 0, "id": 5129 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5130 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001af4" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" } ], "repeated": 0, "id": 5131 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577d3e41", "parentcaller": "0x7fff578543b9", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00001af4" }, { "name": "ValueName", "value": "Current" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Current" } ], "repeated": 0, "id": 5132 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "140" }, { "name": "Name", "value": "Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe" } ], "repeated": 0, "id": 5133 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 5134 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "141" }, { "name": "Name", "value": "Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-125_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-125_8wekyb3d8bbwe" } ], "repeated": 0, "id": 5135 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff57fc2a0e", "parentcaller": "0x7fff581d409e", "category": "synchronization", "api": "NtAddAtomEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "UIA_WindowVisibilityOverridden" }, { "name": "Atom", "value": "0x0000c042" } ], "repeated": 0, "id": 5136 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6164", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x18\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6164" } ], "repeated": 0, "id": 5137 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 5138 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "142" }, { "name": "Name", "value": "Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-200_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-200_8wekyb3d8bbwe" } ], "repeated": 0, "id": 5139 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58085ee4", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002048" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 5140 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "10916", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xa4*\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "10916" } ], "repeated": 0, "id": 5141 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "143" }, { "name": "Name", "value": "Microsoft.XboxApp_48.49.31001.0_neutral_~_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.XboxApp_48.49.31001.0_neutral_~_8wekyb3d8bbwe" } ], "repeated": 0, "id": 5142 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "144" }, { "name": "Name", "value": "Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe" } ], "repeated": 0, "id": 5143 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "10916", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xa4*\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "10916" } ], "repeated": 0, "id": 5144 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "145" }, { "name": "Name", "value": "Microsoft.XboxGameCallableUI_1000.19041.3636.0_neutral_neutral_cw5n1h2txyewy" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.XboxGameCallableUI_1000.19041.3636.0_neutral_neutral_cw5n1h2txyewy" } ], "repeated": 0, "id": 5145 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "4500", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 5146 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "146" }, { "name": "Name", "value": "Microsoft.XboxGameOverlay_1.46.11001.0_neutral_split.scale-100_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.XboxGameOverlay_1.46.11001.0_neutral_split.scale-100_8wekyb3d8bbwe" } ], "repeated": 0, "id": 5147 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6164", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x18\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6164" } ], "repeated": 0, "id": 5148 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "147" }, { "name": "Name", "value": "Microsoft.XboxGameOverlay_1.46.11001.0_neutral_~_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.XboxGameOverlay_1.46.11001.0_neutral_~_8wekyb3d8bbwe" } ], "repeated": 0, "id": 5149 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 5150 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "148" }, { "name": "Name", "value": "Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe" } ], "repeated": 0, "id": 5151 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "149" }, { "name": "Name", "value": "Microsoft.XboxGamingOverlay_2.34.28001.0_neutral_split.scale-100_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.XboxGamingOverlay_2.34.28001.0_neutral_split.scale-100_8wekyb3d8bbwe" } ], "repeated": 0, "id": 5152 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "150" }, { "name": "Name", "value": "Microsoft.XboxGamingOverlay_2.34.28001.0_neutral_split.scale-125_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.XboxGamingOverlay_2.34.28001.0_neutral_split.scale-125_8wekyb3d8bbwe" } ], "repeated": 0, "id": 5153 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "151" }, { "name": "Name", "value": "Microsoft.XboxGamingOverlay_2.34.28001.0_neutral_~_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.XboxGamingOverlay_2.34.28001.0_neutral_~_8wekyb3d8bbwe" } ], "repeated": 0, "id": 5154 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "4696", "caller": "0x7ff79bc2151a", "parentcaller": "0x7ff79bc213ca", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 5155 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "152" }, { "name": "Name", "value": "Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe" } ], "repeated": 0, "id": 5156 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6152", "caller": "0x7fff58520e98", "parentcaller": "0x7fff5855be33", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 5157 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "153" }, { "name": "Name", "value": "Microsoft.XboxIdentityProvider_12.50.6001.0_neutral_~_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.XboxIdentityProvider_12.50.6001.0_neutral_~_8wekyb3d8bbwe" } ], "repeated": 0, "id": 5158 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "154" }, { "name": "Name", "value": "Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe" } ], "repeated": 0, "id": 5159 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "4500", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xfe\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x94\\x11\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4500" } ], "repeated": 0, "id": 5160 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "4696", "caller": "0x7ff79bc2153a", "parentcaller": "0x7ff79bc213ca", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 1, "id": 5161 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "155" }, { "name": "Name", "value": "Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_neutral_split.scale-100_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_neutral_split.scale-100_8wekyb3d8bbwe" } ], "repeated": 0, "id": 5162 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "9572", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 5163 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "156" }, { "name": "Name", "value": "Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_neutral_~_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_neutral_~_8wekyb3d8bbwe" } ], "repeated": 0, "id": 5164 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "159" }, { "name": "Name", "value": "Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-125_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-125_8wekyb3d8bbwe" } ], "repeated": 0, "id": 5165 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "160" }, { "name": "Name", "value": "Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe" } ], "repeated": 0, "id": 5166 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "161" }, { "name": "Name", "value": "Microsoft.YourPhone_2019.430.2026.0_neutral_~_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.YourPhone_2019.430.2026.0_neutral_~_8wekyb3d8bbwe" } ], "repeated": 0, "id": 5167 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "162" }, { "name": "Name", "value": "Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe" } ], "repeated": 0, "id": 5168 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "4696", "caller": "0x7fff57fc2a0e", "parentcaller": "0x7fff581d409e", "category": "synchronization", "api": "NtAddAtomEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "TrayRaisedWindowProp" }, { "name": "Atom", "value": "0x0000c06d" } ], "repeated": 0, "id": 5169 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6156", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 5170 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "9572", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00d%\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "9572" } ], "repeated": 0, "id": 5171 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "164" }, { "name": "Name", "value": "Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe" } ], "repeated": 0, "id": 5172 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "4696", "caller": "0x7ff79bc216ed", "parentcaller": "0x7ff79bc215c3", "category": "synchronization", "api": "NtAddAtomEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "TrayRaisedWindowProp" }, { "name": "Atom", "value": "0x0000c06d" } ], "repeated": 0, "id": 5173 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6152", "caller": "0x7fff577d6785", "parentcaller": "0x7fff557c403a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001838" } ], "repeated": 0, "id": 5174 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "4500", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 5175 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "165" }, { "name": "Name", "value": "Microsoft.ZuneMusic_2019.19071.19011.0_neutral_~_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.ZuneMusic_2019.19071.19011.0_neutral_~_8wekyb3d8bbwe" } ], "repeated": 0, "id": 5176 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6148", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 5177 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "166" }, { "name": "Name", "value": "Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe" } ], "repeated": 0, "id": 5178 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6156", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 5179 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "167" }, { "name": "Name", "value": "Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe" } ], "repeated": 0, "id": 5180 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6148", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x18\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6148" } ], "repeated": 0, "id": 5181 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "169" }, { "name": "Name", "value": "Microsoft.ZuneVideo_2019.19071.19011.0_neutral_~_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.ZuneVideo_2019.19071.19011.0_neutral_~_8wekyb3d8bbwe" } ], "repeated": 0, "id": 5182 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Index", "value": "170" }, { "name": "Name", "value": "MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" } ], "repeated": 0, "id": 5183 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4f749620", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" } ], "repeated": 0, "id": 5184 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6156", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 5185 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff59f667b5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x00\\xdei\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00q\\xe0i\r\\x00\\x00\\x00\\x00,\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xdfi\r\\x00\\x00\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5186 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff59f667ec", "parentcaller": "0x7fff577b5140", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001acc" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 5187 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "4504", "caller": "0x7fff58520e98", "parentcaller": "0x7fff5859b785", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 5188 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001acc" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5189 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001838" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00001acc" }, { "name": "ObjectAttributesName", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Families\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Families\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy" } ], "repeated": 0, "id": 5190 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff577b50dc", "parentcaller": "0x7fff577b4da8", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" } ], "repeated": 0, "id": 5191 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58085ee4", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002048" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 5192 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "4344", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 5193 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff577b4e18", "parentcaller": "0x7fff577b4cae", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001838" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Families\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" } ], "repeated": 0, "id": 5194 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001838" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5195 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "4500", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 1, "id": 5196 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 5197 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff577b4fee", "parentcaller": "0x7fff577b4e3e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "ValueName", "value": "Flags" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Families\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\Flags" } ], "repeated": 0, "id": 5198 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff577d43a6", "parentcaller": "0x7fff577b4ffa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" } ], "repeated": 0, "id": 5199 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "4344", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 5200 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff577b4e18", "parentcaller": "0x7fff577b4cae", "category": "registry", "api": "RegEnumKeyExW", "status": false, "return": "0x00000103", "pretty_return": "NO_MORE_ITEMS", "arguments": [ { "name": "Handle", "value": "0x00001838" }, { "name": "Index", "value": "1" }, { "name": "Name", "value": "" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Families\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\\" } ], "repeated": 0, "id": 5201 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "4696", "caller": "0x7ff79bc69b1e", "parentcaller": "0x7ff79bc69f41", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 5202 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff577b4ef4", "parentcaller": "0x7fff577b4cae", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001838" } ], "repeated": 0, "id": 5203 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "4500", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xfe\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x94\\x11\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4500" } ], "repeated": 0, "id": 5204 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "4696", "caller": "0x7ff79bc69b1e", "parentcaller": "0x7ff79bc69f41", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 5205 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5206 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 5207 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "4696", "caller": "0x7ff79bc69b1e", "parentcaller": "0x7ff79bc69f41", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5208 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6164", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x18\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6164" } ], "repeated": 0, "id": 5209 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 5210 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6156", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 1, "id": 5211 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001838" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00001258" }, { "name": "ObjectAttributesName", "value": "S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 5212 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001838" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5213 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001acc" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00001838" }, { "name": "ObjectAttributesName", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" } ], "repeated": 0, "id": 5214 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff577b4086", "parentcaller": "0x7fff577b27b6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001838" } ], "repeated": 0, "id": 5215 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff577b40c3", "parentcaller": "0x7fff577b27b6", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "ValueName", "value": "PackageStatus" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\PackageStatus" } ], "repeated": 0, "id": 5216 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff577b40d4", "parentcaller": "0x7fff577b27b6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" } ], "repeated": 0, "id": 5217 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "4696", "caller": "0x7ff79bc69b4c", "parentcaller": "0x7ff79bc69f41", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xc0\\xec\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xf7\\x7f\\x00\\x00\\x88\\x84\\xfc\\x9b\\xf7\\x7f\\x00\\x00\\x88\\x84\\xfc\\x9b\\xf7\\x7f\\x00\\x00\\xf4\\x1a\\x00\\x00\\x00\\x00\\x00\\x00\\xb9E[\\x1a\\xff\\x7f\\x00\\x00\\x10\\xed\\\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5218 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "4696", "caller": "0x7ff79bc69b4c", "parentcaller": "0x7ff79bc69f41", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001af4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 5219 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "4696", "caller": "0x7ff79bc69b4c", "parentcaller": "0x7ff79bc69f41", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001af4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5220 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "4696", "caller": "0x7ff79bc69b4c", "parentcaller": "0x7ff79bc69f41", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000255c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00001af4" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" } ], "repeated": 0, "id": 5221 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6156", "caller": "0x7ff79bcaadd7", "parentcaller": "0x00000000", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00010094" }, { "name": "Message", "value": "0x000005bb" } ], "repeated": 0, "id": 5222 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "4696", "caller": "0x7ff79bc69b4c", "parentcaller": "0x7ff79bc69f41", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000255c" }, { "name": "ValueName", "value": "SystemUsesLightTheme" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\\SystemUsesLightTheme" } ], "repeated": 0, "id": 5223 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "4696", "caller": "0x7ff79bc69b4c", "parentcaller": "0x7ff79bc69f41", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000255c" } ], "repeated": 0, "id": 5224 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4cbd12d2", "parentcaller": "0x7fff465d5c64", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache" }, { "name": "Handle", "value": "0x00001ae0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache" } ], "repeated": 0, "id": 5225 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "4696", "caller": "0x7ff79bc69bb6", "parentcaller": "0x7ff79bc69f41", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 5226 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4cbd1a81", "parentcaller": "0x7fff4cbd138a", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00001ae0" }, { "name": "SubKey", "value": "Metadata" }, { "name": "Handle", "value": "0x00001ae4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Metadata" } ], "repeated": 0, "id": 5227 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "4696", "caller": "0x7ff79bc69bb6", "parentcaller": "0x7ff79bc69f41", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5228 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff465c2594", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 5229 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff465c260f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xa0V\\xc3\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x14\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00" } ], "repeated": 0, "id": 5230 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "4696", "caller": "0x7ff79bc69bb6", "parentcaller": "0x7ff79bc69f41", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001af4" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" } ], "repeated": 0, "id": 5231 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff465d5d02", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00001ae0" }, { "name": "SubKey", "value": "User\\Index\\UserSid\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "Handle", "value": "0x000022e0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\User\\Index\\UserSid\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 5232 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "4696", "caller": "0x7ff79bc69bb6", "parentcaller": "0x7ff79bc69f41", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af4" }, { "name": "ValueName", "value": "EnableTransparency" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\\EnableTransparency" } ], "repeated": 0, "id": 5233 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4cbd1732", "parentcaller": "0x7fff466023a5", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e0" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "3" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\User\\Index\\UserSid\\S-1-5-21-3968686040-3210279463-847977608-1001\\3" } ], "repeated": 0, "id": 5234 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6160", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff466023f4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e0" } ], "repeated": 0, "id": 5235 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "4696", "caller": "0x7ff79bc69bb6", "parentcaller": "0x7ff79bc69f41", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af4" } ], "repeated": 0, "id": 5236 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "6164", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 5237 }, { "timestamp": "2026-05-29 01:05:21,727", "thread_id": "4620", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 5238 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "4500", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 5239 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "4696", "caller": "0x7ff79bc69ac0", "parentcaller": "0x7ff79bc69c05", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 5240 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "6160", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff465d5d02", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00001ae0" }, { "name": "SubKey", "value": "ApplicationUser\\Index\\UserAndApplicationUserModelId\\3^MicrosoftWindows.Client.CBS_cw5n1h2txyewy!InputApp" }, { "name": "Handle", "value": "0x00001ac8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\ApplicationUser\\Index\\UserAndApplicationUserModelId\\3^MicrosoftWindows.Client.CBS_cw5n1h2txyewy!InputApp" } ], "repeated": 0, "id": 5241 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "4696", "caller": "0x7ff79bc69b1e", "parentcaller": "0x7ff79bc69c05", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 5242 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "4500", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 5243 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "6160", "caller": "0x7fff4cbd1732", "parentcaller": "0x7fff46602f16", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ac8" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "c3" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\ApplicationUser\\Index\\UserAndApplicationUserModelId\\3^MicrosoftWindows.Client.CBS_cw5n1h2txyewy!InputApp\\c3" } ], "repeated": 0, "id": 5244 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "4696", "caller": "0x7ff79bc69b1e", "parentcaller": "0x7ff79bc69c05", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5245 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "6160", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff46602f7b", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ac8" } ], "repeated": 0, "id": 5246 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "4696", "caller": "0x7ff79bc69b1e", "parentcaller": "0x7ff79bc69c05", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001af4" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" } ], "repeated": 0, "id": 5247 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "6160", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff465d5d02", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00001ae0" }, { "name": "SubKey", "value": "ApplicationUser\\Data\\c3" }, { "name": "Handle", "value": "0x00001ac8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\ApplicationUser\\Data\\c3" } ], "repeated": 0, "id": 5248 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "6160", "caller": "0x7fff4cbd16ad", "parentcaller": "0x7fff46602c7c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ac8" }, { "name": "ValueName", "value": "Application" }, { "name": "Data", "value": "41" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\ApplicationUser\\Data\\c3\\Application" } ], "repeated": 0, "id": 5249 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "4696", "caller": "0x7ff79bc69b1e", "parentcaller": "0x7ff79bc69c05", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af4" }, { "name": "ValueName", "value": "ColorPrevalence" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\\ColorPrevalence" } ], "repeated": 0, "id": 5250 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "6160", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff46602cff", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ac8" } ], "repeated": 0, "id": 5251 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "4696", "caller": "0x7ff79bc69b1e", "parentcaller": "0x7ff79bc69c05", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af4" } ], "repeated": 0, "id": 5252 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "4696", "caller": "0x7ff79bc69b4c", "parentcaller": "0x7ff79bc69c05", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xec\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xf7\\x7f\\x00\\x00\\x88\\x84\\xfc\\x9b\\xf7\\x7f\\x00\\x00\\x88\\x84\\xfc\\x9b\\xf7\\x7f\\x00\\x00\\xf4\\x1a\\x00\\x00\\x00\\x00\\x00\\x00\\xb9E[\\x1a\\xff\\x7f\\x00\\x00\\xd0\\xec\\\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5253 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "6160", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff465d5d02", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00001ae0" }, { "name": "SubKey", "value": "Application\\Data\\29" }, { "name": "Handle", "value": "0x00001ac8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Application\\Data\\29" } ], "repeated": 0, "id": 5254 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "4696", "caller": "0x7ff79bc69b4c", "parentcaller": "0x7ff79bc69c05", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001af4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5255 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "4500", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 5256 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "6160", "caller": "0x7fff4cbd16ad", "parentcaller": "0x7fff46602599", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ac8" }, { "name": "ValueName", "value": "Package" }, { "name": "Data", "value": "34" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Application\\Data\\29\\Package" } ], "repeated": 0, "id": 5257 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "4696", "caller": "0x7ff79bc69b4c", "parentcaller": "0x7ff79bc69c05", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000255c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00001af4" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" } ], "repeated": 0, "id": 5258 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "6160", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577ae9b0", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00001ac8" }, { "name": "SubKey", "value": "PackageExternalLocation\\Index\\UserAndPackage\\3^22" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\PackageExternalLocation\\Index\\UserAndPackage\\3^22" } ], "repeated": 0, "id": 5259 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "6160", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577ae9b0", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00001ac8" }, { "name": "SubKey", "value": "PackageExternalLocation\\Index\\UserAndPackage\\0^22" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\PackageExternalLocation\\Index\\UserAndPackage\\0^22" } ], "repeated": 0, "id": 5260 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "4696", "caller": "0x7ff79bc1f163", "parentcaller": "0x7ff79bca3b95", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 5261 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "6160", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577af308", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00001ac8" }, { "name": "SubKey", "value": "Package\\Data\\22" }, { "name": "Handle", "value": "0x00001af4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\22" } ], "repeated": 0, "id": 5262 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "6160", "caller": "0x7fff4cbd15ac", "parentcaller": "0x7fff4cbd14ff", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af4" }, { "name": "ValueName", "value": "InstalledLocation" }, { "name": "Data", "value": "C:\\Windows\\SystemApps\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\22\\InstalledLocation" } ], "repeated": 0, "id": 5263 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "4696", "caller": "0x7ff79bca5b09", "parentcaller": "0x7ff79bca5ab0", "category": "synchronization", "api": "NtOpenEvent", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "Handle", "value": "0x035cf3d0" }, { "name": "EventName", "value": "{A1965210-3A9D-4bca-822B-433645B3F5A2}" } ], "repeated": 0, "id": 5264 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "6160", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577aed38", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af4" } ], "repeated": 0, "id": 5265 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "6160", "caller": "0x7fff4cbd17f2", "parentcaller": "0x7fff577ae12f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ac4" } ], "repeated": 0, "id": 5266 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "4696", "caller": "0x7ff79bc21348", "parentcaller": "0x7ff79bca8e5f", "category": "misc", "api": "GetCursorPos", "status": true, "return": "0x00000001", "arguments": [ { "name": "x", "value": "24" }, { "name": "y", "value": "1064" } ], "repeated": 0, "id": 5267 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "6160", "caller": "0x7fff4cbd180b", "parentcaller": "0x7fff577ae12f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ac8" } ], "repeated": 0, "id": 5268 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "6160", "caller": "0x7fff4cbd12d2", "parentcaller": "0x7fff577adf5c", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache" }, { "name": "Handle", "value": "0x00001ac8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache" } ], "repeated": 0, "id": 5269 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "6160", "caller": "0x7fff4cbd1a81", "parentcaller": "0x7fff4cbd138a", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00001ac8" }, { "name": "SubKey", "value": "Metadata" }, { "name": "Handle", "value": "0x00001ac4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Metadata" } ], "repeated": 0, "id": 5270 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "6160", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577af579", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00001ac8" }, { "name": "SubKey", "value": "Package\\Index\\PackageFullName\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" }, { "name": "Handle", "value": "0x00001af4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Index\\PackageFullName\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" } ], "repeated": 0, "id": 5271 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "4696", "caller": "0x7ff79bc6b631", "parentcaller": "0x7ff79bc6b527", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "TaskbarMonitor" }, { "name": "Atom", "value": "0x0000c045" } ], "repeated": 0, "id": 5272 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "6160", "caller": "0x7fff4cbd1732", "parentcaller": "0x7fff577af7dc", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af4" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "22" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Index\\PackageFullName\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\22" } ], "repeated": 0, "id": 5273 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "6160", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af4" } ], "repeated": 0, "id": 5274 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc69953", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 5275 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "6160", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff57815e2d", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 5276 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "6160", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff57815e8b", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xe0W\\xc3\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\\\x00U\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00" } ], "repeated": 0, "id": 5277 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "6160", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577aebe9", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00001ac8" }, { "name": "SubKey", "value": "User\\Index\\UserSid\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "Handle", "value": "0x00001af4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\User\\Index\\UserSid\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 5278 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "6160", "caller": "0x7fff4cbd1732", "parentcaller": "0x7fff577af7dc", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af4" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "3" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\User\\Index\\UserSid\\S-1-5-21-3968686040-3210279463-847977608-1001\\3" } ], "repeated": 0, "id": 5279 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "6160", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577aec6d", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af4" } ], "repeated": 0, "id": 5280 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "6160", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577ae9b0", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00001ac8" }, { "name": "SubKey", "value": "PackageExternalLocation\\Index\\UserAndPackage\\3^22" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\PackageExternalLocation\\Index\\UserAndPackage\\3^22" } ], "repeated": 0, "id": 5281 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "6160", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577ae9b0", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00001ac8" }, { "name": "SubKey", "value": "PackageExternalLocation\\Index\\UserAndPackage\\0^22" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\PackageExternalLocation\\Index\\UserAndPackage\\0^22" } ], "repeated": 0, "id": 5282 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "6160", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577af308", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00001ac8" }, { "name": "SubKey", "value": "Package\\Data\\22" }, { "name": "Handle", "value": "0x00001af4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\22" } ], "repeated": 0, "id": 5283 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "6160", "caller": "0x7fff4cbd15ac", "parentcaller": "0x7fff4cbd14ff", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af4" }, { "name": "ValueName", "value": "InstalledLocation" }, { "name": "Data", "value": "C:\\Windows\\SystemApps\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\22\\InstalledLocation" } ], "repeated": 0, "id": 5284 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "6160", "caller": "0x7fff4cbd15ac", "parentcaller": "0x7fff4cbd14ff", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af4" }, { "name": "ValueName", "value": "MutableLink" }, { "name": "Data", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\22\\MutableLink" } ], "repeated": 0, "id": 5285 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "6160", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577aed38", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af4" } ], "repeated": 0, "id": 5286 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "6160", "caller": "0x7fff4cbd17f2", "parentcaller": "0x7fff577ae12f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ac4" } ], "repeated": 0, "id": 5287 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "6160", "caller": "0x7fff4cbd180b", "parentcaller": "0x7fff577ae12f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ac8" } ], "repeated": 0, "id": 5288 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "6160", "caller": "0x7fff4cbd17f2", "parentcaller": "0x7fff4661b532", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ae4" } ], "repeated": 0, "id": 5289 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "6160", "caller": "0x7fff4cbd180b", "parentcaller": "0x7fff4661b532", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ae0" } ], "repeated": 0, "id": 5290 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 5291 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc686b4", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 5292 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "6160", "caller": "0x7fff5855dd9d", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ae0" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000430" }, { "name": "ObjectAttributesName", "value": "Windows.Foundation.Collections.PropertySet" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet" } ], "repeated": 0, "id": 5293 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "6160", "caller": "0x7fff5855ddf7", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ae0" }, { "name": "KeyInformation", "value": "\\xff97\\xfffc\\xffe7\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00T\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00F\\x00o\\x00u\\x00n\\x00d\\x00a\\x00t\\x00i\\x00o\\x00n\\x00.\\x00C\\x00o\\x00l\\x00l\\x00e\\x00c\\x00t\\x00i\\x00o\\x00n\\x00s\\x00.\\x00P\\x00r\\x00o\\x00p\\x00e\\x00r\\x00t\\x00y\\x00S\\x00e\\x00t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\xffa6\\xffb6\\x08\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x15\\x01\\x00\\x00\\x00\\x00\\x19\\xffddi\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x15%\\x01\\x00\\x00\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\xffc4\\x02%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffc0\\x0c%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0EzX\\xffff\\x7f\\x00\\x00\\xffc8'\\xffc5\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff0\\xffddi\r\\x00\\x00\\x00\\x00\\xff87\\xff9dNX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00 `\\xffc5\\x0b\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffa0'\\xffc5\\x0b\\x00\\x00\\x00\\x00 `\\xffc5\\x0b\\x00\\x00\\x00\\x00\\xff90U\\xffc3\\x0b\\x00\\x00\\x00\\x00\\xffc7\\xffb3\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\xfff6sNX\\xffff\\x7f\\x00\\x00 Y\\xffc5\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xff90U\\xffc3\\x0b\\x00\\x00\\x00\\x00 \\~\\x03\\x00\\x00\\x00\\x00 \\~\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00 `\\xffc5\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x006\\xff8cYX\\xffff\\x7f\\x00\\x00\\xff90\\xffc3\\xffda\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffe0\\xffdei\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffe0\\xffdei\r\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 5294 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002454" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 5295 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "6160", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ae0" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivationType" } ], "repeated": 0, "id": 5296 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "4696", "caller": "0x7ff79bc8a418", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002454" } ], "repeated": 0, "id": 5297 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "6160", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff585700bb", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ae0" }, { "name": "ValueName", "value": "DllPath" }, { "name": "Data", "value": "C:\\Windows\\System32\\WinTypes.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\DllPath" } ], "repeated": 0, "id": 5298 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "6160", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ae0" }, { "name": "ValueName", "value": "Threading" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\Threading" } ], "repeated": 0, "id": 5299 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "6160", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ae0" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\TrustLevel" } ], "repeated": 0, "id": 5300 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "6160", "caller": "0x7fff584bc0fc", "parentcaller": "0x7fff58554170", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00001ae0" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\CustomAttributes" } ], "repeated": 0, "id": 5301 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "6160", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001ae0" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\RemoteServer" } ], "repeated": 0, "id": 5302 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "6160", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001ae0" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivateAsUser" } ], "repeated": 0, "id": 5303 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "6160", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001ae0" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivateInSharedBroker" } ], "repeated": 0, "id": 5304 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "6160", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001ae0" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 5305 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "6160", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58562222", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001ae0" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\Permissions" } ], "repeated": 0, "id": 5306 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "4620", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff517e2bd6", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000022e0" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "6136" }, { "name": "ProcessName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe" } ], "repeated": 0, "id": 5307 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "6160", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001ae0" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivateOnHostFlags" } ], "repeated": 0, "id": 5308 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "6160", "caller": "0x7fff577d43a6", "parentcaller": "0x7fff58557226", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ae0" } ], "repeated": 0, "id": 5309 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "6164", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 5310 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "4620", "caller": "0x7fff577d6785", "parentcaller": "0x7fff517e2cbb", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002454" } ], "repeated": 0, "id": 5311 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "4620", "caller": "0x7fff577d6785", "parentcaller": "0x7fff517e2cd5", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e0" } ], "repeated": 0, "id": 5312 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "4620", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff517e29b1", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000022e0" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "6136" }, { "name": "ProcessName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe" } ], "repeated": 0, "id": 5313 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "4620", "caller": "0x7fff5781026b", "parentcaller": "0x7fff517e29fb", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000022e0" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00001aa8" } ], "repeated": 0, "id": 5314 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "4620", "caller": "0x7fff59f9413e", "parentcaller": "0x7fff517e2a39", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 5315 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "4620", "caller": "0x7fff59f9416d", "parentcaller": "0x7fff517e2a39", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "31" }, { "name": "TokenInformation", "value": "\\xd8\\xf3 \\x03\\x00\\x00\\x00\\x00\\x01\\x08\\x00\\x00\\x00\\x00\\x00\\x0f\\x02\\x00\\x00\\x00<\\xe6\\xf3\\x1f\\x8a.\\x82*u\\xa8\\x8a?\\x1b(\\xed\\xbf9\\x8fA\\x14\\x0c\\xfc9u]5\n`\\xe0\"\\x00\\x00\\x00\\x00\\x00\\x00\\xc2Tc\\x1a\\xff\\x7f\\x00\\x00\\xe0\"\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5316 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "4620", "caller": "0x7fff59f941a8", "parentcaller": "0x7fff517e2a39", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "42" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5317 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "4620", "caller": "0x7fff59f941df", "parentcaller": "0x7fff517e2a39", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "12" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 5318 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "4620", "caller": "0x7fff59f94256", "parentcaller": "0x7fff517e2a39", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "44" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x1c*y^t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xc8\\xf9 \\x03\\x00\\x00\\x00\\x00\\xf8\\x17\\x00\\x00\\x00\\x00\\x00\\x000a\\x88\\x10\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5319 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "4620", "caller": "0x7fff577d6785", "parentcaller": "0x7fff517e2a5b", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001aa8" } ], "repeated": 0, "id": 5320 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "4620", "caller": "0x7fff577d6785", "parentcaller": "0x7fff517e2a75", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e0" } ], "repeated": 0, "id": 5321 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "4620", "caller": "0x7fff577cf588", "parentcaller": "0x7fff517ead8b", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000022e0" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "Global\\Session\\1\\AppContainerNamedObjects\\S-1-15-2-536077884-713174666-1066051701-3219990555-339840825-1966734348-1611281757\\17f8HWNDInterface:1019e" } ], "repeated": 0, "id": 5322 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "4620", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c232", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000022e0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0b2d0000" }, { "name": "SectionOffset", "value": "0x0320f950" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 5323 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "4620", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff517eae5e", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0b2d0000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 5324 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "4620", "caller": "0x7fff577d6785", "parentcaller": "0x7fff517eae6d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e0" } ], "repeated": 0, "id": 5325 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "6164", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 5326 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "4620", "caller": "0x7fff4cbd12d2", "parentcaller": "0x7fff577adc16", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache" }, { "name": "Handle", "value": "0x00001ae0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache" } ], "repeated": 0, "id": 5327 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "4620", "caller": "0x7fff4cbd1a81", "parentcaller": "0x7fff4cbd138a", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00001ae0" }, { "name": "SubKey", "value": "Metadata" }, { "name": "Handle", "value": "0x00001ae4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Metadata" } ], "repeated": 0, "id": 5328 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577af579", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00001ae0" }, { "name": "SubKey", "value": "Package\\Index\\PackageFullName\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy" }, { "name": "Handle", "value": "0x00001ac8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Index\\PackageFullName\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy" } ], "repeated": 0, "id": 5329 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "4620", "caller": "0x7fff4cbd1732", "parentcaller": "0x7fff577af7dc", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ac8" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "1a" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Index\\PackageFullName\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\\1a" } ], "repeated": 0, "id": 5330 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "4620", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577af5fd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ac8" } ], "repeated": 0, "id": 5331 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577af308", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00001ae0" }, { "name": "SubKey", "value": "Package\\Data\\1a" }, { "name": "Handle", "value": "0x00001ac8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\1a" } ], "repeated": 0, "id": 5332 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "4620", "caller": "0x7fff4cbd16ad", "parentcaller": "0x7fff5781d320", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ac8" }, { "name": "ValueName", "value": "PackageOrigin" }, { "name": "Data", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\1a\\PackageOrigin" } ], "repeated": 0, "id": 5333 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "4620", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577aed38", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ac8" } ], "repeated": 0, "id": 5334 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "4620", "caller": "0x7fff4cbd17f2", "parentcaller": "0x7fff577adcce", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ae4" } ], "repeated": 0, "id": 5335 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "4620", "caller": "0x7fff4cbd180b", "parentcaller": "0x7fff577adcce", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ae0" } ], "repeated": 0, "id": 5336 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "4620", "caller": "0x7fff59f93f7a", "parentcaller": "0x7fff59770ed7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5337 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "4620", "caller": "0x7fff59770cd1", "parentcaller": "0x7fff597a1530", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00001ae0" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 5338 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "4620", "caller": "0x7fff5781026b", "parentcaller": "0x7fff59770daf", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002438" } ], "repeated": 0, "id": 5339 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "4620", "caller": "0x7fff59f88cde", "parentcaller": "0x7fff59fc9c4e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": " \\xf1\\x02\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5340 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "4620", "caller": "0x7fff59fb6e46", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\xf8n\\xe5\\x08\\x00\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x04]\\x88\\x8a\\xeb\\x1c\\xc9\\x11\\x9f\\xe8\\x08\\x00+\\x10H`\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00;\\x00\\x00\\x00" } ], "repeated": 0, "id": 5341 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "4620", "caller": "0x7fff59fb6e9b", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "`c\\xe5\\x08\\x00\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x03\\x00\\x00\\x08\\x03\\x00\\x00sday`\\xdf\\x9e\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00p\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5342 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "4620", "caller": "0x7fff59fb6ec0", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 5343 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "4620", "caller": "0x7fff59fb6f0e", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "H\\x00}\\x0c\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 5344 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "6164", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 5345 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "4620", "caller": "0x7fff59fb6e46", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "Xf\\xe5\\x08\\x00\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x04]\\x88\\x8a\\xeb\\x1c\\xc9\\x11\\x9f\\xe8\\x08\\x00+\\x10H`\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00;\\x00\\x00\\x00" } ], "repeated": 0, "id": 5346 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "4620", "caller": "0x7fff59fb6e9b", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\x00i\\xe5\\x08\\x00\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\xf9\\xfd\\x15\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x04\\x00\\x00\\x00\\xf0\\xa6\\xbc\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x08\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x18\\x00\\x008\\x18\\x00\\x00" } ], "repeated": 0, "id": 5347 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "4620", "caller": "0x7fff59fb6ec0", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 5348 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "4620", "caller": "0x7fff59fb6f0e", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\x18\\xfd|\\x0c\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 5349 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "4620", "caller": "0x7fff59fb6f37", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 5350 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "6164", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 5351 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "4620", "caller": "0x7fff59fb6f8f", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xb8i\\xe5\\x08\\x00\\x00\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 5352 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "4620", "caller": "0x7fff59fb7048", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x81\\x1a\\xff\\x7f\\x00\\x00\\xebPY\\x1a\\xff\\x7f\\x00\\x00h=*y^t\\x00\\x00(N}\\x1a\\xff\\x7f\\x00\\x000\\xd9 \\x03\\x00\\x00\\x00\\x00(\\xd9 \\x03\\x00\\x00\\x00\\x00\\xf8\\xd8 \\x03\\x00\\x00\\x00\\x00\\x18\\xd9 \\x03" } ], "repeated": 0, "id": 5353 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "4620", "caller": "0x7fff59fb707b", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0i\\xe5\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8Z\\x1a\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x18\\xd7 \\x03\\x00\\x00\\x00\\x008$\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00$\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2}\\x1a" } ], "repeated": 0, "id": 5354 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "4620", "caller": "0x7fff577d6785", "parentcaller": "0x7fff59770e27", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ae0" } ], "repeated": 0, "id": 5355 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "4620", "caller": "0x7fff577d6785", "parentcaller": "0x7fff59770e49", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 5356 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "4620", "caller": "0x7fff597a1630", "parentcaller": "0x7fff597a12cd", "category": "system", "api": "NtQuerySystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 5357 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "6164", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 5358 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "6164", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x18\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6164" } ], "repeated": 0, "id": 5359 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "6164", "caller": "0x7fff577ce76a", "parentcaller": "0x7fff584cea0e", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "oleaut32.dll" }, { "name": "ModuleHandle", "value": "0x7fff58860000" } ], "repeated": 0, "id": 5360 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "6164", "caller": "0x7fff5809b283", "parentcaller": "0x7fff58088b47", "category": "windows", "api": "PostThreadMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessId", "value": "4484" }, { "name": "ThreadId", "value": "4488" }, { "name": "Message", "value": "0" } ], "repeated": 1, "id": 5361 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "6164", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5809da8f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024dc" } ], "repeated": 0, "id": 5362 }, { "timestamp": "2026-05-29 01:05:21,743", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 5363 }, { "timestamp": "2026-05-29 01:05:21,758", "thread_id": "6164", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff584fb0ca", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 5364 }, { "timestamp": "2026-05-29 01:05:21,758", "thread_id": "6164", "caller": "0x7fff58519794", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "F1C46D71-B791-4110-8D5C-7108F22C1010" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 5365 }, { "timestamp": "2026-05-29 01:05:21,758", "thread_id": "6164", "caller": "0x7fff585192b9", "parentcaller": "0x7fff584e8db3", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 5366 }, { "timestamp": "2026-05-29 01:05:21,758", "thread_id": "6164", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x18\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6164" } ], "repeated": 0, "id": 5367 }, { "timestamp": "2026-05-29 01:05:21,758", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 5368 }, { "timestamp": "2026-05-29 01:05:21,758", "thread_id": "6164", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x18\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6164" } ], "repeated": 0, "id": 5369 }, { "timestamp": "2026-05-29 01:05:21,758", "thread_id": "4500", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xfe\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x94\\x11\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4500" } ], "repeated": 0, "id": 5370 }, { "timestamp": "2026-05-29 01:05:21,758", "thread_id": "4500", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xfe\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x94\\x11\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4500" } ], "repeated": 0, "id": 5371 }, { "timestamp": "2026-05-29 01:05:21,758", "thread_id": "4620", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 5372 }, { "timestamp": "2026-05-29 01:05:21,758", "thread_id": "4620", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000360" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 5373 }, { "timestamp": "2026-05-29 01:05:21,758", "thread_id": "6164", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 5374 }, { "timestamp": "2026-05-29 01:05:21,758", "thread_id": "6164", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000360" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 5375 }, { "timestamp": "2026-05-29 01:05:21,758", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 5376 }, { "timestamp": "2026-05-29 01:05:21,758", "thread_id": "6164", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff584fb0ca", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5377 }, { "timestamp": "2026-05-29 01:05:21,758", "thread_id": "6164", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 5378 }, { "timestamp": "2026-05-29 01:05:21,758", "thread_id": "6164", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000360" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 5379 }, { "timestamp": "2026-05-29 01:05:21,758", "thread_id": "6164", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff584fb0ca", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5380 }, { "timestamp": "2026-05-29 01:05:21,774", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 5381 }, { "timestamp": "2026-05-29 01:05:21,774", "thread_id": "4620", "caller": "0x7fff428ef240", "parentcaller": "0x7fff4260c46e", "category": "misc", "api": "GetSystemMetrics", "status": false, "return": "0x00000000", "arguments": [ { "name": "SystemMetricIndex", "value": "8192" } ], "repeated": 1, "id": 5382 }, { "timestamp": "2026-05-29 01:05:21,774", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 5383 }, { "timestamp": "2026-05-29 01:05:21,790", "thread_id": "4696", "caller": "0x7ff79bc1fa2e", "parentcaller": "0x7ff79bc7fc27", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000072" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 5384 }, { "timestamp": "2026-05-29 01:05:21,790", "thread_id": "4696", "caller": "0x7ff79bca5b09", "parentcaller": "0x7ff79bc1fa68", "category": "synchronization", "api": "NtOpenEvent", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "Handle", "value": "0x7ff79bc7fc22" }, { "name": "EventName", "value": "{A1965210-3A9D-4bca-822B-433645B3F5A2}" } ], "repeated": 0, "id": 5385 }, { "timestamp": "2026-05-29 01:05:21,790", "thread_id": "4696", "caller": "0x7ff79bc1faf5", "parentcaller": "0x7ff79bc1fa75", "category": "synchronization", "api": "NtOpenMutant", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "Handle", "value": "0x7ff79bc7fc22" }, { "name": "MutexName", "value": "Local\\__DDrawCheckExclMode__" } ], "repeated": 0, "id": 5386 }, { "timestamp": "2026-05-29 01:05:21,790", "thread_id": "4696", "caller": "0x7ff79bc19217", "parentcaller": "0x7ff79bc1fa94", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 5387 }, { "timestamp": "2026-05-29 01:05:21,790", "thread_id": "4696", "caller": "0x7ff79bc19217", "parentcaller": "0x7ff79bc1fa94", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5388 }, { "timestamp": "2026-05-29 01:05:21,790", "thread_id": "4696", "caller": "0x7ff79bc19217", "parentcaller": "0x7ff79bc1fa94", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000024dc" }, { "name": "DesiredAccess", "value": "0x00000101", "pretty_value": "KEY_QUERY_VALUE|KEY_WOW64_64KEY" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\RetailDemo\\OobeWrite" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\RetailDemo\\OobeWrite" } ], "repeated": 0, "id": 5389 }, { "timestamp": "2026-05-29 01:05:21,790", "thread_id": "4696", "caller": "0x7ff79bc19217", "parentcaller": "0x7ff79bc1fa94", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024dc" }, { "name": "ValueName", "value": "Enabled" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RetailDemo\\OobeWrite\\Enabled" } ], "repeated": 0, "id": 5390 }, { "timestamp": "2026-05-29 01:05:21,790", "thread_id": "4696", "caller": "0x7ff79bc19217", "parentcaller": "0x7ff79bc1fa94", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024dc" } ], "repeated": 0, "id": 5391 }, { "timestamp": "2026-05-29 01:05:21,790", "thread_id": "4696", "caller": "0x7ff79bc19232", "parentcaller": "0x7ff79bc1fa94", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 5392 }, { "timestamp": "2026-05-29 01:05:22,337", "thread_id": "6164", "caller": "0x7fff58520e98", "parentcaller": "0x7fff5859b785", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 5393 }, { "timestamp": "2026-05-29 01:05:22,337", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 5394 }, { "timestamp": "2026-05-29 01:05:22,337", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 5395 }, { "timestamp": "2026-05-29 01:05:22,337", "thread_id": "4620", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 1, "id": 5396 }, { "timestamp": "2026-05-29 01:05:22,337", "thread_id": "5000", "caller": "0x7fff4259fa9e", "parentcaller": "0x7fff425935ce", "category": "windows", "api": "FindWindowW", "status": true, "return": "0x00010094", "arguments": [ { "name": "ClassName", "value": "Shell_TrayWnd" }, { "name": "WindowName", "value": "" } ], "repeated": 0, "id": 5397 }, { "timestamp": "2026-05-29 01:05:22,337", "thread_id": "5000", "caller": "0x7fff57fc2eeb", "parentcaller": "0x7fff581ba00f", "category": "synchronization", "api": "NtFindAtom", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "AtomName", "value": "IsAutoHideEnabled" }, { "name": "Atom", "value": "0x00000000" } ], "repeated": 0, "id": 5398 }, { "timestamp": "2026-05-29 01:05:22,337", "thread_id": "5000", "caller": "0x7fff4259fa9e", "parentcaller": "0x7fff425936d8", "category": "windows", "api": "FindWindowW", "status": true, "return": "0x00010094", "arguments": [ { "name": "ClassName", "value": "Shell_TrayWnd" }, { "name": "WindowName", "value": "" } ], "repeated": 0, "id": 5399 }, { "timestamp": "2026-05-29 01:05:22,337", "thread_id": "5000", "caller": "0x7fff57fc2eeb", "parentcaller": "0x7fff581ba00f", "category": "synchronization", "api": "NtFindAtom", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "AtomName", "value": "IsAutoHideEnabled" }, { "name": "Atom", "value": "0x00000000" } ], "repeated": 0, "id": 5400 }, { "timestamp": "2026-05-29 01:05:22,337", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 5401 }, { "timestamp": "2026-05-29 01:05:22,337", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58085ee4", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002048" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 5402 }, { "timestamp": "2026-05-29 01:05:22,337", "thread_id": "4500", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xfe\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x94\\x11\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4500" } ], "repeated": 1, "id": 5403 }, { "timestamp": "2026-05-29 01:05:22,337", "thread_id": "4344", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xfc\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\\x10\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4344" } ], "repeated": 0, "id": 5404 }, { "timestamp": "2026-05-29 01:05:22,337", "thread_id": "5000", "caller": "0x7fff57fc2eeb", "parentcaller": "0x7fff581d609e", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "CrossProcessParentHWND" }, { "name": "Atom", "value": "0x0000c07d" } ], "repeated": 0, "id": 5405 }, { "timestamp": "2026-05-29 01:05:22,337", "thread_id": "4500", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xfe\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x94\\x11\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4500" } ], "repeated": 0, "id": 5406 }, { "timestamp": "2026-05-29 01:05:22,337", "thread_id": "6164", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5407 }, { "timestamp": "2026-05-29 01:05:22,337", "thread_id": "5000", "caller": "0x7fff57fc2eeb", "parentcaller": "0x7fff581d609e", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "NonComponentUIWindow" }, { "name": "Atom", "value": "0x0000c071" } ], "repeated": 0, "id": 5408 }, { "timestamp": "2026-05-29 01:05:22,337", "thread_id": "5000", "caller": "0x7fff57fc2a0e", "parentcaller": "0x7fff581d409e", "category": "synchronization", "api": "NtAddAtomEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "UIA_WindowPatternEnabled" }, { "name": "Atom", "value": "0x0000c057" } ], "repeated": 0, "id": 5409 }, { "timestamp": "2026-05-29 01:05:22,337", "thread_id": "4344", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xfc\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\\x10\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4344" } ], "repeated": 0, "id": 5410 }, { "timestamp": "2026-05-29 01:05:22,337", "thread_id": "5000", "caller": "0x7fff57fc2eeb", "parentcaller": "0x7fff581d609e", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "CrossProcessChildHWND" }, { "name": "Atom", "value": "0x0000c066" } ], "repeated": 0, "id": 5411 }, { "timestamp": "2026-05-29 01:05:22,337", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 5412 }, { "timestamp": "2026-05-29 01:05:22,337", "thread_id": "4500", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xfe\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x94\\x11\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4500" } ], "repeated": 0, "id": 5413 }, { "timestamp": "2026-05-29 01:05:22,337", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 5414 }, { "timestamp": "2026-05-29 01:05:22,337", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58085ee4", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002048" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 5415 }, { "timestamp": "2026-05-29 01:05:22,337", "thread_id": "4504", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xfe\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x98\\x11\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4504" } ], "repeated": 0, "id": 5416 }, { "timestamp": "2026-05-29 01:05:22,337", "thread_id": "4344", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xfc\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\\x10\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4344" } ], "repeated": 0, "id": 5417 }, { "timestamp": "2026-05-29 01:05:22,337", "thread_id": "10916", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xa4*\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "10916" } ], "repeated": 0, "id": 5418 }, { "timestamp": "2026-05-29 01:05:22,337", "thread_id": "6152", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff557c3a98", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x18\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6152" } ], "repeated": 0, "id": 5419 }, { "timestamp": "2026-05-29 01:05:22,337", "thread_id": "4504", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 1, "id": 5420 }, { "timestamp": "2026-05-29 01:05:22,337", "thread_id": "4500", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff517e2bd6", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000022e0" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "6136" }, { "name": "ProcessName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe" } ], "repeated": 0, "id": 5421 }, { "timestamp": "2026-05-29 01:05:22,337", "thread_id": "4500", "caller": "0x7fff5781026b", "parentcaller": "0x7fff517e2c2a", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000022e0" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00001ae4" } ], "repeated": 0, "id": 5422 }, { "timestamp": "2026-05-29 01:05:22,337", "thread_id": "4500", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff517e2c87", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 5423 }, { "timestamp": "2026-05-29 01:05:22,337", "thread_id": "4500", "caller": "0x7fff577d6785", "parentcaller": "0x7fff517e2cbb", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ae4" } ], "repeated": 0, "id": 5424 }, { "timestamp": "2026-05-29 01:05:22,337", "thread_id": "4500", "caller": "0x7fff577d6785", "parentcaller": "0x7fff517e2cd5", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e0" } ], "repeated": 0, "id": 5425 }, { "timestamp": "2026-05-29 01:05:22,337", "thread_id": "4500", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff517e29b1", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000022e0" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "6136" }, { "name": "ProcessName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe" } ], "repeated": 0, "id": 5426 }, { "timestamp": "2026-05-29 01:05:22,337", "thread_id": "4500", "caller": "0x7fff5781026b", "parentcaller": "0x7fff517e29fb", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000022e0" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00001ae4" } ], "repeated": 0, "id": 5427 }, { "timestamp": "2026-05-29 01:05:22,337", "thread_id": "4344", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xfc\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\\x10\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4344" } ], "repeated": 0, "id": 5428 }, { "timestamp": "2026-05-29 01:05:22,337", "thread_id": "5000", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 5429 }, { "timestamp": "2026-05-29 01:05:22,337", "thread_id": "4500", "caller": "0x7fff59f9416d", "parentcaller": "0x7fff517e2a39", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "31" }, { "name": "TokenInformation", "value": "\\x88\\xed\\xff\\x0b\\x00\\x00\\x00\\x00\\x01\\x08\\x00\\x00\\x00\\x00\\x00\\x0f\\x02\\x00\\x00\\x00<\\xe6\\xf3\\x1f\\x8a.\\x82*u\\xa8\\x8a?\\x1b(\\xed\\xbf9\\x8fA\\x14\\x0c\\xfc9u]5\n`\\xe0\"\\x00\\x00\\x00\\x00\\x00\\x00\\xc2Tc\\x1a\\xff\\x7f\\x00\\x00\\xe0\"\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5430 }, { "timestamp": "2026-05-29 01:05:22,337", "thread_id": "4500", "caller": "0x7fff59f941a8", "parentcaller": "0x7fff517e2a39", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "42" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5431 }, { "timestamp": "2026-05-29 01:05:22,337", "thread_id": "4500", "caller": "0x7fff59f94256", "parentcaller": "0x7fff517e2a39", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "44" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x98\\x06\\xf5q^t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00x\\xf3\\xff\\x0b\\x00\\x00\\x00\\x00\\xf8\\x17\\x00\\x00\\x00\\x00\\x00\\x000a\\x88\\x10\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5432 }, { "timestamp": "2026-05-29 01:05:22,337", "thread_id": "6148", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x18\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6148" } ], "repeated": 0, "id": 5433 }, { "timestamp": "2026-05-29 01:05:22,337", "thread_id": "4500", "caller": "0x7fff577d6785", "parentcaller": "0x7fff517e2a5b", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ae4" } ], "repeated": 0, "id": 5434 }, { "timestamp": "2026-05-29 01:05:22,337", "thread_id": "4500", "caller": "0x7fff577d6785", "parentcaller": "0x7fff517e2a75", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e0" } ], "repeated": 0, "id": 5435 }, { "timestamp": "2026-05-29 01:05:22,337", "thread_id": "6148", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x18\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6148" } ], "repeated": 0, "id": 5436 }, { "timestamp": "2026-05-29 01:05:22,337", "thread_id": "4500", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c232", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000022e0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0b2d0000" }, { "name": "SectionOffset", "value": "0x0bfff300" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 5437 }, { "timestamp": "2026-05-29 01:05:22,337", "thread_id": "4500", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff517eae5e", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0b2d0000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 5438 }, { "timestamp": "2026-05-29 01:05:22,337", "thread_id": "4500", "caller": "0x7fff577d6785", "parentcaller": "0x7fff517eae6d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e0" } ], "repeated": 0, "id": 5439 }, { "timestamp": "2026-05-29 01:05:22,337", "thread_id": "6152", "caller": "0x7fff58520e98", "parentcaller": "0x7fff5855be33", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 5440 }, { "timestamp": "2026-05-29 01:05:22,337", "thread_id": "6164", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x18\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6164" } ], "repeated": 0, "id": 5441 }, { "timestamp": "2026-05-29 01:05:22,337", "thread_id": "4344", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xfc\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\\x10\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4344" } ], "repeated": 0, "id": 5442 }, { "timestamp": "2026-05-29 01:05:22,337", "thread_id": "4344", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xfc\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\\x10\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4344" } ], "repeated": 0, "id": 5443 }, { "timestamp": "2026-05-29 01:05:22,337", "thread_id": "6164", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff584fb0ca", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5444 }, { "timestamp": "2026-05-29 01:05:22,337", "thread_id": "4500", "caller": "0x7fff4cbd12d2", "parentcaller": "0x7fff577adc16", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache" }, { "name": "Handle", "value": "0x00001ae0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache" } ], "repeated": 0, "id": 5445 }, { "timestamp": "2026-05-29 01:05:22,337", "thread_id": "4500", "caller": "0x7fff4cbd1a81", "parentcaller": "0x7fff4cbd138a", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00001ae0" }, { "name": "SubKey", "value": "Metadata" }, { "name": "Handle", "value": "0x0000256c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Metadata" } ], "repeated": 0, "id": 5446 }, { "timestamp": "2026-05-29 01:05:22,337", "thread_id": "4500", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577af579", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00001ae0" }, { "name": "SubKey", "value": "Package\\Index\\PackageFullName\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy" }, { "name": "Handle", "value": "0x00001af0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Index\\PackageFullName\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy" } ], "repeated": 0, "id": 5447 }, { "timestamp": "2026-05-29 01:05:22,337", "thread_id": "4500", "caller": "0x7fff4cbd1732", "parentcaller": "0x7fff577af7dc", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "1a" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Index\\PackageFullName\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\\1a" } ], "repeated": 0, "id": 5448 }, { "timestamp": "2026-05-29 01:05:22,337", "thread_id": "4500", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577af5fd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 5449 }, { "timestamp": "2026-05-29 01:05:22,337", "thread_id": "4500", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577af308", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00001ae0" }, { "name": "SubKey", "value": "Package\\Data\\1a" }, { "name": "Handle", "value": "0x00001af0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\1a" } ], "repeated": 0, "id": 5450 }, { "timestamp": "2026-05-29 01:05:22,337", "thread_id": "4500", "caller": "0x7fff4cbd16ad", "parentcaller": "0x7fff5781d320", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "ValueName", "value": "PackageOrigin" }, { "name": "Data", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\1a\\PackageOrigin" } ], "repeated": 0, "id": 5451 }, { "timestamp": "2026-05-29 01:05:22,337", "thread_id": "4500", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577aed38", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 5452 }, { "timestamp": "2026-05-29 01:05:22,337", "thread_id": "4500", "caller": "0x7fff4cbd17f2", "parentcaller": "0x7fff577adcce", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 5453 }, { "timestamp": "2026-05-29 01:05:22,337", "thread_id": "4500", "caller": "0x7fff4cbd180b", "parentcaller": "0x7fff577adcce", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ae0" } ], "repeated": 0, "id": 5454 }, { "timestamp": "2026-05-29 01:05:22,337", "thread_id": "4500", "caller": "0x7fff59f93f7a", "parentcaller": "0x7fff59770ed7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5455 }, { "timestamp": "2026-05-29 01:05:22,337", "thread_id": "4500", "caller": "0x7fff59770cd1", "parentcaller": "0x7fff597a1530", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00001ae0" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 5456 }, { "timestamp": "2026-05-29 01:05:22,337", "thread_id": "4500", "caller": "0x7fff5781026b", "parentcaller": "0x7fff59770daf", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000256c" } ], "repeated": 0, "id": 5457 }, { "timestamp": "2026-05-29 01:05:22,337", "thread_id": "4500", "caller": "0x7fff59f88cde", "parentcaller": "0x7fff59fc9c4e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": " \\xf1\\x02\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5458 }, { "timestamp": "2026-05-29 01:05:22,337", "thread_id": "4500", "caller": "0x7fff59fb6e46", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\xf8J\\xa9\\x0c\\x00\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\xb8\\x11nX\\xff\\x7f\\x00\\x00\\x90\\x11nX\\xff\\x7f\\x00\\x00X\\x11nX\\xff\\x7f\\x00\\x00`y\\x84\\x0c\\x00\\x00\\x00\\x00\\x90K\\x1a\\x01\\x00\\x00\\x00\\x00\\x00:Fr\\x88\\x13\\x00\\x00\\xdd~\\x1e\\xde" } ], "repeated": 0, "id": 5459 }, { "timestamp": "2026-05-29 01:05:22,337", "thread_id": "4500", "caller": "0x7fff59fb6e9b", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "@S\\xa9\\x0c\\x00\\x00\\x00\\x00`\\x00\\x00\\x007\\x007\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x009\\x005\\x001\\x00A\\x00-\\x000\\x00E\\x004\\x00E\\x00-\\x00E\\x009\\x008\\x00C\\x00E\\x00C\\x004\\x004\\x002\\x00E\\x00C\\x009\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5460 }, { "timestamp": "2026-05-29 01:05:22,337", "thread_id": "4500", "caller": "0x7fff59fb6ec0", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 5461 }, { "timestamp": "2026-05-29 01:05:22,337", "thread_id": "4500", "caller": "0x7fff59fb6f0e", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "H\\xda\\xd8\\x08\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 5462 }, { "timestamp": "2026-05-29 01:05:22,337", "thread_id": "4500", "caller": "0x7fff59fb6f37", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 5463 }, { "timestamp": "2026-05-29 01:05:22,337", "thread_id": "4500", "caller": "0x7fff59fb6f8f", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xf8G\\xa9\\x0c\\x00\\x00\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 5464 }, { "timestamp": "2026-05-29 01:05:22,337", "thread_id": "4500", "caller": "0x7fff59fb7048", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x81\\x1a\\xff\\x7f\\x00\\x00\\xebPY\\x1a\\xff\\x7f\\x00\\x00\\xd8#\\xf5q^t\\x00\\x00(N}\\x1a\\xff\\x7f\\x00\\x00\\x80\\xd6\\xff\\x0b\\x00\\x00\\x00\\x00x\\xd6\\xff\\x0b\\x00\\x00\\x00\\x00H\\xd6\\xff\\x0b\\x00\\x00\\x00\\x00h\\xd6\\xff\\x0b" } ], "repeated": 0, "id": 5465 }, { "timestamp": "2026-05-29 01:05:22,337", "thread_id": "4500", "caller": "0x7fff59fb707b", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0G\\xa9\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8Z\\x1a\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00h\\xd4\\xff\\x0b\\x00\\x00\\x00\\x00l%\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00$\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2}\\x1a" } ], "repeated": 0, "id": 5466 }, { "timestamp": "2026-05-29 01:05:22,337", "thread_id": "4500", "caller": "0x7fff59f88cde", "parentcaller": "0x7fff59f8953a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": " \\xf1\\x02\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5467 }, { "timestamp": "2026-05-29 01:05:22,337", "thread_id": "4500", "caller": "0x7fff59fb6e46", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "8D\\xa9\\x0c\\x00\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\"\\x00S\\x00h\\x00e\\x00l\\x00l\\x00A\\x00c\\x00t\\x00i\\x00v\\x00i\\x00t\\x00y\\x00M\\x00o\\x00n\\x00i\\x00t\\x00o\\x00r\\x00\"\\x00\\x00\\x00at" } ], "repeated": 0, "id": 5468 }, { "timestamp": "2026-05-29 01:05:22,337", "thread_id": "4500", "caller": "0x7fff59fb6e9b", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "@A\\xa9\\x0c\\x00\\x00\\x00\\x00`\\x00\\x00\\x00Mon:\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00uesday:Wed:Wednesday:Thu:Thursday:Fri:Friday:Sat:Saturda" } ], "repeated": 0, "id": 5469 }, { "timestamp": "2026-05-29 01:05:22,337", "thread_id": "4500", "caller": "0x7fff59fb6ec0", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 5470 }, { "timestamp": "2026-05-29 01:05:22,337", "thread_id": "4500", "caller": "0x7fff59fb6f0e", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "8\\xd8\\xd8\\x08\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 5471 }, { "timestamp": "2026-05-29 01:05:22,337", "thread_id": "4500", "caller": "0x7fff59fb6f37", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 5472 }, { "timestamp": "2026-05-29 01:05:22,337", "thread_id": "4500", "caller": "0x7fff59fb6f8f", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xd8R\\xa9\\x0c\\x00\\x00\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 5473 }, { "timestamp": "2026-05-29 01:05:22,337", "thread_id": "4500", "caller": "0x7fff59fb7048", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x81\\x1a\\xff\\x7f\\x00\\x00\\xebPY\\x1a\\xff\\x7f\\x00\\x00\\xb8'\\xf5q^t\\x00\\x00(N}\\x1a\\xff\\x7f\\x00\\x00\\xe0\\xd2\\xff\\x0b\\x00\\x00\\x00\\x00\\xd8\\xd2\\xff\\x0b\\x00\\x00\\x00\\x00\\xa8\\xd2\\xff\\x0b\\x00\\x00\\x00\\x00\\xc8\\xd2\\xff\\x0b" } ], "repeated": 0, "id": 5474 }, { "timestamp": "2026-05-29 01:05:22,337", "thread_id": "4500", "caller": "0x7fff59fb707b", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0R\\xa9\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8Z\\x1a\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xc8\\xd0\\xff\\x0b\\x00\\x00\\x00\\x00l%\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00$\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2}\\x1a" } ], "repeated": 0, "id": 5475 }, { "timestamp": "2026-05-29 01:05:22,337", "thread_id": "4500", "caller": "0x7fff577d6785", "parentcaller": "0x7fff59770e27", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ae0" } ], "repeated": 0, "id": 5476 }, { "timestamp": "2026-05-29 01:05:22,337", "thread_id": "4500", "caller": "0x7fff577d6785", "parentcaller": "0x7fff59770e49", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 5477 }, { "timestamp": "2026-05-29 01:05:22,337", "thread_id": "4500", "caller": "0x7fff597a1630", "parentcaller": "0x7fff597a12cd", "category": "system", "api": "NtQuerySystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 5478 }, { "timestamp": "2026-05-29 01:05:22,337", "thread_id": "4500", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xfe\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x94\\x11\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4500" } ], "repeated": 0, "id": 5479 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 5480 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "4500", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xfe\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x94\\x11\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4500" } ], "repeated": 0, "id": 5481 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "4500", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff517e2bd6", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000256c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "6136" }, { "name": "ProcessName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe" } ], "repeated": 0, "id": 5482 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "4500", "caller": "0x7fff5781026b", "parentcaller": "0x7fff517e2c2a", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000256c" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00001ae0" } ], "repeated": 0, "id": 5483 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "4500", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff517e2c87", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 5484 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "4500", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ae0" } ], "repeated": 0, "id": 5485 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "4500", "caller": "0x7fff577d6785", "parentcaller": "0x7fff517e2cd5", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 5486 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "4500", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff517e29b1", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000256c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "6136" }, { "name": "ProcessName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe" } ], "repeated": 0, "id": 5487 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "4500", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000256c" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00001ae0" } ], "repeated": 0, "id": 5488 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "4500", "caller": "0x7fff59f9413e", "parentcaller": "0x7fff517e2a39", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 5489 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "4500", "caller": "0x7fff59f9416d", "parentcaller": "0x7fff517e2a39", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "31" }, { "name": "TokenInformation", "value": "\\x88\\xed\\xff\\x0b\\x00\\x00\\x00\\x00\\x01\\x08\\x00\\x00\\x00\\x00\\x00\\x0f\\x02\\x00\\x00\\x00<\\xe6\\xf3\\x1f\\x8a.\\x82*u\\xa8\\x8a?\\x1b(\\xed\\xbf9\\x8fA\\x14\\x0c\\xfc9u]5\n`l%\\x00\\x00\\x00\\x00\\x00\\x00\\xc2Tc\\x1a\\xff\\x7f\\x00\\x00l%\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5490 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "5000", "caller": "0x7fff584d7b74", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000034a" }, { "name": "SubKey", "value": "CLSID\\{C90250F3-4D7D-4991-9B69-A5C5BC1C2AE6}" }, { "name": "Handle", "value": "0x000024de" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{C90250F3-4D7D-4991-9B69-A5C5BC1C2AE6}" } ], "repeated": 0, "id": 5491 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "4500", "caller": "0x7fff577d6785", "parentcaller": "0x7fff517e2a5b", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ae0" } ], "repeated": 0, "id": 5492 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "5000", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000024de" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{C90250F3-4D7D-4991-9B69-A5C5BC1C2AE6}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5493 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "4500", "caller": "0x7fff577cf588", "parentcaller": "0x7fff517ead8b", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000256c" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "Global\\Session\\1\\AppContainerNamedObjects\\S-1-15-2-536077884-713174666-1066051701-3219990555-339840825-1966734348-1611281757\\17f8HWNDInterface:1019e" } ], "repeated": 0, "id": 5494 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "5000", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000024de" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5495 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "4500", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c232", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000256c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0b2d0000" }, { "name": "SectionOffset", "value": "0x0bfff300" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 5496 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "5000", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "p\\xbd\\x19\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\xde$\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xbe\\x19\\x08\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5497 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "5000", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{C90250F3-4D7D-4991-9B69-A5C5BC1C2AE6}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{C90250F3-4D7D-4991-9B69-A5C5BC1C2AE6}\\TreatAs" } ], "repeated": 0, "id": 5498 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "5000", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000024de" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5499 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "4500", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff517eae5e", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0b2d0000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 5500 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "4500", "caller": "0x7fff577d6785", "parentcaller": "0x7fff517eae6d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 5501 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "5000", "caller": "0x7fff585622e1", "parentcaller": "0x7fff584d7c1d", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000024de" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{C90250F3-4D7D-4991-9B69-A5C5BC1C2AE6}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5502 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d81f5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000024de" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{C90250F3-4D7D-4991-9B69-A5C5BC1C2AE6}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 5503 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024de" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{C90250F3-4D7D-4991-9B69-A5C5BC1C2AE6}\\(Default)" } ], "repeated": 0, "id": 5504 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "4500", "caller": "0x7fff4cbd12d2", "parentcaller": "0x7fff577adc16", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache" }, { "name": "Handle", "value": "0x00002454" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache" } ], "repeated": 0, "id": 5505 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024de" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "PSFactoryBuffer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{C90250F3-4D7D-4991-9B69-A5C5BC1C2AE6}\\(Default)" } ], "repeated": 0, "id": 5506 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "4500", "caller": "0x7fff4cbd1a81", "parentcaller": "0x7fff4cbd138a", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002454" }, { "name": "SubKey", "value": "Metadata" }, { "name": "Handle", "value": "0x00001aa8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Metadata" } ], "repeated": 0, "id": 5507 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "5000", "caller": "0x7fff584d8485", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000024de" }, { "name": "SubKey", "value": "InprocServer32" }, { "name": "Handle", "value": "0x00002292" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{C90250F3-4D7D-4991-9B69-A5C5BC1C2AE6}\\InprocServer32" } ], "repeated": 0, "id": 5508 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002292" }, { "name": "ValueName", "value": "InprocServer32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{C90250F3-4D7D-4991-9B69-A5C5BC1C2AE6}\\InProcServer32\\InprocServer32" } ], "repeated": 0, "id": 5509 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "4500", "caller": "0x7fff4cbd1732", "parentcaller": "0x7fff577af7dc", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e0" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "1a" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Index\\PackageFullName\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\\1a" } ], "repeated": 0, "id": 5510 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "4500", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577af5fd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e0" } ], "repeated": 0, "id": 5511 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002292" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{C90250F3-4D7D-4991-9B69-A5C5BC1C2AE6}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 5512 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "4500", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577af308", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002454" }, { "name": "SubKey", "value": "Package\\Data\\1a" }, { "name": "Handle", "value": "0x000022e0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\1a" } ], "repeated": 0, "id": 5513 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002292" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "C:\\Windows\\System32\\ActXPrxy.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{C90250F3-4D7D-4991-9B69-A5C5BC1C2AE6}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 5514 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "4500", "caller": "0x7fff4cbd16ad", "parentcaller": "0x7fff5781d320", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e0" }, { "name": "ValueName", "value": "PackageOrigin" }, { "name": "Data", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\1a\\PackageOrigin" } ], "repeated": 0, "id": 5515 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "4500", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577aed38", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e0" } ], "repeated": 0, "id": 5516 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d8d32", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002292" }, { "name": "ValueName", "value": "ThreadingModel" }, { "name": "Data", "value": "Both" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{C90250F3-4D7D-4991-9B69-A5C5BC1C2AE6}\\InProcServer32\\ThreadingModel" } ], "repeated": 0, "id": 5517 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "4500", "caller": "0x7fff4cbd17f2", "parentcaller": "0x7fff577adcce", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001aa8" } ], "repeated": 0, "id": 5518 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "4500", "caller": "0x7fff4cbd180b", "parentcaller": "0x7fff577adcce", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002454" } ], "repeated": 0, "id": 5519 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "5000", "caller": "0x7fff584d855f", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002292" } ], "repeated": 0, "id": 5520 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "4500", "caller": "0x7fff59f93f7a", "parentcaller": "0x7fff59770ed7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5521 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "5000", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000024de" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{C90250F3-4D7D-4991-9B69-A5C5BC1C2AE6}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5522 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "4500", "caller": "0x7fff5781026b", "parentcaller": "0x7fff59770daf", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00001aa8" } ], "repeated": 0, "id": 5523 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "4500", "caller": "0x7fff59f88cde", "parentcaller": "0x7fff59fc9c4e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": " \\xf1\\x02\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5524 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "5000", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{C90250F3-4D7D-4991-9B69-A5C5BC1C2AE6}\\InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{C90250F3-4D7D-4991-9B69-A5C5BC1C2AE6}\\InprocHandler32" } ], "repeated": 0, "id": 5525 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "4500", "caller": "0x7fff59fb6e46", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\xb8H\\xa9\\x0c\\x00\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00y\\x00s\\x00t\\x00e\\x00m\\x003\\x002\\x00\\\\x00a\\x00p\\x00p\\x00r\\x00e\\x00s\\x00o\\x00l\\x00v\\x00e\\x00r\\x00.\\x00d\\x00l\\x00l\\x00\\x00\\x00\\x00\\x00\\xc8\\x0b" } ], "repeated": 0, "id": 5526 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "4500", "caller": "0x7fff59fb6e9b", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xe0C\\xa9\\x0c\\x00\\x00\\x00\\x00`\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\xff\\x7f\\x00\\x00m\\x003\\x002\\x00\\\\x00W\\x00i\\x00n\\x00d\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00o\\x00w\\x00e\\x00r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5527 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000024de" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5528 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "4500", "caller": "0x7fff59fb6ec0", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 5529 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "4500", "caller": "0x7fff59fb6f0e", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xb8\\xdc\\xd8\\x08\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 5530 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "5000", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000024de" }, { "name": "ObjectAttributesName", "value": "InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{C90250F3-4D7D-4991-9B69-A5C5BC1C2AE6}\\InprocHandler32" } ], "repeated": 0, "id": 5531 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "4500", "caller": "0x7fff59fb6f8f", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xd8R\\xa9\\x0c\\x00\\x00\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 5532 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "4500", "caller": "0x7fff59fb7048", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x81\\x1a\\xff\\x7f\\x00\\x00\\xebPY\\x1a\\xff\\x7f\\x00\\x00\\xd8#\\xf5q^t\\x00\\x00(N}\\x1a\\xff\\x7f\\x00\\x00\\x80\\xd6\\xff\\x0b\\x00\\x00\\x00\\x00x\\xd6\\xff\\x0b\\x00\\x00\\x00\\x00H\\xd6\\xff\\x0b\\x00\\x00\\x00\\x00h\\xd6\\xff\\x0b" } ], "repeated": 0, "id": 5533 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "4500", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0R\\xa9\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8Z\\x1a\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00h\\xd4\\xff\\x0b\\x00\\x00\\x00\\x00\\xa8\\x1a\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00$\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2}\\x1a" } ], "repeated": 0, "id": 5534 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "5000", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000024de" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{C90250F3-4D7D-4991-9B69-A5C5BC1C2AE6}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5535 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "4500", "caller": "0x7fff59f88cde", "parentcaller": "0x7fff59f8953a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": " \\xf1\\x02\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5536 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "5000", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000024de" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5537 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "4500", "caller": "0x7fff59fb6e9b", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "`W\\xa9\\x0c\\x00\\x00\\x00\\x00`\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\xe4\\x11\\x00\\x00\\xe0\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xac\\xe3R\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5538 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "4500", "caller": "0x7fff59fb6ec0", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 5539 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "5000", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x00\\xbc\\x19\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\xde$\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xbd\\x19\\x08\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5540 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "4500", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\x98\\xdb\\xd8\\x08\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 5541 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "4500", "caller": "0x7fff59fb6f37", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 5542 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "5000", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{C90250F3-4D7D-4991-9B69-A5C5BC1C2AE6}\\InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{C90250F3-4D7D-4991-9B69-A5C5BC1C2AE6}\\InprocHandler" } ], "repeated": 0, "id": 5543 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "4500", "caller": "0x7fff59fb7048", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x81\\x1a\\xff\\x7f\\x00\\x00\\xebPY\\x1a\\xff\\x7f\\x00\\x00\\xb8'\\xf5q^t\\x00\\x00(N}\\x1a\\xff\\x7f\\x00\\x00\\xe0\\xd2\\xff\\x0b\\x00\\x00\\x00\\x00\\xd8\\xd2\\xff\\x0b\\x00\\x00\\x00\\x00\\xa8\\xd2\\xff\\x0b\\x00\\x00\\x00\\x00\\xc8\\xd2\\xff\\x0b" } ], "repeated": 0, "id": 5544 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000024de" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5545 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "4500", "caller": "0x7fff59fb707b", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10@\\xa9\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8Z\\x1a\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xc8\\xd0\\xff\\x0b\\x00\\x00\\x00\\x00\\xa8\\x1a\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00$\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x84\\xa2}\\x1a" } ], "repeated": 0, "id": 5546 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "4500", "caller": "0x7fff577d6785", "parentcaller": "0x7fff59770e27", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002454" } ], "repeated": 0, "id": 5547 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "5000", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000024de" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{C90250F3-4D7D-4991-9B69-A5C5BC1C2AE6}\\InprocHandler" } ], "repeated": 0, "id": 5548 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "4500", "caller": "0x7fff597a1630", "parentcaller": "0x7fff597a12cd", "category": "system", "api": "NtQuerySystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 5549 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "5000", "caller": "0x7fff584d8010", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024de" } ], "repeated": 0, "id": 5550 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 5551 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "4344", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xfc\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\\x10\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4344" } ], "repeated": 0, "id": 5552 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "4620", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 9, "id": 5553 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 5554 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "4504", "caller": "0x7ff79bcaadd7", "parentcaller": "0x00000000", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00010094" }, { "name": "Message", "value": "0x000005bb" } ], "repeated": 0, "id": 5555 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "4344", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xfc\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\\x10\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4344" } ], "repeated": 0, "id": 5556 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "4696", "caller": "0x7ff79bca5b09", "parentcaller": "0x7ff79bca5ab0", "category": "synchronization", "api": "NtOpenEvent", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "Handle", "value": "0x7fff58064ba0" }, { "name": "EventName", "value": "{A1965210-3A9D-4bca-822B-433645B3F5A2}" } ], "repeated": 0, "id": 5557 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "4696", "caller": "0x7ff79bc21348", "parentcaller": "0x7ff79bca8e5f", "category": "misc", "api": "GetCursorPos", "status": true, "return": "0x00000001", "arguments": [ { "name": "x", "value": "24" }, { "name": "y", "value": "1064" } ], "repeated": 0, "id": 5558 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "4696", "caller": "0x7ff79bc6b631", "parentcaller": "0x7ff79bc6b527", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "TaskbarMonitor" }, { "name": "Atom", "value": "0x0000c045" } ], "repeated": 0, "id": 5559 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc69953", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 5560 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "5000", "caller": "0x7fff57fc2755", "parentcaller": "0x7fff57fc2699", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "{\\x00C\\x005\\x006\\x00C\\x005\\x007\\x009\\x009\\x00-\\x004\\x00B\\x00B\\x003\\x00-\\x007\\x00F\\x00A\\x00E\\x00-\\x007\\x00F\\x00A\\x00D\\x00-\\x004\\x00D\\x00B\\x002\\x00F\\x006\\x00A\\x005\\x003\\x00E\\x00F\\x00F\\x00}\\x00" }, { "name": "Size", "value": "76" }, { "name": "Atom", "value": "0x0000c05f" } ], "repeated": 1, "id": 5561 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "4504", "caller": "0x7fff58520e98", "parentcaller": "0x7fff5859b785", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 5562 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff517e2bd6", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001acc" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "6136" }, { "name": "ProcessName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe" } ], "repeated": 0, "id": 5563 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "5000", "caller": "0x7fff5781026b", "parentcaller": "0x7fff517e2c2a", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001acc" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00001838" } ], "repeated": 0, "id": 5564 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "5000", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff517e2c87", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 5565 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff517e2cbb", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001838" } ], "repeated": 0, "id": 5566 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff517e2cd5", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" } ], "repeated": 0, "id": 5567 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff517e29b1", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001acc" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "6136" }, { "name": "ProcessName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe" } ], "repeated": 0, "id": 5568 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "5000", "caller": "0x7fff5781026b", "parentcaller": "0x7fff517e29fb", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001acc" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00001838" } ], "repeated": 0, "id": 5569 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "5000", "caller": "0x7fff59f9413e", "parentcaller": "0x7fff517e2a39", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 5570 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "5000", "caller": "0x7fff59f9416d", "parentcaller": "0x7fff517e2a39", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "31" }, { "name": "TokenInformation", "value": "\\x98\\xdf\\x19\\x08\\x00\\x00\\x00\\x00\\x01\\x08\\x00\\x00\\x00\\x00\\x00\\x0f\\x02\\x00\\x00\\x00<\\xe6\\xf3\\x1f\\x8a.\\x82*u\\xa8\\x8a?\\x1b(\\xed\\xbf9\\x8fA\\x14\\x0c\\xfc9u]5\n`\\xcc\\x1a\\x00\\x00\\x00\\x00\\x00\\x00\\xc2Tc\\x1a\\xff\\x7f\\x00\\x00\\xcc\\x1a\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5571 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "5000", "caller": "0x7fff59f941a8", "parentcaller": "0x7fff517e2a39", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "42" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5572 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "5000", "caller": "0x7fff59f941df", "parentcaller": "0x7fff517e2a39", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "12" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 5573 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "5000", "caller": "0x7fff59f94256", "parentcaller": "0x7fff517e2a39", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "44" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb1&\\xfaY\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x880\\x13r^t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\xe5\\x19\\x08\\x00\\x00\\x00\\x00\\xf8\\x17\\x00\\x00\\x00\\x00\\x00\\x000a\\x88\\x10\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5574 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff517e2a5b", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001838" } ], "repeated": 0, "id": 5575 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff517e2a75", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" } ], "repeated": 0, "id": 5576 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "5000", "caller": "0x7fff577cf588", "parentcaller": "0x7fff517ead8b", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001acc" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "Global\\Session\\1\\AppContainerNamedObjects\\S-1-15-2-536077884-713174666-1066051701-3219990555-339840825-1966734348-1611281757\\17f8HWNDInterface:1019e" } ], "repeated": 0, "id": 5577 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "5000", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c232", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001acc" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0b2d0000" }, { "name": "SectionOffset", "value": "0x0819e510" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 5578 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "5000", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff517eae5e", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0b2d0000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 5579 }, { "timestamp": "2026-05-29 01:05:22,352", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff517eae6d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" } ], "repeated": 0, "id": 5580 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff58519794", "parentcaller": "0x7fff517eb1dd", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "F6C29334-47DC-4397-9150-F549CF1D4861" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 5581 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 5582 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 5583 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "4620", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 1, "id": 5584 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 5585 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "4344", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xfc\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\\x10\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4344" } ], "repeated": 0, "id": 5586 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "4344", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff517e2bd6", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001acc" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "5624" }, { "name": "ProcessName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe" } ], "repeated": 0, "id": 5587 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "4344", "caller": "0x7fff5781026b", "parentcaller": "0x7fff517e2c2a", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001acc" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00001838" } ], "repeated": 0, "id": 5588 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff427435a9", "parentcaller": "0x7fff42799839", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000019d4" }, { "name": "ValueName", "value": "TraySearchBoxVisible" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Buffer", "value": "0" }, { "name": "BufferLength", "value": "4" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\TraySearchBoxVisible" } ], "repeated": 0, "id": 5589 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "4344", "caller": "0x7fff577d6785", "parentcaller": "0x7fff517e2cd5", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" } ], "repeated": 0, "id": 5590 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff427435c1", "parentcaller": "0x7fff42799839", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000019d4" } ], "repeated": 0, "id": 5591 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 5592 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5593 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "4344", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff517e29b1", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001aa8" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "5624" }, { "name": "ProcessName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe" } ], "repeated": 0, "id": 5594 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "4344", "caller": "0x7fff5781026b", "parentcaller": "0x7fff517e29fb", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001aa8" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002454" } ], "repeated": 0, "id": 5595 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000019d4" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced" } ], "repeated": 0, "id": 5596 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "4344", "caller": "0x7fff59f9413e", "parentcaller": "0x7fff517e2a39", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 5597 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff425e8fa6", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000019d4" }, { "name": "ValueName", "value": "TaskbarSmallIcons" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\TaskbarSmallIcons" } ], "repeated": 0, "id": 5598 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "4344", "caller": "0x7fff59f941a8", "parentcaller": "0x7fff517e2a39", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "42" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5599 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "4344", "caller": "0x7fff59f941df", "parentcaller": "0x7fff517e2a39", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "12" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 5600 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff577d3018", "parentcaller": "0x7fff425e8fa6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000019d4" } ], "repeated": 0, "id": 5601 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "4344", "caller": "0x7fff577d6785", "parentcaller": "0x7fff517e2a5b", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002454" } ], "repeated": 0, "id": 5602 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 5603 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "4344", "caller": "0x7fff577d6785", "parentcaller": "0x7fff517e2a75", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001aa8" } ], "repeated": 0, "id": 5604 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff577d3b20", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 5605 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5606 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "4504", "caller": "0x7fff58520e98", "parentcaller": "0x7fff5859b785", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 5607 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" } ], "repeated": 0, "id": 5608 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 5609 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5610 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000019d4" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" } ], "repeated": 0, "id": 5611 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "4344", "caller": "0x7fff577d6785", "parentcaller": "0x7fff517eae6d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e0" } ], "repeated": 0, "id": 5612 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000019d4" }, { "name": "ValueName", "value": "Current" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Current" } ], "repeated": 0, "id": 5613 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff577d3018", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000019d4" } ], "repeated": 0, "id": 5614 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff4bfd299f", "parentcaller": "0x7fff425e9098", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Accessibility" }, { "name": "Handle", "value": "0x000019d4" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Accessibility" } ], "repeated": 0, "id": 5615 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff4bfd2a24", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000019d4" }, { "name": "ValueName", "value": "TextScaleFactor" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Accessibility\\TextScaleFactor" } ], "repeated": 0, "id": 5616 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff4bfd2a6a", "parentcaller": "0x7fff425e9098", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000019d4" } ], "repeated": 0, "id": 5617 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 5618 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "4344", "caller": "0x7fff4cbd12d2", "parentcaller": "0x7fff577adc16", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache" }, { "name": "Handle", "value": "0x000022e0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache" } ], "repeated": 0, "id": 5619 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff577d3b20", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 5620 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5621 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000019d4" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" } ], "repeated": 0, "id": 5622 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000019d4" }, { "name": "ValueName", "value": "Current" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Current" } ], "repeated": 0, "id": 5623 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff577d3018", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000019d4" } ], "repeated": 0, "id": 5624 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "4344", "caller": "0x7fff4cbd1a81", "parentcaller": "0x7fff4cbd138a", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000022e0" }, { "name": "SubKey", "value": "Metadata" }, { "name": "Handle", "value": "0x00002438" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Metadata" } ], "repeated": 0, "id": 5625 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff577d3b20", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 5626 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "4344", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577af579", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000022e0" }, { "name": "SubKey", "value": "Package\\Index\\PackageFullName\\Microsoft.Windows.StartMenuExperienceHost_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy" }, { "name": "Handle", "value": "0x00002300" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Index\\PackageFullName\\Microsoft.Windows.StartMenuExperienceHost_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy" } ], "repeated": 0, "id": 5627 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" } ], "repeated": 0, "id": 5628 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 5629 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5630 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000022fc" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" } ], "repeated": 0, "id": 5631 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "4344", "caller": "0x7fff4cbd1732", "parentcaller": "0x7fff577af7dc", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002300" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "1f" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Index\\PackageFullName\\Microsoft.Windows.StartMenuExperienceHost_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\1f" } ], "repeated": 0, "id": 5632 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 5633 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "4344", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577af5fd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002300" } ], "repeated": 0, "id": 5634 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "4344", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000022e0" }, { "name": "KeyInformation", "value": "\\x00\\x01\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5635 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff4bfd299f", "parentcaller": "0x7fff425e9098", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Accessibility" }, { "name": "Handle", "value": "0x000022fc" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Accessibility" } ], "repeated": 0, "id": 5636 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff4bfd2a24", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000022fc" }, { "name": "ValueName", "value": "TextScaleFactor" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Accessibility\\TextScaleFactor" } ], "repeated": 0, "id": 5637 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "4344", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000024cc" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x000022e0" }, { "name": "ObjectAttributesName", "value": "Package\\Data\\1f" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\1f" } ], "repeated": 0, "id": 5638 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 5639 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5640 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" } ], "repeated": 0, "id": 5641 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 5642 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5643 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000022fc" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" } ], "repeated": 0, "id": 5644 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "4344", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577aed38", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024cc" } ], "repeated": 0, "id": 5645 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000022fc" }, { "name": "ValueName", "value": "Current" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Current" } ], "repeated": 0, "id": 5646 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "4344", "caller": "0x7fff4cbd180b", "parentcaller": "0x7fff577adcce", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e0" } ], "repeated": 0, "id": 5647 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff577d3018", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022fc" } ], "repeated": 0, "id": 5648 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 5649 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5650 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "4344", "caller": "0x7fff59f93f7a", "parentcaller": "0x7fff59770ed7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5651 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "4344", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x000022e0" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 5652 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff517e2a75", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022fc" } ], "repeated": 0, "id": 5653 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "4344", "caller": "0x7fff5781026b", "parentcaller": "0x7fff59770daf", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002438" } ], "repeated": 0, "id": 5654 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff577cf588", "parentcaller": "0x7fff517ead8b", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000022fc" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "Global\\Session\\1\\AppContainerNamedObjects\\S-1-15-2-536077884-713174666-1066051701-3219990555-339840825-1966734348-1611281757\\17f8HWNDInterface:1019e" } ], "repeated": 0, "id": 5655 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "4344", "caller": "0x7fff59f88cde", "parentcaller": "0x7fff59fc9c4e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": " \\xf1\\x02\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5656 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "4344", "caller": "0x7fff59fb6e46", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "xd\\xe5\\x08\\x00\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00m\\x00s\\x00-\\x00d\\x00e\\x00f\\x00a\\x00u\\x00l\\x00t\\x00-\\x00o\\x00n\\x00-\\x00s\\x00c\\x00r\\x00e\\x00e\\x00n\\x00-\\x00i\\x00n\\x00p\\x00" } ], "repeated": 0, "id": 5657 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff517eae5e", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0b2d0000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 5658 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff517eae6d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022fc" } ], "repeated": 0, "id": 5659 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff58519794", "parentcaller": "0x7fff517eb1dd", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "F6C29334-47DC-4397-9150-F549CF1D4861" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 5660 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "10916", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xa4*\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "10916" } ], "repeated": 0, "id": 5661 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 5662 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 1, "id": 5663 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "4344", "caller": "0x7fff59fb6e9b", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\x00i\\xe5\\x08\\x00\\x00\\x00\\x00`\\x00\\x00\\x00-\\x00w\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00e\\x00-\\x00w\\x00i\\x00n\\x003\\x002\\x00k\\x00-\\x00f\\x00u\\x00l\\x00l\\x00u\\x00s\\x00e\\x00r\\x00-\\x00l\\x001\\x00-\\x001\\x00-\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5664 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "4344", "caller": "0x7fff59fb6ec0", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 5665 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "4344", "caller": "0x7fff59fb6f0e", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "X\\xfc|\\x0c\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 5666 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "4344", "caller": "0x7fff59fb6f37", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 5667 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "4344", "caller": "0x7fff59fb6f8f", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xf8n\\xe5\\x08\\x00\\x00\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 5668 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "4344", "caller": "0x7fff59fb7048", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x81\\x1a\\xff\\x7f\\x00\\x00\\xebPY\\x1a\\xff\\x7f\\x00\\x00\\xa8$\\xe4s^t\\x00\\x00(N}\\x1a\\xff\\x7f\\x00\\x00\\xf0\\xd1\\xee\t\\x00\\x00\\x00\\x00\\xe8\\xd1\\xee\t\\x00\\x00\\x00\\x00\\xb8\\xd1\\xee\t\\x00\\x00\\x00\\x00\\xd8\\xd1\\xee\t" } ], "repeated": 0, "id": 5669 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "4504", "caller": "0x7ff79bcd3bb4", "parentcaller": "0x00000000", "category": "registry", "api": "RegNotifyChangeKeyValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\" }, { "name": "NotifyFilter", "value": "0x10000005" }, { "name": "WatchSubtree", "value": "1" }, { "name": "Asynchronous", "value": "1" } ], "repeated": 0, "id": 5670 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "4344", "caller": "0x7fff59f88cde", "parentcaller": "0x7fff59f8953a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": " \\xf1\\x02\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5671 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "4344", "caller": "0x7fff59fb6e46", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\x98e\\xe5\\x08\\x00\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x04]\\x88\\x8a\\xeb\\x1c\\xc9\\x11\\x9f\\xe8\\x08\\x00+\\x10H`\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'\\x00\\x00\\x00" } ], "repeated": 0, "id": 5672 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "4504", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd15e8a", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 5673 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "4504", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd15e8a", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5674 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "4344", "caller": "0x7fff59fb6e9b", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": " m\\xe5\\x08\\x00\\x00\\x00\\x00`\\x00\\x00\\x00)S\\xc5\\xa3\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\xeb\\x1c\\xc9\\x11\\x9f\\xe8\\x08\\x00+\\x10H`\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5675 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "4344", "caller": "0x7fff59fb6ec0", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 5676 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "4344", "caller": "0x7fff59fb6f0e", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xb8\\xfc|\\x0c\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 5677 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "4504", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd15e8a", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000019d4" }, { "name": "ValueName", "value": "BackgroundAppGlobalToggle" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\BackgroundAppGlobalToggle" } ], "repeated": 0, "id": 5678 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "4504", "caller": "0x7fff577d3018", "parentcaller": "0x7ff79bc55095", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000019d4" } ], "repeated": 0, "id": 5679 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "6164", "caller": "0x7ff79bcd3bb4", "parentcaller": "0x00000000", "category": "registry", "api": "RegNotifyChangeKeyValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\" }, { "name": "NotifyFilter", "value": "0x10000005" }, { "name": "WatchSubtree", "value": "1" }, { "name": "Asynchronous", "value": "1" } ], "repeated": 0, "id": 5680 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "6164", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd15e8a", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 5681 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "6164", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd15e8a", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5682 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "6164", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd15e8a", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000019d4" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search" } ], "repeated": 0, "id": 5683 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "6164", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd15e8a", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000019d4" }, { "name": "ValueName", "value": "BackgroundAppGlobalToggle" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\BackgroundAppGlobalToggle" } ], "repeated": 0, "id": 5684 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "6164", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd15e8a", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000019d4" } ], "repeated": 0, "id": 5685 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "4620", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 1, "id": 5686 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "4344", "caller": "0x7fff59fb6f37", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 5687 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff577d3018", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022fc" } ], "repeated": 0, "id": 5688 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 5689 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5690 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" } ], "repeated": 0, "id": 5691 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 5692 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5693 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000022fc" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" } ], "repeated": 0, "id": 5694 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000022fc" }, { "name": "ValueName", "value": "Current" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Current" } ], "repeated": 0, "id": 5695 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff577d3018", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022fc" } ], "repeated": 0, "id": 5696 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 5697 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5698 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" } ], "repeated": 0, "id": 5699 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 5700 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5701 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000022fc" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" } ], "repeated": 0, "id": 5702 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000022fc" }, { "name": "ValueName", "value": "Current" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Current" } ], "repeated": 0, "id": 5703 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff577d3018", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022fc" } ], "repeated": 0, "id": 5704 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff4bfd299f", "parentcaller": "0x7fff425e9098", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Accessibility" }, { "name": "Handle", "value": "0x000022fc" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Accessibility" } ], "repeated": 0, "id": 5705 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff4bfd2a24", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000022fc" }, { "name": "ValueName", "value": "TextScaleFactor" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Accessibility\\TextScaleFactor" } ], "repeated": 0, "id": 5706 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff4bfd2a6a", "parentcaller": "0x7fff425e9098", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022fc" } ], "repeated": 0, "id": 5707 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 5708 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "4344", "caller": "0x7fff59fb6f8f", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "Xo\\xe5\\x08\\x00\\x00\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 5709 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5710 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "4344", "caller": "0x7fff59fb7048", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x81\\x1a\\xff\\x7f\\x00\\x00\\xebPY\\x1a\\xff\\x7f\\x00\\x00\\x08(\\xe4s^t\\x00\\x00(N}\\x1a\\xff\\x7f\\x00\\x00P\\xce\\xee\t\\x00\\x00\\x00\\x00H\\xce\\xee\t\\x00\\x00\\x00\\x00\\x18\\xce\\xee\t\\x00\\x00\\x00\\x008\\xce\\xee\t" } ], "repeated": 0, "id": 5711 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" } ], "repeated": 0, "id": 5712 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "4344", "caller": "0x7fff577d6785", "parentcaller": "0x7fff59770e27", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e0" } ], "repeated": 0, "id": 5713 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 5714 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "4344", "caller": "0x7fff577d6785", "parentcaller": "0x7fff59770e49", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 5715 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff577d3b20", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 5716 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "4344", "caller": "0x7fff597a1630", "parentcaller": "0x7fff597a12cd", "category": "system", "api": "NtQuerySystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 5717 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5718 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000022fc" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" } ], "repeated": 0, "id": 5719 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000022fc" }, { "name": "ValueName", "value": "Current" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Current" } ], "repeated": 0, "id": 5720 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff577d3018", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022fc" } ], "repeated": 0, "id": 5721 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 5722 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5723 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" } ], "repeated": 0, "id": 5724 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 5725 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5726 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000022fc" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" } ], "repeated": 0, "id": 5727 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000022fc" }, { "name": "ValueName", "value": "Current" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Current" } ], "repeated": 0, "id": 5728 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff577d3018", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022fc" } ], "repeated": 0, "id": 5729 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 5730 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5731 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" } ], "repeated": 0, "id": 5732 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 5733 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5734 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000022fc" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" } ], "repeated": 0, "id": 5735 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000022fc" }, { "name": "ValueName", "value": "Current" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Current" } ], "repeated": 0, "id": 5736 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff577d3018", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022fc" } ], "repeated": 0, "id": 5737 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 5738 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff57fc2a0e", "parentcaller": "0x7fff581d409e", "category": "synchronization", "api": "NtAddAtomEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "UIA_WindowVisibilityOverridden" }, { "name": "Atom", "value": "0x0000c042" } ], "repeated": 0, "id": 5739 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 5740 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58085ee4", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002048" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 5741 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "6148", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x18\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6148" } ], "repeated": 0, "id": 5742 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "6148", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x18\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6148" } ], "repeated": 0, "id": 5743 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "10916", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xa4*\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "10916" } ], "repeated": 0, "id": 5744 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "4620", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 5745 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 5746 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "6164", "caller": "0x7fff58520e98", "parentcaller": "0x7fff5859b785", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 5747 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "10916", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xa4*\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "10916" } ], "repeated": 0, "id": 5748 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "4500", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xfe\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x94\\x11\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4500" } ], "repeated": 0, "id": 5749 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 1, "id": 5750 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "4620", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 1, "id": 5751 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff4274356a", "parentcaller": "0x7fff42799839", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x00000002", "pretty_value": "KEY_SET_VALUE" }, { "name": "Handle", "value": "0x000019d4" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 5752 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff427435a9", "parentcaller": "0x7fff42799839", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000019d4" }, { "name": "ValueName", "value": "TraySearchBoxVisible" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Buffer", "value": "0" }, { "name": "BufferLength", "value": "4" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\TraySearchBoxVisible" } ], "repeated": 0, "id": 5753 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff427435c1", "parentcaller": "0x7fff42799839", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000019d4" } ], "repeated": 0, "id": 5754 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 5755 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5756 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000019d4" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced" } ], "repeated": 0, "id": 5757 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "4344", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xfc\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\\x10\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4344" } ], "repeated": 0, "id": 5758 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff425e8fa6", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000019d4" }, { "name": "ValueName", "value": "TaskbarSmallIcons" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\TaskbarSmallIcons" } ], "repeated": 0, "id": 5759 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff577d3018", "parentcaller": "0x7fff425e8fa6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000019d4" } ], "repeated": 0, "id": 5760 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 5761 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5762 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" } ], "repeated": 0, "id": 5763 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 5764 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5765 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000019d4" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" } ], "repeated": 0, "id": 5766 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000019d4" }, { "name": "ValueName", "value": "Current" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Current" } ], "repeated": 0, "id": 5767 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "5000", "caller": "0x7fff577d3018", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000019d4" } ], "repeated": 0, "id": 5768 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "4620", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 5769 }, { "timestamp": "2026-05-29 01:05:22,368", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 5770 }, { "timestamp": "2026-05-29 01:05:22,415", "thread_id": "4696", "caller": "0x7ff79be75e31", "parentcaller": "0x7ff79bda1c43", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00001016" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 5771 }, { "timestamp": "2026-05-29 01:05:22,415", "thread_id": "4696", "caller": "0x7ff79be75e31", "parentcaller": "0x7ff79bda1c43", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00001018" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 5772 }, { "timestamp": "2026-05-29 01:05:23,165", "thread_id": "4696", "caller": "0x7ff79bc6b631", "parentcaller": "0x7ff79bc6b527", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "TaskbarMonitor" }, { "name": "Atom", "value": "0x0000c045" } ], "repeated": 0, "id": 5773 }, { "timestamp": "2026-05-29 01:05:23,165", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc69953", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 5774 }, { "timestamp": "2026-05-29 01:05:23,196", "thread_id": "4696", "caller": "0x7ff79bc6b631", "parentcaller": "0x7ff79bc6b527", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "TaskbarMonitor" }, { "name": "Atom", "value": "0x0000c045" } ], "repeated": 0, "id": 5775 }, { "timestamp": "2026-05-29 01:05:23,196", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc69953", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 5776 }, { "timestamp": "2026-05-29 01:05:23,212", "thread_id": "4696", "caller": "0x7ff79bc6b631", "parentcaller": "0x7ff79bc6b527", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "TaskbarMonitor" }, { "name": "Atom", "value": "0x0000c045" } ], "repeated": 0, "id": 5777 }, { "timestamp": "2026-05-29 01:05:23,212", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc69953", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 5778 }, { "timestamp": "2026-05-29 01:05:23,227", "thread_id": "4696", "caller": "0x7ff79bc6b631", "parentcaller": "0x7ff79bc6b527", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "TaskbarMonitor" }, { "name": "Atom", "value": "0x0000c045" } ], "repeated": 0, "id": 5779 }, { "timestamp": "2026-05-29 01:05:23,227", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc69953", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 5780 }, { "timestamp": "2026-05-29 01:05:23,243", "thread_id": "4696", "caller": "0x7ff79bc6b631", "parentcaller": "0x7ff79bc6b527", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "TaskbarMonitor" }, { "name": "Atom", "value": "0x0000c045" } ], "repeated": 0, "id": 5781 }, { "timestamp": "2026-05-29 01:05:23,243", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc69953", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 5782 }, { "timestamp": "2026-05-29 01:05:23,258", "thread_id": "4696", "caller": "0x7ff79bc6b631", "parentcaller": "0x7ff79bc6b527", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "TaskbarMonitor" }, { "name": "Atom", "value": "0x0000c045" } ], "repeated": 0, "id": 5783 }, { "timestamp": "2026-05-29 01:05:23,258", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc69953", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 5784 }, { "timestamp": "2026-05-29 01:05:23,274", "thread_id": "4696", "caller": "0x7ff79bc6b631", "parentcaller": "0x7ff79bc6b527", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "TaskbarMonitor" }, { "name": "Atom", "value": "0x0000c045" } ], "repeated": 0, "id": 5785 }, { "timestamp": "2026-05-29 01:05:23,274", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc69953", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 5786 }, { "timestamp": "2026-05-29 01:05:23,290", "thread_id": "4696", "caller": "0x7ff79bc6b631", "parentcaller": "0x7ff79bc6b527", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "TaskbarMonitor" }, { "name": "Atom", "value": "0x0000c045" } ], "repeated": 1, "id": 5787 }, { "timestamp": "2026-05-29 01:05:23,727", "thread_id": "6164", "caller": "0x7fff428ef240", "parentcaller": "0x7fff42905506", "category": "misc", "api": "GetSystemMetrics", "status": false, "return": "0x00000000", "arguments": [ { "name": "SystemMetricIndex", "value": "8192" } ], "repeated": 0, "id": 5788 }, { "timestamp": "2026-05-29 01:05:23,727", "thread_id": "4504", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff584fb0ca", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5789 }, { "timestamp": "2026-05-29 01:05:23,727", "thread_id": "4504", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff584c6d2f", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000019d4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 5790 }, { "timestamp": "2026-05-29 01:05:23,727", "thread_id": "4504", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff584fb0ca", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 5791 }, { "timestamp": "2026-05-29 01:05:23,743", "thread_id": "4504", "caller": "0x745e704c64c8", "parentcaller": "0x00000000", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "31" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\x8dF\n\\x00\\x00\\x00\\x00X\\x8dF\n\\x00\\x00\\x00\\x00\\xe0\\x99\\xb1\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\xb1&\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00UB\\xff\\x7f\\x00\\x00\\x18sb\\x07\\x00\\x00\\x00\\x00\\x80\\x93F\n" } ], "repeated": 0, "id": 5792 }, { "timestamp": "2026-05-29 01:05:23,743", "thread_id": "4504", "caller": "0x7fff5486cf1d", "parentcaller": "0x7fff4075ad28", "category": "system", "api": "GetSystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 3, "id": 5793 }, { "timestamp": "2026-05-29 01:05:23,821", "thread_id": "4504", "caller": "0x7fff457f5d68", "parentcaller": "0x7fff59f60ebc", "category": "registry", "api": "RegNotifyChangeKeyValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Deployment\\Package\\*\\S-1-5-21-3968686040-3210279463-847977608-1001\\{8BE3BA15-80C6-4702-A853-5D58F0944DF1}\\" }, { "name": "NotifyFilter", "value": "0x10000005" }, { "name": "WatchSubtree", "value": "1" }, { "name": "Asynchronous", "value": "1" } ], "repeated": 0, "id": 5794 }, { "timestamp": "2026-05-29 01:05:23,821", "thread_id": "4504", "caller": "0x7fff457f3fdd", "parentcaller": "0x7fff457f4c90", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000564" }, { "name": "ValueName", "value": "Version" }, { "name": "Data", "value": "\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Deployment\\Package\\*\\S-1-5-21-3968686040-3210279463-847977608-1001\\{8BE3BA15-80C6-4702-A853-5D58F0944DF1}\\Version" } ], "repeated": 0, "id": 5795 }, { "timestamp": "2026-05-29 01:05:23,821", "thread_id": "6164", "caller": "0x7fff457f5d68", "parentcaller": "0x7fff59f60ebc", "category": "registry", "api": "RegNotifyChangeKeyValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Deployment\\Package\\*\\S-1-5-21-3968686040-3210279463-847977608-1001\\{8BE3BA15-80C6-4702-A853-5D58F0944DF1}\\" }, { "name": "NotifyFilter", "value": "0x10000005" }, { "name": "WatchSubtree", "value": "1" }, { "name": "Asynchronous", "value": "1" } ], "repeated": 0, "id": 5796 }, { "timestamp": "2026-05-29 01:05:23,821", "thread_id": "6164", "caller": "0x7fff457f3fdd", "parentcaller": "0x7fff457f4c90", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000564" }, { "name": "ValueName", "value": "Version" }, { "name": "Data", "value": "\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Deployment\\Package\\*\\S-1-5-21-3968686040-3210279463-847977608-1001\\{8BE3BA15-80C6-4702-A853-5D58F0944DF1}\\Version" } ], "repeated": 0, "id": 5797 }, { "timestamp": "2026-05-29 01:05:23,821", "thread_id": "4504", "caller": "0x7fff457f5d68", "parentcaller": "0x7fff59f60ebc", "category": "registry", "api": "RegNotifyChangeKeyValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Deployment\\Package\\*\\S-1-5-21-3968686040-3210279463-847977608-1001\\{8BE3BA15-80C6-4702-A853-5D58F0944DF1}\\" }, { "name": "NotifyFilter", "value": "0x10000005" }, { "name": "WatchSubtree", "value": "1" }, { "name": "Asynchronous", "value": "1" } ], "repeated": 0, "id": 5798 }, { "timestamp": "2026-05-29 01:05:23,821", "thread_id": "4504", "caller": "0x7fff457f3fdd", "parentcaller": "0x7fff457f4c90", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000564" }, { "name": "ValueName", "value": "Version" }, { "name": "Data", "value": "\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Deployment\\Package\\*\\S-1-5-21-3968686040-3210279463-847977608-1001\\{8BE3BA15-80C6-4702-A853-5D58F0944DF1}\\Version" } ], "repeated": 0, "id": 5799 }, { "timestamp": "2026-05-29 01:05:23,837", "thread_id": "4504", "caller": "0x7fff457f5d68", "parentcaller": "0x7fff59f60ebc", "category": "registry", "api": "RegNotifyChangeKeyValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Deployment\\Package\\*\\S-1-5-21-3968686040-3210279463-847977608-1001\\{8BE3BA15-80C6-4702-A853-5D58F0944DF1}\\" }, { "name": "NotifyFilter", "value": "0x10000005" }, { "name": "WatchSubtree", "value": "1" }, { "name": "Asynchronous", "value": "1" } ], "repeated": 0, "id": 5800 }, { "timestamp": "2026-05-29 01:05:23,837", "thread_id": "4504", "caller": "0x7fff457f3fdd", "parentcaller": "0x7fff457f4c90", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000564" }, { "name": "ValueName", "value": "Version" }, { "name": "Data", "value": "\\x0e\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Deployment\\Package\\*\\S-1-5-21-3968686040-3210279463-847977608-1001\\{8BE3BA15-80C6-4702-A853-5D58F0944DF1}\\Version" } ], "repeated": 0, "id": 5801 }, { "timestamp": "2026-05-29 01:05:23,837", "thread_id": "6164", "caller": "0x7fff457f5d68", "parentcaller": "0x7fff59f60ebc", "category": "registry", "api": "RegNotifyChangeKeyValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Deployment\\Package\\*\\S-1-5-21-3968686040-3210279463-847977608-1001\\{8BE3BA15-80C6-4702-A853-5D58F0944DF1}\\" }, { "name": "NotifyFilter", "value": "0x10000005" }, { "name": "WatchSubtree", "value": "1" }, { "name": "Asynchronous", "value": "1" } ], "repeated": 0, "id": 5802 }, { "timestamp": "2026-05-29 01:05:23,837", "thread_id": "6164", "caller": "0x7fff457f3fdd", "parentcaller": "0x7fff457f4c90", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000564" }, { "name": "ValueName", "value": "Version" }, { "name": "Data", "value": "\\x0e\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Deployment\\Package\\*\\S-1-5-21-3968686040-3210279463-847977608-1001\\{8BE3BA15-80C6-4702-A853-5D58F0944DF1}\\Version" } ], "repeated": 0, "id": 5803 }, { "timestamp": "2026-05-29 01:05:23,837", "thread_id": "4504", "caller": "0x7fff457f5d68", "parentcaller": "0x7fff59f60ebc", "category": "registry", "api": "RegNotifyChangeKeyValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Deployment\\Package\\*\\S-1-5-21-3968686040-3210279463-847977608-1001\\{8BE3BA15-80C6-4702-A853-5D58F0944DF1}\\" }, { "name": "NotifyFilter", "value": "0x10000005" }, { "name": "WatchSubtree", "value": "1" }, { "name": "Asynchronous", "value": "1" } ], "repeated": 0, "id": 5804 }, { "timestamp": "2026-05-29 01:05:23,837", "thread_id": "4504", "caller": "0x7fff457f3fdd", "parentcaller": "0x7fff457f4c90", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000564" }, { "name": "ValueName", "value": "Version" }, { "name": "Data", "value": "\\x0e\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Deployment\\Package\\*\\S-1-5-21-3968686040-3210279463-847977608-1001\\{8BE3BA15-80C6-4702-A853-5D58F0944DF1}\\Version" } ], "repeated": 0, "id": 5805 }, { "timestamp": "2026-05-29 01:05:23,899", "thread_id": "6204", "caller": "0x7fff38e913d3", "parentcaller": "0x7fff38e915e8", "category": "registry", "api": "RegNotifyChangeKeyValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\" }, { "name": "NotifyFilter", "value": "0x00000001" }, { "name": "WatchSubtree", "value": "0" }, { "name": "Asynchronous", "value": "1" } ], "repeated": 0, "id": 5806 }, { "timestamp": "2026-05-29 01:05:23,899", "thread_id": "6204", "caller": "0x7fff38e91400", "parentcaller": "0x7fff38e915e8", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "Outlook.Application" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\Outlook.Application" } ], "repeated": 0, "id": 5807 }, { "timestamp": "2026-05-29 01:05:23,899", "thread_id": "6204", "caller": "0x7fff38e9147f", "parentcaller": "0x7fff38e915e8", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "Outlook.Application.12" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\Outlook.Application.12" } ], "repeated": 0, "id": 5808 }, { "timestamp": "2026-05-29 01:05:23,899", "thread_id": "6204", "caller": "0x7fff38e914b7", "parentcaller": "0x7fff38e915e8", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "Outlook.Application.11" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\Outlook.Application.11" } ], "repeated": 0, "id": 5809 }, { "timestamp": "2026-05-29 01:05:23,899", "thread_id": "6204", "caller": "0x7fff38e914f3", "parentcaller": "0x7fff38e915e8", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "Outlook.Application.10" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\Outlook.Application.10" } ], "repeated": 0, "id": 5810 }, { "timestamp": "2026-05-29 01:05:23,899", "thread_id": "6204", "caller": "0x7fff38e913d3", "parentcaller": "0x7fff38e915e8", "category": "registry", "api": "RegNotifyChangeKeyValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\" }, { "name": "NotifyFilter", "value": "0x00000001" }, { "name": "WatchSubtree", "value": "0" }, { "name": "Asynchronous", "value": "1" } ], "repeated": 0, "id": 5811 }, { "timestamp": "2026-05-29 01:05:23,899", "thread_id": "6204", "caller": "0x7fff38e91400", "parentcaller": "0x7fff38e915e8", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "Outlook.Application" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\Outlook.Application" } ], "repeated": 0, "id": 5812 }, { "timestamp": "2026-05-29 01:05:23,899", "thread_id": "6204", "caller": "0x7fff38e9147f", "parentcaller": "0x7fff38e915e8", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "Outlook.Application.12" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\Outlook.Application.12" } ], "repeated": 0, "id": 5813 }, { "timestamp": "2026-05-29 01:05:23,899", "thread_id": "6204", "caller": "0x7fff38e914b7", "parentcaller": "0x7fff38e915e8", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "Outlook.Application.11" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\Outlook.Application.11" } ], "repeated": 0, "id": 5814 }, { "timestamp": "2026-05-29 01:05:23,899", "thread_id": "6204", "caller": "0x7fff38e914f3", "parentcaller": "0x7fff38e915e8", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "Outlook.Application.10" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\Outlook.Application.10" } ], "repeated": 0, "id": 5815 }, { "timestamp": "2026-05-29 01:05:23,899", "thread_id": "6204", "caller": "0x7fff38e913d3", "parentcaller": "0x7fff38e915e8", "category": "registry", "api": "RegNotifyChangeKeyValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\" }, { "name": "NotifyFilter", "value": "0x00000001" }, { "name": "WatchSubtree", "value": "0" }, { "name": "Asynchronous", "value": "1" } ], "repeated": 0, "id": 5816 }, { "timestamp": "2026-05-29 01:05:23,899", "thread_id": "6204", "caller": "0x7fff38e91400", "parentcaller": "0x7fff38e915e8", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "Outlook.Application" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\Outlook.Application" } ], "repeated": 0, "id": 5817 }, { "timestamp": "2026-05-29 01:05:23,899", "thread_id": "6204", "caller": "0x7fff38e9147f", "parentcaller": "0x7fff38e915e8", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "Outlook.Application.12" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\Outlook.Application.12" } ], "repeated": 0, "id": 5818 }, { "timestamp": "2026-05-29 01:05:23,899", "thread_id": "6204", "caller": "0x7fff38e914b7", "parentcaller": "0x7fff38e915e8", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "Outlook.Application.11" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\Outlook.Application.11" } ], "repeated": 0, "id": 5819 }, { "timestamp": "2026-05-29 01:05:23,899", "thread_id": "6204", "caller": "0x7fff38e914f3", "parentcaller": "0x7fff38e915e8", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "Outlook.Application.10" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\Outlook.Application.10" } ], "repeated": 0, "id": 5820 }, { "timestamp": "2026-05-29 01:05:23,977", "thread_id": "4504", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbddbb", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001ae4" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "6136" }, { "name": "ProcessName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe" } ], "repeated": 0, "id": 5821 }, { "timestamp": "2026-05-29 01:05:23,977", "thread_id": "4504", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbddbb", "category": "process", "api": "NtOpenProcess", "status": false, "return": "0xffffffffc0000022", "pretty_return": "ACCESS_DENIED", "arguments": [ { "name": "ProcessHandle", "value": "0x00001ae4" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "1048" } ], "repeated": 0, "id": 5822 }, { "timestamp": "2026-05-29 01:05:23,977", "thread_id": "4504", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbddbb", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001ac8" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 5823 }, { "timestamp": "2026-05-29 01:05:23,977", "thread_id": "4504", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbddbb", "category": "process", "api": "NtOpenProcess", "status": false, "return": "0xffffffffc0000022", "pretty_return": "ACCESS_DENIED", "arguments": [ { "name": "ProcessHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "1180" } ], "repeated": 0, "id": 5824 }, { "timestamp": "2026-05-29 01:05:23,977", "thread_id": "4504", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbddbb", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001ac4" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "5624" }, { "name": "ProcessName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe" } ], "repeated": 0, "id": 5825 }, { "timestamp": "2026-05-29 01:05:23,977", "thread_id": "4504", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbddbb", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001af4" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "5128" }, { "name": "ProcessName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe" } ], "repeated": 0, "id": 5826 }, { "timestamp": "2026-05-29 01:05:23,977", "thread_id": "4504", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbddbb", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000255c" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "6400" }, { "name": "ProcessName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe" } ], "repeated": 0, "id": 5827 }, { "timestamp": "2026-05-29 01:05:23,977", "thread_id": "4504", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xfe\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x98\\x11\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4504" } ], "repeated": 3, "id": 5828 }, { "timestamp": "2026-05-29 01:05:23,977", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 5829 }, { "timestamp": "2026-05-29 01:05:23,977", "thread_id": "4504", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xfe\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x98\\x11\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4504" } ], "repeated": 3, "id": 5830 }, { "timestamp": "2026-05-29 01:05:23,977", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 5831 }, { "timestamp": "2026-05-29 01:05:23,977", "thread_id": "4504", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xfe\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x98\\x11\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4504" } ], "repeated": 3, "id": 5832 }, { "timestamp": "2026-05-29 01:05:23,977", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 5833 }, { "timestamp": "2026-05-29 01:05:23,977", "thread_id": "4504", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xfe\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x98\\x11\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4504" } ], "repeated": 2, "id": 5834 }, { "timestamp": "2026-05-29 01:05:23,977", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 5835 }, { "timestamp": "2026-05-29 01:05:23,977", "thread_id": "4504", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xfe\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x98\\x11\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4504" } ], "repeated": 1, "id": 5836 }, { "timestamp": "2026-05-29 01:05:23,977", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 1, "id": 5837 }, { "timestamp": "2026-05-29 01:05:23,977", "thread_id": "4504", "caller": "0x7fff41dbe842", "parentcaller": "0x7fff59fc16e9", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002440" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "\\Device\\Bam" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 5838 }, { "timestamp": "2026-05-29 01:05:23,977", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 2, "id": 5839 }, { "timestamp": "2026-05-29 01:05:23,977", "thread_id": "4504", "caller": "0x7fff41dbe8a3", "parentcaller": "0x7fff59fc16e9", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002440" }, { "name": "HandleName", "value": "\\Device\\Bam" }, { "name": "IoControlCode", "value": "0x00220004" }, { "name": "InputBuffer", "value": "\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe4\\x1a\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc8\\x1a\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9c\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc4\\x1a\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf4\\x1a\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\%\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 5840 }, { "timestamp": "2026-05-29 01:05:23,977", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 5841 }, { "timestamp": "2026-05-29 01:05:23,977", "thread_id": "4504", "caller": "0x7fff577d6785", "parentcaller": "0x7fff41dbe9a9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ac8" } ], "repeated": 0, "id": 5842 }, { "timestamp": "2026-05-29 01:05:23,977", "thread_id": "4504", "caller": "0x7fff577d6785", "parentcaller": "0x7fff41dbe9a9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ac4" } ], "repeated": 0, "id": 5843 }, { "timestamp": "2026-05-29 01:05:23,977", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 5844 }, { "timestamp": "2026-05-29 01:05:23,977", "thread_id": "4504", "caller": "0x7fff577d6785", "parentcaller": "0x7fff41dbe9a9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000255c" } ], "repeated": 0, "id": 5845 }, { "timestamp": "2026-05-29 01:05:23,977", "thread_id": "4504", "caller": "0x7fff41dbe9d8", "parentcaller": "0x7fff59fc16e9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002440" } ], "repeated": 0, "id": 5846 }, { "timestamp": "2026-05-29 01:05:23,977", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 25, "id": 5847 }, { "timestamp": "2026-05-29 01:05:24,024", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "misc", "api": "GetKeyboardLayout", "status": true, "return": "0x04090409", "arguments": [ { "name": "KeyboardLayout", "value": "0x00000409" }, { "name": "LanguageName", "value": "English (United States)" } ], "repeated": 0, "id": 5848 }, { "timestamp": "2026-05-29 01:05:24,024", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 5849 }, { "timestamp": "2026-05-29 01:05:24,024", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002440" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 5850 }, { "timestamp": "2026-05-29 01:05:24,024", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002440" } ], "repeated": 0, "id": 5851 }, { "timestamp": "2026-05-29 01:05:24,024", "thread_id": "6204", "caller": "0x7fff38e913d3", "parentcaller": "0x7fff38e915e8", "category": "registry", "api": "RegNotifyChangeKeyValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\" }, { "name": "NotifyFilter", "value": "0x00000001" }, { "name": "WatchSubtree", "value": "0" }, { "name": "Asynchronous", "value": "1" } ], "repeated": 0, "id": 5852 }, { "timestamp": "2026-05-29 01:05:24,024", "thread_id": "6204", "caller": "0x7fff38e91400", "parentcaller": "0x7fff38e915e8", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "Outlook.Application" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\Outlook.Application" } ], "repeated": 0, "id": 5853 }, { "timestamp": "2026-05-29 01:05:24,024", "thread_id": "6204", "caller": "0x7fff38e9147f", "parentcaller": "0x7fff38e915e8", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "Outlook.Application.12" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\Outlook.Application.12" } ], "repeated": 0, "id": 5854 }, { "timestamp": "2026-05-29 01:05:24,024", "thread_id": "6204", "caller": "0x7fff38e914b7", "parentcaller": "0x7fff38e915e8", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "Outlook.Application.11" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\Outlook.Application.11" } ], "repeated": 0, "id": 5855 }, { "timestamp": "2026-05-29 01:05:24,024", "thread_id": "6204", "caller": "0x7fff38e914f3", "parentcaller": "0x7fff38e915e8", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "Outlook.Application.10" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\Outlook.Application.10" } ], "repeated": 0, "id": 5856 }, { "timestamp": "2026-05-29 01:05:24,024", "thread_id": "6204", "caller": "0x7fff38e913d3", "parentcaller": "0x7fff38e915e8", "category": "registry", "api": "RegNotifyChangeKeyValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\" }, { "name": "NotifyFilter", "value": "0x00000001" }, { "name": "WatchSubtree", "value": "0" }, { "name": "Asynchronous", "value": "1" } ], "repeated": 0, "id": 5857 }, { "timestamp": "2026-05-29 01:05:24,024", "thread_id": "6204", "caller": "0x7fff38e91400", "parentcaller": "0x7fff38e915e8", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "Outlook.Application" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\Outlook.Application" } ], "repeated": 0, "id": 5858 }, { "timestamp": "2026-05-29 01:05:24,024", "thread_id": "6204", "caller": "0x7fff38e9147f", "parentcaller": "0x7fff38e915e8", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "Outlook.Application.12" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\Outlook.Application.12" } ], "repeated": 0, "id": 5859 }, { "timestamp": "2026-05-29 01:05:24,024", "thread_id": "6204", "caller": "0x7fff38e914b7", "parentcaller": "0x7fff38e915e8", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "Outlook.Application.11" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\Outlook.Application.11" } ], "repeated": 0, "id": 5860 }, { "timestamp": "2026-05-29 01:05:24,024", "thread_id": "6204", "caller": "0x7fff38e914f3", "parentcaller": "0x7fff38e915e8", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "Outlook.Application.10" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\Outlook.Application.10" } ], "repeated": 0, "id": 5861 }, { "timestamp": "2026-05-29 01:05:24,024", "thread_id": "6204", "caller": "0x7fff38e913d3", "parentcaller": "0x7fff38e915e8", "category": "registry", "api": "RegNotifyChangeKeyValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\" }, { "name": "NotifyFilter", "value": "0x00000001" }, { "name": "WatchSubtree", "value": "0" }, { "name": "Asynchronous", "value": "1" } ], "repeated": 0, "id": 5862 }, { "timestamp": "2026-05-29 01:05:24,024", "thread_id": "6204", "caller": "0x7fff38e91400", "parentcaller": "0x7fff38e915e8", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "Outlook.Application" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\Outlook.Application" } ], "repeated": 0, "id": 5863 }, { "timestamp": "2026-05-29 01:05:24,024", "thread_id": "6204", "caller": "0x7fff38e9147f", "parentcaller": "0x7fff38e915e8", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "Outlook.Application.12" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\Outlook.Application.12" } ], "repeated": 0, "id": 5864 }, { "timestamp": "2026-05-29 01:05:24,024", "thread_id": "6204", "caller": "0x7fff38e914b7", "parentcaller": "0x7fff38e915e8", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "Outlook.Application.11" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\Outlook.Application.11" } ], "repeated": 0, "id": 5865 }, { "timestamp": "2026-05-29 01:05:24,024", "thread_id": "6204", "caller": "0x7fff38e914f3", "parentcaller": "0x7fff38e915e8", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "Outlook.Application.10" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\Outlook.Application.10" } ], "repeated": 0, "id": 5866 }, { "timestamp": "2026-05-29 01:05:24,040", "thread_id": "5000", "caller": "0x7fff5486cf1d", "parentcaller": "0x7fff4075ad28", "category": "system", "api": "GetSystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 3, "id": 5867 }, { "timestamp": "2026-05-29 01:05:24,087", "thread_id": "4504", "caller": "0x7fff457f5d68", "parentcaller": "0x7fff59f60ebc", "category": "registry", "api": "RegNotifyChangeKeyValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Deployment\\Package\\*\\S-1-5-21-3968686040-3210279463-847977608-1001\\{8BE3BA15-80C6-4702-A853-5D58F0944DF1}\\" }, { "name": "NotifyFilter", "value": "0x10000005" }, { "name": "WatchSubtree", "value": "1" }, { "name": "Asynchronous", "value": "1" } ], "repeated": 0, "id": 5868 }, { "timestamp": "2026-05-29 01:05:24,087", "thread_id": "4504", "caller": "0x7fff457f3fdd", "parentcaller": "0x7fff457f4c90", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000564" }, { "name": "ValueName", "value": "Version" }, { "name": "Data", "value": "\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Deployment\\Package\\*\\S-1-5-21-3968686040-3210279463-847977608-1001\\{8BE3BA15-80C6-4702-A853-5D58F0944DF1}\\Version" } ], "repeated": 0, "id": 5869 }, { "timestamp": "2026-05-29 01:05:24,102", "thread_id": "6164", "caller": "0x7fff457f5d68", "parentcaller": "0x7fff59f60ebc", "category": "registry", "api": "RegNotifyChangeKeyValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Deployment\\Package\\*\\S-1-5-21-3968686040-3210279463-847977608-1001\\{8BE3BA15-80C6-4702-A853-5D58F0944DF1}\\" }, { "name": "NotifyFilter", "value": "0x10000005" }, { "name": "WatchSubtree", "value": "1" }, { "name": "Asynchronous", "value": "1" } ], "repeated": 0, "id": 5870 }, { "timestamp": "2026-05-29 01:05:24,102", "thread_id": "6164", "caller": "0x7fff457f3fdd", "parentcaller": "0x7fff457f4c90", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000564" }, { "name": "ValueName", "value": "Version" }, { "name": "Data", "value": "\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Deployment\\Package\\*\\S-1-5-21-3968686040-3210279463-847977608-1001\\{8BE3BA15-80C6-4702-A853-5D58F0944DF1}\\Version" } ], "repeated": 0, "id": 5871 }, { "timestamp": "2026-05-29 01:05:24,102", "thread_id": "4504", "caller": "0x7fff457f5d68", "parentcaller": "0x7fff59f60ebc", "category": "registry", "api": "RegNotifyChangeKeyValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Deployment\\Package\\*\\S-1-5-21-3968686040-3210279463-847977608-1001\\{8BE3BA15-80C6-4702-A853-5D58F0944DF1}\\" }, { "name": "NotifyFilter", "value": "0x10000005" }, { "name": "WatchSubtree", "value": "1" }, { "name": "Asynchronous", "value": "1" } ], "repeated": 0, "id": 5872 }, { "timestamp": "2026-05-29 01:05:24,102", "thread_id": "4504", "caller": "0x7fff457f3fdd", "parentcaller": "0x7fff457f4c90", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000564" }, { "name": "ValueName", "value": "Version" }, { "name": "Data", "value": "\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Deployment\\Package\\*\\S-1-5-21-3968686040-3210279463-847977608-1001\\{8BE3BA15-80C6-4702-A853-5D58F0944DF1}\\Version" } ], "repeated": 0, "id": 5873 }, { "timestamp": "2026-05-29 01:05:24,133", "thread_id": "4504", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff584c8ce0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "ck\\x0c\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x02\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\xa2\\x11\\x05\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5874 }, { "timestamp": "2026-05-29 01:05:24,133", "thread_id": "4504", "caller": "0x7fff577d6785", "parentcaller": "0x7fff584c8c8a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001aa8" } ], "repeated": 0, "id": 5875 }, { "timestamp": "2026-05-29 01:05:24,133", "thread_id": "4504", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff584fb0ca", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5876 }, { "timestamp": "2026-05-29 01:05:24,133", "thread_id": "4504", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 5877 }, { "timestamp": "2026-05-29 01:05:24,133", "thread_id": "4504", "caller": "0x7fff584d7b74", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000034a" }, { "name": "SubKey", "value": "CLSID\\{C2F03A33-21F5-47FA-B4BB-156362A2F239}" }, { "name": "Handle", "value": "0x00001aaa" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{C2F03A33-21F5-47FA-B4BB-156362A2F239}" } ], "repeated": 0, "id": 5878 }, { "timestamp": "2026-05-29 01:05:24,133", "thread_id": "4504", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001aaa" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{c2f03a33-21f5-47fa-b4bb-156362a2f239}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5879 }, { "timestamp": "2026-05-29 01:05:24,133", "thread_id": "4504", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001aaa" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5880 }, { "timestamp": "2026-05-29 01:05:24,133", "thread_id": "4504", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x00\\xc6F\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\xaa\\x1a\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc7F\n\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5881 }, { "timestamp": "2026-05-29 01:05:24,133", "thread_id": "4504", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{c2f03a33-21f5-47fa-b4bb-156362a2f239}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{c2f03a33-21f5-47fa-b4bb-156362a2f239}\\TreatAs" } ], "repeated": 0, "id": 5882 }, { "timestamp": "2026-05-29 01:05:24,133", "thread_id": "4504", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001aaa" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5883 }, { "timestamp": "2026-05-29 01:05:24,133", "thread_id": "4504", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00001aaa" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c2f03a33-21f5-47fa-b4bb-156362a2f239}\\TreatAs" } ], "repeated": 0, "id": 5884 }, { "timestamp": "2026-05-29 01:05:24,133", "thread_id": "4504", "caller": "0x7fff585622e1", "parentcaller": "0x7fff584d7c1d", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001aaa" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{c2f03a33-21f5-47fa-b4bb-156362a2f239}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5885 }, { "timestamp": "2026-05-29 01:05:24,133", "thread_id": "4504", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d81f5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001aaa" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c2f03a33-21f5-47fa-b4bb-156362a2f239}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 5886 }, { "timestamp": "2026-05-29 01:05:24,133", "thread_id": "4504", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001aaa" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c2f03a33-21f5-47fa-b4bb-156362a2f239}\\(Default)" } ], "repeated": 0, "id": 5887 }, { "timestamp": "2026-05-29 01:05:24,133", "thread_id": "4504", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001aaa" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "Immersive Shell" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c2f03a33-21f5-47fa-b4bb-156362a2f239}\\(Default)" } ], "repeated": 0, "id": 5888 }, { "timestamp": "2026-05-29 01:05:24,133", "thread_id": "4504", "caller": "0x7fff584d8485", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00001aaa" }, { "name": "SubKey", "value": "InprocServer32" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c2f03a33-21f5-47fa-b4bb-156362a2f239}\\InprocServer32" } ], "repeated": 0, "id": 5889 }, { "timestamp": "2026-05-29 01:05:24,133", "thread_id": "4504", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001aaa" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{c2f03a33-21f5-47fa-b4bb-156362a2f239}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5890 }, { "timestamp": "2026-05-29 01:05:24,133", "thread_id": "4504", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001aaa" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5891 }, { "timestamp": "2026-05-29 01:05:24,133", "thread_id": "4504", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x90\\xc4F\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\xaa\\x1a\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xc5F\n\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5892 }, { "timestamp": "2026-05-29 01:05:24,133", "thread_id": "4504", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{c2f03a33-21f5-47fa-b4bb-156362a2f239}\\InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{c2f03a33-21f5-47fa-b4bb-156362a2f239}\\InprocHandler32" } ], "repeated": 0, "id": 5893 }, { "timestamp": "2026-05-29 01:05:24,133", "thread_id": "4504", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001aaa" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5894 }, { "timestamp": "2026-05-29 01:05:24,133", "thread_id": "4504", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00001aaa" }, { "name": "ObjectAttributesName", "value": "InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c2f03a33-21f5-47fa-b4bb-156362a2f239}\\InprocHandler32" } ], "repeated": 0, "id": 5895 }, { "timestamp": "2026-05-29 01:05:24,133", "thread_id": "4504", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001aaa" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{c2f03a33-21f5-47fa-b4bb-156362a2f239}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5896 }, { "timestamp": "2026-05-29 01:05:24,133", "thread_id": "4504", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001aaa" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5897 }, { "timestamp": "2026-05-29 01:05:24,133", "thread_id": "4504", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x90\\xc4F\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\xaa\\x1a\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xc5F\n\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5898 }, { "timestamp": "2026-05-29 01:05:24,133", "thread_id": "4504", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{c2f03a33-21f5-47fa-b4bb-156362a2f239}\\InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{c2f03a33-21f5-47fa-b4bb-156362a2f239}\\InprocHandler" } ], "repeated": 0, "id": 5899 }, { "timestamp": "2026-05-29 01:05:24,133", "thread_id": "4504", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001aaa" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5900 }, { "timestamp": "2026-05-29 01:05:24,133", "thread_id": "4504", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00001aaa" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c2f03a33-21f5-47fa-b4bb-156362a2f239}\\InprocHandler" } ], "repeated": 0, "id": 5901 }, { "timestamp": "2026-05-29 01:05:24,133", "thread_id": "4504", "caller": "0x7fff584d8010", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001aaa" } ], "repeated": 0, "id": 5902 }, { "timestamp": "2026-05-29 01:05:24,133", "thread_id": "4504", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 4, "id": 5903 }, { "timestamp": "2026-05-29 01:05:24,133", "thread_id": "5000", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff5854fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000033a" }, { "name": "SubKey", "value": "Interface\\{3E90BC6D-F3D9-4E87-94EC-BB0819D7CDBF}" }, { "name": "Handle", "value": "0x000022fe" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{3E90BC6D-F3D9-4E87-94EC-BB0819D7CDBF}" } ], "repeated": 0, "id": 5904 }, { "timestamp": "2026-05-29 01:05:24,133", "thread_id": "5000", "caller": "0x7fff5854fa51", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000022fe" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x000024da" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{3E90BC6D-F3D9-4E87-94EC-BB0819D7CDBF}\\ProxyStubClsid32" } ], "repeated": 0, "id": 5905 }, { "timestamp": "2026-05-29 01:05:24,133", "thread_id": "5000", "caller": "0x7fff5854fa8c", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024da" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{3E90BC6D-F3D9-4E87-94EC-BB0819D7CDBF}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 5906 }, { "timestamp": "2026-05-29 01:05:24,133", "thread_id": "5000", "caller": "0x7fff5854fad3", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024da" } ], "repeated": 0, "id": 5907 }, { "timestamp": "2026-05-29 01:05:24,133", "thread_id": "5000", "caller": "0x7fff5854fae4", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022fe" } ], "repeated": 0, "id": 5908 }, { "timestamp": "2026-05-29 01:05:24,133", "thread_id": "5000", "caller": "0x7fff584d7b74", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000034a" }, { "name": "SubKey", "value": "CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "Handle", "value": "0x000022fe" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" } ], "repeated": 0, "id": 5909 }, { "timestamp": "2026-05-29 01:05:24,133", "thread_id": "5000", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000022fe" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5910 }, { "timestamp": "2026-05-29 01:05:24,133", "thread_id": "5000", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000022fe" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5911 }, { "timestamp": "2026-05-29 01:05:24,133", "thread_id": "5000", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "p\\xcd\\x19\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\xfe\"\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xce\\x19\\x08\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5912 }, { "timestamp": "2026-05-29 01:05:24,133", "thread_id": "5000", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\TreatAs" } ], "repeated": 0, "id": 5913 }, { "timestamp": "2026-05-29 01:05:24,133", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000022fe" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5914 }, { "timestamp": "2026-05-29 01:05:24,133", "thread_id": "5000", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000022fe" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\TreatAs" } ], "repeated": 0, "id": 5915 }, { "timestamp": "2026-05-29 01:05:24,133", "thread_id": "5000", "caller": "0x7fff585622e1", "parentcaller": "0x7fff584d7c1d", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000022fe" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5916 }, { "timestamp": "2026-05-29 01:05:24,133", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d81f5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000022fe" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 5917 }, { "timestamp": "2026-05-29 01:05:24,133", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022fe" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)" } ], "repeated": 0, "id": 5918 }, { "timestamp": "2026-05-29 01:05:24,133", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022fe" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "PSFactoryBuffer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)" } ], "repeated": 0, "id": 5919 }, { "timestamp": "2026-05-29 01:05:24,133", "thread_id": "5000", "caller": "0x7fff584d8485", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000022fe" }, { "name": "SubKey", "value": "InprocServer32" }, { "name": "Handle", "value": "0x000024da" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocServer32" } ], "repeated": 0, "id": 5920 }, { "timestamp": "2026-05-29 01:05:24,133", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000024da" }, { "name": "ValueName", "value": "InprocServer32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\InprocServer32" } ], "repeated": 0, "id": 5921 }, { "timestamp": "2026-05-29 01:05:24,133", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024da" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 5922 }, { "timestamp": "2026-05-29 01:05:24,133", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024da" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "C:\\Windows\\System32\\OneCoreUAPCommonProxyStub.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 5923 }, { "timestamp": "2026-05-29 01:05:24,133", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d8d32", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024da" }, { "name": "ValueName", "value": "ThreadingModel" }, { "name": "Data", "value": "Both" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\ThreadingModel" } ], "repeated": 0, "id": 5924 }, { "timestamp": "2026-05-29 01:05:24,133", "thread_id": "5000", "caller": "0x7fff584d855f", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024da" } ], "repeated": 0, "id": 5925 }, { "timestamp": "2026-05-29 01:05:24,133", "thread_id": "5000", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000022fe" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5926 }, { "timestamp": "2026-05-29 01:05:24,133", "thread_id": "5000", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000022fe" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5927 }, { "timestamp": "2026-05-29 01:05:24,133", "thread_id": "5000", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x00\\xcc\\x19\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\xfe\"\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xcd\\x19\\x08\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5928 }, { "timestamp": "2026-05-29 01:05:24,133", "thread_id": "5000", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler32" } ], "repeated": 0, "id": 5929 }, { "timestamp": "2026-05-29 01:05:24,133", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000022fe" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5930 }, { "timestamp": "2026-05-29 01:05:24,133", "thread_id": "5000", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000022fe" }, { "name": "ObjectAttributesName", "value": "InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler32" } ], "repeated": 0, "id": 5931 }, { "timestamp": "2026-05-29 01:05:24,133", "thread_id": "5000", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000022fe" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5932 }, { "timestamp": "2026-05-29 01:05:24,133", "thread_id": "5000", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000022fe" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5933 }, { "timestamp": "2026-05-29 01:05:24,133", "thread_id": "5000", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x00\\xcc\\x19\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\xfe\"\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xcd\\x19\\x08\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5934 }, { "timestamp": "2026-05-29 01:05:24,133", "thread_id": "5000", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler" } ], "repeated": 0, "id": 5935 }, { "timestamp": "2026-05-29 01:05:24,133", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000022fe" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5936 }, { "timestamp": "2026-05-29 01:05:24,133", "thread_id": "5000", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000022fe" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler" } ], "repeated": 0, "id": 5937 }, { "timestamp": "2026-05-29 01:05:24,133", "thread_id": "5000", "caller": "0x7fff584d8010", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022fe" } ], "repeated": 0, "id": 5938 }, { "timestamp": "2026-05-29 01:05:24,133", "thread_id": "5000", "caller": "0x7fff59f93f7a", "parentcaller": "0x7fff59770ed7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5939 }, { "timestamp": "2026-05-29 01:05:24,133", "thread_id": "5000", "caller": "0x7fff59770cd1", "parentcaller": "0x7fff5976f28f", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x000022fc" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 5940 }, { "timestamp": "2026-05-29 01:05:24,133", "thread_id": "5000", "caller": "0x7fff5781026b", "parentcaller": "0x7fff59770daf", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000024d8" } ], "repeated": 0, "id": 5941 }, { "timestamp": "2026-05-29 01:05:24,133", "thread_id": "5000", "caller": "0x7fff59f88cde", "parentcaller": "0x7fff59fc9c4e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": " \\xf1\\x02\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5942 }, { "timestamp": "2026-05-29 01:05:24,133", "thread_id": "5000", "caller": "0x7fff59fb6e46", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\xd8\\x04p\\x0c\\x00\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x98\\xac\\xe3R\\xff\\x7f\\x00\\x00w\\x00i\\x00n\\x003\\x002\\x00k\\x00-\\x00m\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00e\\x00r\\x00-\\x00l\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xac\\xe3R" } ], "repeated": 0, "id": 5943 }, { "timestamp": "2026-05-29 01:05:24,133", "thread_id": "5000", "caller": "0x7fff59fb6e9b", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xa0\\x05p\\x0c\\x00\\x00\\x00\\x00`\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\xff\\x7f\\x00\\x00\\x9f\\xe8\\x08\\x00+\\x10H`\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00m\\x00p\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x0e\\xe4R\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5944 }, { "timestamp": "2026-05-29 01:05:24,133", "thread_id": "5000", "caller": "0x7fff59fb6ec0", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 5945 }, { "timestamp": "2026-05-29 01:05:24,133", "thread_id": "5000", "caller": "0x7fff59fb6f0e", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "x\\x83v\\x0c\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 5946 }, { "timestamp": "2026-05-29 01:05:24,133", "thread_id": "5000", "caller": "0x7fff59fb6f37", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 5947 }, { "timestamp": "2026-05-29 01:05:24,133", "thread_id": "5000", "caller": "0x7fff59fb6f8f", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "x\\xf2o\\x0c\\x00\\x00\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 5948 }, { "timestamp": "2026-05-29 01:05:24,133", "thread_id": "5000", "caller": "0x7fff59fb7048", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x81\\x1a\\xff\\x7f\\x00\\x00\\xebPY\\x1a\\xff\\x7f\\x00\\x00\\x98>\\x13r^t\\x00\\x00(N}\\x1a\\xff\\x7f\\x00\\x00\\xc0\\xdb\\x19\\x08\\x00\\x00\\x00\\x00\\xb8\\xdb\\x19\\x08\\x00\\x00\\x00\\x00\\x88\\xdb\\x19\\x08\\x00\\x00\\x00\\x00\\xa8\\xdb\\x19\\x08" } ], "repeated": 0, "id": 5949 }, { "timestamp": "2026-05-29 01:05:24,133", "thread_id": "5000", "caller": "0x7fff59fb707b", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xf2o\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8Z\\x1a\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xa8\\xd9\\x19\\x08\\x00\\x00\\x00\\x00\\xd8$\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00$\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2}\\x1a" } ], "repeated": 0, "id": 5950 }, { "timestamp": "2026-05-29 01:05:24,133", "thread_id": "5000", "caller": "0x7fff59f88cde", "parentcaller": "0x7fff59f8953a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": " \\xf1\\x02\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5951 }, { "timestamp": "2026-05-29 01:05:24,133", "thread_id": "5000", "caller": "0x7fff59fb6e46", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\xd8\\xf8o\\x0c\\x00\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x04]\\x88\\x8a\\xeb\\x1c\\xc9\\x11\\x9f\\xe8\\x08\\x00+\\x10H`\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00-\\x00l\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'\\x00\\x00\\x00" } ], "repeated": 0, "id": 5952 }, { "timestamp": "2026-05-29 01:05:24,133", "thread_id": "5000", "caller": "0x7fff59fb6e9b", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\x80\\xf8o\\x0c\\x00\\x00\\x00\\x00`\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\xff\\x7f\\x00\\x00\\x9f\\xe8\\x08\\x00+\\x10H`\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa8B\\xe4R\\xff\\x7f\\x00\\x00\\x00\\x00\\xa0C" } ], "repeated": 0, "id": 5953 }, { "timestamp": "2026-05-29 01:05:24,133", "thread_id": "5000", "caller": "0x7fff59fb6ec0", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 5954 }, { "timestamp": "2026-05-29 01:05:24,133", "thread_id": "5000", "caller": "0x7fff59fb6f0e", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\x88\\x88v\\x0c\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 5955 }, { "timestamp": "2026-05-29 01:05:24,133", "thread_id": "5000", "caller": "0x7fff59fb6f37", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 5956 }, { "timestamp": "2026-05-29 01:05:24,133", "thread_id": "5000", "caller": "0x7fff59fb6f8f", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xf8\\x05p\\x0c\\x00\\x00\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 5957 }, { "timestamp": "2026-05-29 01:05:24,133", "thread_id": "5000", "caller": "0x7fff59fb7048", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x81\\x1a\\xff\\x7f\\x00\\x00\\xebPY\\x1a\\xff\\x7f\\x00\\x00x\"\\x13r^t\\x00\\x00(N}\\x1a\\xff\\x7f\\x00\\x00 \\xd8\\x19\\x08\\x00\\x00\\x00\\x00\\x18\\xd8\\x19\\x08\\x00\\x00\\x00\\x00\\xe8\\xd7\\x19\\x08\\x00\\x00\\x00\\x00\\x08\\xd8\\x19\\x08" } ], "repeated": 0, "id": 5958 }, { "timestamp": "2026-05-29 01:05:24,133", "thread_id": "5000", "caller": "0x7fff59fb707b", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\x05p\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8Z\\x1a\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x08\\xd6\\x19\\x08\\x00\\x00\\x00\\x00\\xd8$\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00$\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2}\\x1a" } ], "repeated": 0, "id": 5959 }, { "timestamp": "2026-05-29 01:05:24,133", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff59770e27", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022fc" } ], "repeated": 0, "id": 5960 }, { "timestamp": "2026-05-29 01:05:24,133", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff59770e49", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024d8" } ], "repeated": 0, "id": 5961 }, { "timestamp": "2026-05-29 01:05:24,133", "thread_id": "4504", "caller": "0x7fff58520e98", "parentcaller": "0x7fff5859b785", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 2, "id": 5962 }, { "timestamp": "2026-05-29 01:05:24,212", "thread_id": "4504", "caller": "0x7fff5855dd9d", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000024d8" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000430" }, { "name": "ObjectAttributesName", "value": "Windows.Internal.StateRepository.PrimaryTileUserChangedEventArgs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.PrimaryTileUserChangedEventArgs" } ], "repeated": 0, "id": 5963 }, { "timestamp": "2026-05-29 01:05:24,212", "thread_id": "4504", "caller": "0x7fff5855ddf7", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000024d8" }, { "name": "KeyInformation", "value": "7_\\xffea\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00I\\x00n\\x00t\\x00e\\x00r\\x00n\\x00a\\x00l\\x00.\\x00S\\x00t\\x00a\\x00t\\x00e\\x00R\\x00e\\x00p\\x00o\\x00s\\x00i\\x00t\\x00o\\x00r\\x00y\\x00.\\x00P\\x00r\\x00i\\x00m\\x00a\\x00r\\x00y\\x00T\\x00i\\x00l\\x00e\\x00U\\x00s\\x00e\\x00r\\x00C\\x00h\\x00a\\x00n\\x00g\\x00e\\x00d\\x00E\\x00v\\x00e\\x00n\\x00t\\x00A\\x00r\\x00g\\x00s\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffc0\\xff8a%\\x01\\x00\\x00\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\xffc4\\x02%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \r%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0EzX\\xffff\\x7f\\x00\\x00\\xff88\\xffb0\\xffb1\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff0\\xffeaF\n\\x00\\x00\\x00\\x00\\xff87\\xff9dNX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff0\\xffbc\\xffb1\\x0c\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xffb0\\xffb1\\x0c\\x00\\x00\\x00\\x00\\xfff0\\xffbc\\xffb1\\x0c\\x00\\x00\\x00\\x00\\xffb0\\xff80\\xffa8\\x0c\\x00\\x00\\x00\\x00\\xffc7\\xffb3\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\xfff6sNX\\xffff\\x7f\\x00\\x000\\xffdc\\xffb1\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffb0\\xff80\\xffa8\\x0c\\x00\\x00\\x00\\x00Pw\\xffb1\\x0c\\x00\\x00\\x00\\x00Pw\\xffb1\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff0\\xffbc\\xffb1\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x006\\xff8cYX\\xffff\\x7f\\x00\\x00\\xfff0\\xffa4\\xffbf\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffe0\\xffebF\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffe0\\xffebF\n\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 5964 }, { "timestamp": "2026-05-29 01:05:24,212", "thread_id": "6164", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002440" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.PrimaryTileUserChangedEventArgs\\ActivationType" } ], "repeated": 0, "id": 5965 }, { "timestamp": "2026-05-29 01:05:24,212", "thread_id": "6164", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002440" }, { "name": "ValueName", "value": "Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.PrimaryTileUserChangedEventArgs\\Server" } ], "repeated": 0, "id": 5966 }, { "timestamp": "2026-05-29 01:05:24,212", "thread_id": "4504", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff585700bb", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024d8" }, { "name": "ValueName", "value": "DllPath" }, { "name": "Data", "value": "C:\\Windows\\System32\\Windows.StateRepositoryClient.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.PrimaryTileUserChangedEventArgs\\DllPath" } ], "repeated": 0, "id": 5967 }, { "timestamp": "2026-05-29 01:05:24,212", "thread_id": "6164", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff585700bb", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002440" }, { "name": "ValueName", "value": "DllPath" }, { "name": "Data", "value": "C:\\Windows\\System32\\Windows.StateRepositoryClient.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.PrimaryTileUserChangedEventArgs\\DllPath" } ], "repeated": 0, "id": 5968 }, { "timestamp": "2026-05-29 01:05:24,212", "thread_id": "4504", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024d8" }, { "name": "ValueName", "value": "Threading" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.PrimaryTileUserChangedEventArgs\\Threading" } ], "repeated": 0, "id": 5969 }, { "timestamp": "2026-05-29 01:05:24,212", "thread_id": "6164", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002440" }, { "name": "ValueName", "value": "Threading" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.PrimaryTileUserChangedEventArgs\\Threading" } ], "repeated": 0, "id": 5970 }, { "timestamp": "2026-05-29 01:05:24,212", "thread_id": "4504", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024d8" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.PrimaryTileUserChangedEventArgs\\TrustLevel" } ], "repeated": 0, "id": 5971 }, { "timestamp": "2026-05-29 01:05:24,212", "thread_id": "6164", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002440" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.PrimaryTileUserChangedEventArgs\\TrustLevel" } ], "repeated": 0, "id": 5972 }, { "timestamp": "2026-05-29 01:05:24,212", "thread_id": "4504", "caller": "0x7fff584bc0fc", "parentcaller": "0x7fff58554170", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000024d8" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.PrimaryTileUserChangedEventArgs\\CustomAttributes" } ], "repeated": 0, "id": 5973 }, { "timestamp": "2026-05-29 01:05:24,212", "thread_id": "6164", "caller": "0x7fff584bc0fc", "parentcaller": "0x7fff58554170", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00002440" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.PrimaryTileUserChangedEventArgs\\CustomAttributes" } ], "repeated": 0, "id": 5974 }, { "timestamp": "2026-05-29 01:05:24,212", "thread_id": "4504", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000024d8" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.PrimaryTileUserChangedEventArgs\\ActivateAsUser" } ], "repeated": 0, "id": 5975 }, { "timestamp": "2026-05-29 01:05:24,212", "thread_id": "6164", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002440" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.PrimaryTileUserChangedEventArgs\\ActivateAsUser" } ], "repeated": 0, "id": 5976 }, { "timestamp": "2026-05-29 01:05:24,212", "thread_id": "4504", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000024d8" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.PrimaryTileUserChangedEventArgs\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 5977 }, { "timestamp": "2026-05-29 01:05:24,212", "thread_id": "6164", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58562222", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002440" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.PrimaryTileUserChangedEventArgs\\Permissions" } ], "repeated": 0, "id": 5978 }, { "timestamp": "2026-05-29 01:05:24,212", "thread_id": "4504", "caller": "0x7fff58557226", "parentcaller": "0x7fff5855ca23", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024d8" } ], "repeated": 0, "id": 5979 }, { "timestamp": "2026-05-29 01:05:24,212", "thread_id": "6164", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002440" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.PrimaryTileUserChangedEventArgs\\ActivateOnHostFlags" } ], "repeated": 0, "id": 5980 }, { "timestamp": "2026-05-29 01:05:24,212", "thread_id": "6164", "caller": "0x7fff58557226", "parentcaller": "0x7fff5855ca23", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002440" } ], "repeated": 0, "id": 5981 }, { "timestamp": "2026-05-29 01:05:24,212", "thread_id": "4504", "caller": "0x7fff5855dd9d", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000024d8" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000430" }, { "name": "ObjectAttributesName", "value": "Windows.Internal.StateRepository.TileViewQueryFilter" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileViewQueryFilter" } ], "repeated": 0, "id": 5982 }, { "timestamp": "2026-05-29 01:05:24,212", "thread_id": "4504", "caller": "0x7fff5855ddf7", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000024d8" }, { "name": "KeyInformation", "value": "\\xfffci\\x0e\\xffd4\\xffde\\xffac\\xffd5\\x01\\x00\\x00\\x00\\x00h\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00I\\x00n\\x00t\\x00e\\x00r\\x00n\\x00a\\x00l\\x00.\\x00S\\x00t\\x00a\\x00t\\x00e\\x00R\\x00e\\x00p\\x00o\\x00s\\x00i\\x00t\\x00o\\x00r\\x00y\\x00.\\x00T\\x00i\\x00l\\x00e\\x00V\\x00i\\x00e\\x00w\\x00Q\\x00u\\x00e\\x00r\\x00y\\x00F\\x00i\\x00l\\x00t\\x00e\\x00r\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x15\\x01\\x00\\x00\\x00\\x00\\xfff9\\xffe6F\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffc0\\xff8a%\\x01\\x00\\x00\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\xffc4\\x02%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \r%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0EzX\\xffff\\x7f\\x00\\x00\\xffb8\\xff92\\xffb1\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xffe7F\n\\x00\\x00\\x00\\x00\\xff87\\xff9dNX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xffb0\\xffb1\\x0c\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\xff92\\xffb1\\x0c\\x00\\x00\\x00\\x00`\\xffb0\\xffb1\\x0c\\x00\\x00\\x00\\x000\\xff89\\xffa8\\x0c\\x00\\x00\\x00\\x00\\xffc7\\xffb3\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\xfff6sNX\\xffff\\x7f\\x00\\x000\\xffd1\\xffb1\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff0\\xff89\\xffa8\\x0c\\x00\\x00\\x00\\x00 |\\xffb1\\x0c\\x00\\x00\\x00\\x00 |\\xffb1\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xffb0\\xffb1\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x006\\xff8cYX\\xffff\\x7f\\x00\\x00@\\xffa0\\xffbf\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffc0\\xffe8F\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffc0\\xffe8F\n\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 5983 }, { "timestamp": "2026-05-29 01:05:24,212", "thread_id": "4504", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024d8" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileViewQueryFilter\\ActivationType" } ], "repeated": 0, "id": 5984 }, { "timestamp": "2026-05-29 01:05:24,212", "thread_id": "4504", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024d8" }, { "name": "ValueName", "value": "Server" }, { "name": "Data", "value": "StateRepository" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileViewQueryFilter\\Server" } ], "repeated": 0, "id": 5985 }, { "timestamp": "2026-05-29 01:05:24,212", "thread_id": "4504", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff585700bb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000024d8" }, { "name": "ValueName", "value": "DllPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileViewQueryFilter\\DllPath" } ], "repeated": 0, "id": 5986 }, { "timestamp": "2026-05-29 01:05:24,212", "thread_id": "4504", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000024d8" }, { "name": "ValueName", "value": "Threading" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileViewQueryFilter\\Threading" } ], "repeated": 0, "id": 5987 }, { "timestamp": "2026-05-29 01:05:24,212", "thread_id": "6164", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x18\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6164" } ], "repeated": 0, "id": 5988 }, { "timestamp": "2026-05-29 01:05:24,212", "thread_id": "4504", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024d8" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileViewQueryFilter\\TrustLevel" } ], "repeated": 0, "id": 5989 }, { "timestamp": "2026-05-29 01:05:24,212", "thread_id": "4504", "caller": "0x7fff584bc0fc", "parentcaller": "0x7fff58554170", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000024d8" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileViewQueryFilter\\CustomAttributes" } ], "repeated": 0, "id": 5990 }, { "timestamp": "2026-05-29 01:05:24,212", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 5991 }, { "timestamp": "2026-05-29 01:05:24,212", "thread_id": "4504", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000024d8" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileViewQueryFilter\\RemoteServer" } ], "repeated": 0, "id": 5992 }, { "timestamp": "2026-05-29 01:05:24,212", "thread_id": "4504", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000024d8" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileViewQueryFilter\\ActivateAsUser" } ], "repeated": 0, "id": 5993 }, { "timestamp": "2026-05-29 01:05:24,212", "thread_id": "4504", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000024d8" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileViewQueryFilter\\ActivateInSharedBroker" } ], "repeated": 0, "id": 5994 }, { "timestamp": "2026-05-29 01:05:24,212", "thread_id": "4504", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000024d8" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileViewQueryFilter\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 5995 }, { "timestamp": "2026-05-29 01:05:24,212", "thread_id": "4504", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58562222", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000024d8" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileViewQueryFilter\\Permissions" } ], "repeated": 0, "id": 5996 }, { "timestamp": "2026-05-29 01:05:24,212", "thread_id": "4504", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000024d8" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileViewQueryFilter\\ActivateOnHostFlags" } ], "repeated": 0, "id": 5997 }, { "timestamp": "2026-05-29 01:05:24,212", "thread_id": "4504", "caller": "0x7fff5855dd9d", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000022fc" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000434" }, { "name": "ObjectAttributesName", "value": "StateRepository" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository" } ], "repeated": 0, "id": 5998 }, { "timestamp": "2026-05-29 01:05:24,212", "thread_id": "4504", "caller": "0x7fff5855ddf7", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000022fc" }, { "name": "KeyInformation", "value": "\\xffcek|\\xffd3\\xffde\\xffac\\xffd5\\x01\\x00\\x00\\x00\\x00\\x1e\\x00\\x00\\x00S\\x00t\\x00a\\x00t\\x00e\\x00R\\x00e\\x00p\\x00o\\x00s\\x00i\\x00t\\x00o\\x00r\\x00y\\x00\\x00\\x00h\\x00\\x00\\x00\\x00\\x00\\x00\\x00k\\xffb8\\xfff7Y\\xffff\\x7f\\x00\\x00\\x07\\x00\\x01\\x00\\x02\\x00\\x00\\x00\\xff89\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xffe2\\x1f\\x01\\x00\\x00\\x00\\x00\\xffc7\\xffb3\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffc0\\xff8a%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\xffc4\\x02%\\x01\\x00\\x00\\x00\\x00\\xff80a%\\x01\\x00\\x00\\x00\\x00\\xff90\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \r%\\x01\\x00\\x00\\x00\\x00\\xffc0\\x02%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0CzX\\xffff\\x7f\\x00\\x00\\xfff8\\xff94\\xffb1\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\xffe4F\n\\x00\\x00\\x00\\x00\\xff87\\xff9dNX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xff9a\\xffbf\\x0b\\x00\\x00\\x00\\x00\\xffb0\\xffc4\\xffb1\\x0c\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xff94\\xffb1\\x0c\\x00\\x00\\x00\\x00P\\xff9a\\xffbf\\x0b\\x00\\x00\\x00\\x000\\xff88\\xffa8\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0\\xffc4\\xffb1\\x0c\\x00\\x00\\x00\\x00kjNX\\xffff\\x7f\\x00\\x00\\xfff0\\xff82\\xffa8\\x0c\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\xff83\\xffb1\\x0c\\x00\\x00\\x00\\x000\\xff88\\xffa8\\x0c\\x00\\x00\\x00\\x00 \\xff83\\xffb1\\x0c\\x00\\x00\\x00\\x00 \\xff83\\xffb1\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xff9a\\xffbf\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xff83\\xffb1\\x0c\\x00\\x00\\x00\\x00\\xffe3rNX\\xffff\\x7f\\x00\\x00\\xffd0\\xff94\\xffb1\\x0c\\x00\\x00\\x00\\x00h\\xffe5F\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\xff83\\xffb1\\x0c\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00E\\xffaeVX\\xffff\\x7f\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 5999 }, { "timestamp": "2026-05-29 01:05:24,212", "thread_id": "4504", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff585700bb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000022fc" }, { "name": "ValueName", "value": "ExePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ExePath" } ], "repeated": 0, "id": 6000 }, { "timestamp": "2026-05-29 01:05:24,212", "thread_id": "4504", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff585700bb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000022fc" }, { "name": "ValueName", "value": "CommandLine" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\CommandLine" } ], "repeated": 0, "id": 6001 }, { "timestamp": "2026-05-29 01:05:24,212", "thread_id": "4504", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022fc" }, { "name": "ValueName", "value": "IdentityType" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\IdentityType" } ], "repeated": 0, "id": 6002 }, { "timestamp": "2026-05-29 01:05:24,212", "thread_id": "4504", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58562222", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x000000ea", "arguments": [ { "name": "Handle", "value": "0x000022fc" }, { "name": "ValueName", "value": "Permissions" }, { "name": "Type", "value": "0x7fff00000003" }, { "name": "DataLength", "value": "184" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Permissions" } ], "repeated": 0, "id": 6003 }, { "timestamp": "2026-05-29 01:05:24,212", "thread_id": "4504", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58562222", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022fc" }, { "name": "ValueName", "value": "Permissions" }, { "name": "Data", "value": "\\x01\\x00\\x14\\x80\\x9c\\x00\\x00\\x00\\xa8\\x00\\x00\\x00\\x14\\x00\\x00\\x000\\x00\\x00\\x00\\x02\\x00\\x1c\\x00\\x01\\x00\\x00\\x00\\x11\\x00\\x14\\x00\\x04\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x10\\x00\\x00\\x02\\x00l\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x1f\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x1f\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x0f\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x008\\x00\\x1f\\x00\\x00\\x00\\x01\n\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\xceJ\\x93Y\\xb9\\xcf\\x0buu\\xc0\\xf2\\x9b\\xb2\\xb4\\xc2\\x98\\xd4F\\xdd\\xf9\\x02z\\x87\\xec\\x14e\\x11w\\xd6\\xe9\\x96U\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\n\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00!\\x02\\x00\\x00" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Permissions" } ], "repeated": 0, "id": 6004 }, { "timestamp": "2026-05-29 01:05:24,212", "thread_id": "4504", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58579d80", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000022fc" }, { "name": "ValueName", "value": "ActivatableClasses" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ActivatableClasses" } ], "repeated": 0, "id": 6005 }, { "timestamp": "2026-05-29 01:05:24,212", "thread_id": "4504", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022fc" }, { "name": "ValueName", "value": "ServerType" }, { "name": "Data", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ServerType" } ], "repeated": 0, "id": 6006 }, { "timestamp": "2026-05-29 01:05:24,212", "thread_id": "4504", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000022fc" }, { "name": "ValueName", "value": "AppId" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\AppId" } ], "repeated": 0, "id": 6007 }, { "timestamp": "2026-05-29 01:05:24,212", "thread_id": "4504", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022fc" }, { "name": "ValueName", "value": "Identity" }, { "name": "Data", "value": "nt authority\\system" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Identity" } ], "repeated": 0, "id": 6008 }, { "timestamp": "2026-05-29 01:05:24,212", "thread_id": "4504", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022fc" }, { "name": "ValueName", "value": "ServiceName" }, { "name": "Data", "value": "StateRepository" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ServiceName" } ], "repeated": 0, "id": 6009 }, { "timestamp": "2026-05-29 01:05:24,212", "thread_id": "4504", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000022fc" }, { "name": "ValueName", "value": "ExplicitPsmActivationType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ExplicitPsmActivationType" } ], "repeated": 0, "id": 6010 }, { "timestamp": "2026-05-29 01:05:24,212", "thread_id": "4504", "caller": "0x7fff584bc0fc", "parentcaller": "0x7fff58554170", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000022fc" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\CustomAttributes" } ], "repeated": 0, "id": 6011 }, { "timestamp": "2026-05-29 01:05:24,212", "thread_id": "4504", "caller": "0x7fff58557226", "parentcaller": "0x7fff5855ca23", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022fc" } ], "repeated": 0, "id": 6012 }, { "timestamp": "2026-05-29 01:05:24,212", "thread_id": "4504", "caller": "0x7fff58557226", "parentcaller": "0x7fff5855ca23", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024d8" } ], "repeated": 0, "id": 6013 }, { "timestamp": "2026-05-29 01:05:24,227", "thread_id": "4504", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 6014 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 6015 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "6164", "caller": "0x7fff457f5d68", "parentcaller": "0x7fff59f60ebc", "category": "registry", "api": "RegNotifyChangeKeyValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Deployment\\Package\\*\\S-1-5-21-3968686040-3210279463-847977608-1001\\{8BE3BA15-80C6-4702-A853-5D58F0944DF1}\\" }, { "name": "NotifyFilter", "value": "0x10000005" }, { "name": "WatchSubtree", "value": "1" }, { "name": "Asynchronous", "value": "1" } ], "repeated": 0, "id": 6016 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "6164", "caller": "0x7fff457f3fdd", "parentcaller": "0x7fff457f4c90", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000564" }, { "name": "ValueName", "value": "Version" }, { "name": "Data", "value": "\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Deployment\\Package\\*\\S-1-5-21-3968686040-3210279463-847977608-1001\\{8BE3BA15-80C6-4702-A853-5D58F0944DF1}\\Version" } ], "repeated": 0, "id": 6017 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "6156", "caller": "0x7ff79bcd3bb4", "parentcaller": "0x00000000", "category": "registry", "api": "RegNotifyChangeKeyValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\" }, { "name": "NotifyFilter", "value": "0x10000005" }, { "name": "WatchSubtree", "value": "1" }, { "name": "Asynchronous", "value": "1" } ], "repeated": 0, "id": 6018 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "5596", "caller": "0x7fff457f5d68", "parentcaller": "0x7fff59f60ebc", "category": "registry", "api": "RegNotifyChangeKeyValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Deployment\\Package\\*\\S-1-5-21-3968686040-3210279463-847977608-1001\\{8BE3BA15-80C6-4702-A853-5D58F0944DF1}\\" }, { "name": "NotifyFilter", "value": "0x10000005" }, { "name": "WatchSubtree", "value": "1" }, { "name": "Asynchronous", "value": "1" } ], "repeated": 0, "id": 6019 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "5596", "caller": "0x7fff457f3fdd", "parentcaller": "0x7fff457f4c90", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000564" }, { "name": "ValueName", "value": "Version" }, { "name": "Data", "value": "\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Deployment\\Package\\*\\S-1-5-21-3968686040-3210279463-847977608-1001\\{8BE3BA15-80C6-4702-A853-5D58F0944DF1}\\Version" } ], "repeated": 0, "id": 6020 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "6164", "caller": "0x7fff457f5d68", "parentcaller": "0x7fff59f60ebc", "category": "registry", "api": "RegNotifyChangeKeyValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Deployment\\Package\\*\\S-1-5-21-3968686040-3210279463-847977608-1001\\{8BE3BA15-80C6-4702-A853-5D58F0944DF1}\\" }, { "name": "NotifyFilter", "value": "0x10000005" }, { "name": "WatchSubtree", "value": "1" }, { "name": "Asynchronous", "value": "1" } ], "repeated": 0, "id": 6021 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "6156", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd15e8a", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 6022 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "6164", "caller": "0x7fff457f3fdd", "parentcaller": "0x7fff457f4c90", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000564" }, { "name": "ValueName", "value": "Version" }, { "name": "Data", "value": "\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Deployment\\Package\\*\\S-1-5-21-3968686040-3210279463-847977608-1001\\{8BE3BA15-80C6-4702-A853-5D58F0944DF1}\\Version" } ], "repeated": 0, "id": 6023 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "6156", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd15e8a", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6024 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "6156", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd15e8a", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002438" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search" } ], "repeated": 0, "id": 6025 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "6156", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd15e8a", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "BackgroundAppGlobalToggle" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\BackgroundAppGlobalToggle" } ], "repeated": 0, "id": 6026 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "6096", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002300" }, { "name": "ValueName", "value": "Server" }, { "name": "Data", "value": "StateRepository" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\Server" } ], "repeated": 0, "id": 6027 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "6096", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff585700bb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002300" }, { "name": "ValueName", "value": "DllPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\DllPath" } ], "repeated": 0, "id": 6028 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "6156", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd15e8a", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 6029 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "6096", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002300" }, { "name": "ValueName", "value": "Threading" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\Threading" } ], "repeated": 0, "id": 6030 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "6156", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd15e8a", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002438" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search" } ], "repeated": 0, "id": 6031 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "6156", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd15e8a", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "BackgroundAppGlobalToggle" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\BackgroundAppGlobalToggle" } ], "repeated": 0, "id": 6032 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "6096", "caller": "0x7fff584bc0fc", "parentcaller": "0x7fff58554170", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00002300" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\CustomAttributes" } ], "repeated": 0, "id": 6033 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "6096", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002300" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\RemoteServer" } ], "repeated": 0, "id": 6034 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 6035 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "6096", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002300" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\ActivateAsUser" } ], "repeated": 0, "id": 6036 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "6096", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002300" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\ActivateInSharedBroker" } ], "repeated": 0, "id": 6037 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "6096", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002300" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 6038 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "5000", "caller": "0x7fff42795e59", "parentcaller": "0x7fff42796b2e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Cortana" }, { "name": "Handle", "value": "0x000024d8" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Cortana" } ], "repeated": 0, "id": 6039 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "5000", "caller": "0x7fff42795e95", "parentcaller": "0x7fff42796b2e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024d8" }, { "name": "ValueName", "value": "IsAvailable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Cortana\\IsAvailable" } ], "repeated": 0, "id": 6040 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "6096", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58562222", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002300" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\Permissions" } ], "repeated": 0, "id": 6041 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "5000", "caller": "0x7fff42795e59", "parentcaller": "0x7fff427a84f2", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Cortana" }, { "name": "Handle", "value": "0x000024d8" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Cortana" } ], "repeated": 0, "id": 6042 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "5000", "caller": "0x7fff42795e95", "parentcaller": "0x7fff427a84f2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000024d8" }, { "name": "ValueName", "value": "DevOverrideOneSettings" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Cortana\\DevOverrideOneSettings" } ], "repeated": 0, "id": 6043 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "5000", "caller": "0x7fff42795ece", "parentcaller": "0x7fff427a84f2", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024d8" } ], "repeated": 0, "id": 6044 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "5000", "caller": "0x7fff5855dd9d", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000024d8" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000430" }, { "name": "ObjectAttributesName", "value": "Windows.Internal.StateRepository.Package" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package" } ], "repeated": 0, "id": 6045 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "6096", "caller": "0x7fff5855dd9d", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002438" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000434" }, { "name": "ObjectAttributesName", "value": "StateRepository" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository" } ], "repeated": 0, "id": 6046 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024d8" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\ActivationType" } ], "repeated": 0, "id": 6047 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "6096", "caller": "0x7fff5855ddf7", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002438" }, { "name": "KeyInformation", "value": "\\xffcek|\\xffd3\\xffde\\xffac\\xffd5\\x01\\x00\\x00\\x00\\x00\\x1e\\x00\\x00\\x00S\\x00t\\x00a\\x00t\\x00e\\x00R\\x00e\\x00p\\x00o\\x00s\\x00i\\x00t\\x00o\\x00r\\x00y\\x00\\x00\\x00h\\x00\\x00\\x00\\x00\\x00\\x00\\x00k\\xffb8\\xfff7Y\\xffff\\x7f\\x00\\x00\\x05\\x00\\x15\\x00\\x02\\x00\\x00\\x00\\xffc3\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xffa3\\xff89\\x0b\\x00\\x00\\x00\\x00\\xffc7\\xffb3\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff8a%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\xffc4\\x02%\\x01\\x00\\x00\\x00\\x00\\xffc0`%\\x01\\x00\\x00\\x00\\x00\\xff90\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff0\\x0c%\\x01\\x00\\x00\\x00\\x00\\xffc0\\x02%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0CzX\\xffff\\x7f\\x00\\x00(\"y\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0\\xffe5\\xfff2\\x02\\x00\\x00\\x00\\x00\\xff87\\xff9dNX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xffe2y\\x0c\\x00\\x00\\x00\\x00\\xffc0\\xff9d\\xffa7\\x0c\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"y\\x0c\\x00\\x00\\x00\\x00\\x10\\xffe2y\\x0c\\x00\\x00\\x00\\x00\\xffe0&\\xffeb\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffc0\\xff9d\\xffa7\\x0c\\x00\\x00\\x00\\x00kjNX\\xffff\\x7f\\x00\\x00\\xffa0\"\\xffeb\\x08\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x0003\\xffe5\\x08\\x00\\x00\\x00\\x00\\xffe0&\\xffeb\\x08\\x00\\x00\\x00\\x0003\\xffe5\\x08\\x00\\x00\\x00\\x0003\\xffe5\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xffe2y\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\x00\\x00\\x00\\x00\\x00`3\\xffe5\\x08\\x00\\x00\\x00\\x00\\xffe3rNX\\xffff\\x7f\\x00\\x00\\x00\"y\\x0c\\x00\\x00\\x00\\x00\\xfff8\\xffe6\\xfff2\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0003\\xffe5\\x08\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00E\\xffaeVX\\xffff\\x7f\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 6048 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "5000", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024d8" }, { "name": "ValueName", "value": "Server" }, { "name": "Data", "value": "StateRepository" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\Server" } ], "repeated": 0, "id": 6049 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "5000", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff585700bb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000024d8" }, { "name": "ValueName", "value": "DllPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\DllPath" } ], "repeated": 0, "id": 6050 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000024d8" }, { "name": "ValueName", "value": "Threading" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\Threading" } ], "repeated": 0, "id": 6051 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024d8" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\TrustLevel" } ], "repeated": 0, "id": 6052 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "5000", "caller": "0x7fff584bc0fc", "parentcaller": "0x7fff58554170", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000024d8" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\CustomAttributes" } ], "repeated": 0, "id": 6053 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "5000", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000024d8" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\RemoteServer" } ], "repeated": 0, "id": 6054 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000024d8" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\ActivateAsUser" } ], "repeated": 0, "id": 6055 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000024d8" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\ActivateInSharedBroker" } ], "repeated": 0, "id": 6056 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000024d8" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 6057 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58562222", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000024d8" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\Permissions" } ], "repeated": 0, "id": 6058 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000024d8" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\ActivateOnHostFlags" } ], "repeated": 0, "id": 6059 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "6096", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58579d80", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "ActivatableClasses" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ActivatableClasses" } ], "repeated": 0, "id": 6060 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "5000", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff585700bb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000022fc" }, { "name": "ValueName", "value": "ExePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ExePath" } ], "repeated": 0, "id": 6061 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "5000", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff585700bb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000022fc" }, { "name": "ValueName", "value": "CommandLine" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\CommandLine" } ], "repeated": 0, "id": 6062 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "6096", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "AppId" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\AppId" } ], "repeated": 0, "id": 6063 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022fc" }, { "name": "ValueName", "value": "IdentityType" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\IdentityType" } ], "repeated": 0, "id": 6064 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58562222", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x000000ea", "arguments": [ { "name": "Handle", "value": "0x000022fc" }, { "name": "ValueName", "value": "Permissions" }, { "name": "Type", "value": "0x7fff00000003" }, { "name": "DataLength", "value": "184" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Permissions" } ], "repeated": 0, "id": 6065 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "6096", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "Identity" }, { "name": "Data", "value": "nt authority\\system" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Identity" } ], "repeated": 0, "id": 6066 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58562222", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022fc" }, { "name": "ValueName", "value": "Permissions" }, { "name": "Data", "value": "\\x01\\x00\\x14\\x80\\x9c\\x00\\x00\\x00\\xa8\\x00\\x00\\x00\\x14\\x00\\x00\\x000\\x00\\x00\\x00\\x02\\x00\\x1c\\x00\\x01\\x00\\x00\\x00\\x11\\x00\\x14\\x00\\x04\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x10\\x00\\x00\\x02\\x00l\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x1f\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x1f\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x0f\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x008\\x00\\x1f\\x00\\x00\\x00\\x01\n\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\xceJ\\x93Y\\xb9\\xcf\\x0buu\\xc0\\xf2\\x9b\\xb2\\xb4\\xc2\\x98\\xd4F\\xdd\\xf9\\x02z\\x87\\xec\\x14e\\x11w\\xd6\\xe9\\x96U\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\n\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00!\\x02\\x00\\x00" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Permissions" } ], "repeated": 0, "id": 6067 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "5000", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58579d80", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000022fc" }, { "name": "ValueName", "value": "ActivatableClasses" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ActivatableClasses" } ], "repeated": 0, "id": 6068 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "6096", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "ExplicitPsmActivationType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ExplicitPsmActivationType" } ], "repeated": 0, "id": 6069 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "6096", "caller": "0x7fff584bc0fc", "parentcaller": "0x7fff58554170", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00002438" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\CustomAttributes" } ], "repeated": 0, "id": 6070 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "5000", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022fc" }, { "name": "ValueName", "value": "ServiceName" }, { "name": "Data", "value": "StateRepository" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ServiceName" } ], "repeated": 0, "id": 6071 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "6096", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 6072 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000022fc" }, { "name": "ValueName", "value": "ExplicitPsmActivationType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ExplicitPsmActivationType" } ], "repeated": 0, "id": 6073 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "6096", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002300" } ], "repeated": 0, "id": 6074 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "5000", "caller": "0x7fff584bc0fc", "parentcaller": "0x7fff58554170", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000022fc" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\CustomAttributes" } ], "repeated": 0, "id": 6075 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "6096", "caller": "0x7fff5855dd9d", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002300" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000430" }, { "name": "ObjectAttributesName", "value": "Windows.Internal.StateRepository.Package" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package" } ], "repeated": 0, "id": 6076 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "5000", "caller": "0x7fff58557226", "parentcaller": "0x7fff5855ca23", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024d8" } ], "repeated": 0, "id": 6077 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "6096", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002300" }, { "name": "KeyInformation", "value": "\\xfffci\\x0e\\xffd4\\xffde\\xffac\\xffd5\\x01\\x00\\x00\\x00\\x00P\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00I\\x00n\\x00t\\x00e\\x00r\\x00n\\x00a\\x00l\\x00.\\x00S\\x00t\\x00a\\x00t\\x00e\\x00R\\x00e\\x00p\\x00o\\x00s\\x00i\\x00t\\x00o\\x00r\\x00y\\x00.\\x00P\\x00a\\x00c\\x00k\\x00a\\x00g\\x00e\\x00\\x07\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xffa3\\xff89\\x0b\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x15\\x01\\x00\\x00\\x00\\x00y\\xffe6\\xfff2\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff8a%\\x01\\x00\\x00\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\xffc4\\x02%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff0\\x0c%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0EzX\\xffff\\x7f\\x00\\x00\\x08!y\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xffe7\\xfff2\\x02\\x00\\x00\\x00\\x00\\xff87\\xff9dNX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffc0\\xff95\\xffa7\\x0c\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffe0 y\\x0c\\x00\\x00\\x00\\x00\\xffc0\\xff95\\xffa7\\x0c\\x00\\x00\\x00\\x00\\xffe0\\x1b\\xffeb\\x08\\x00\\x00\\x00\\x00\\xffc7\\xffb3\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\xfff6sNX\\xffff\\x7f\\x00\\x00@\\xff92\\xffa7\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffe0\\x1b\\xffeb\\x08\\x00\\x00\\x00\\x00\\xfff04\\xffe5\\x08\\x00\\x00\\x00\\x00\\xfff04\\xffe5\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffc0\\xff95\\xffa7\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfffcW\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x006\\xff8cYX\\xffff\\x7f\\x00\\x00\\xff90\\xffd5y\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xffe8\\xfff2\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xffe8\\xfff2\\x02\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 6078 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "5596", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 6079 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "6096", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002300" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\ActivationType" } ], "repeated": 0, "id": 6080 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "5596", "caller": "0x7fff584d7b74", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000034a" }, { "name": "SubKey", "value": "CLSID\\{C2F03A33-21F5-47FA-B4BB-156362A2F239}" }, { "name": "Handle", "value": "0x000022e2" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{C2F03A33-21F5-47FA-B4BB-156362A2F239}" } ], "repeated": 0, "id": 6081 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "5596", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000022e2" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{c2f03a33-21f5-47fa-b4bb-156362a2f239}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 6082 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "6096", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002300" }, { "name": "ValueName", "value": "Server" }, { "name": "Data", "value": "StateRepository" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\Server" } ], "repeated": 0, "id": 6083 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "5596", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xf0\\xc77\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\xe2\"\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xc87\\x0b\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 6084 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "6096", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff585700bb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002300" }, { "name": "ValueName", "value": "DllPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\DllPath" } ], "repeated": 0, "id": 6085 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "5596", "caller": "0x7fff585622e1", "parentcaller": "0x7fff584d7c1d", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000022e2" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{c2f03a33-21f5-47fa-b4bb-156362a2f239}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 6086 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "6096", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002300" }, { "name": "ValueName", "value": "Threading" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\Threading" } ], "repeated": 0, "id": 6087 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "5596", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e2" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c2f03a33-21f5-47fa-b4bb-156362a2f239}\\(Default)" } ], "repeated": 0, "id": 6088 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "6096", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002300" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\TrustLevel" } ], "repeated": 0, "id": 6089 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "5596", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e2" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "Immersive Shell" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c2f03a33-21f5-47fa-b4bb-156362a2f239}\\(Default)" } ], "repeated": 0, "id": 6090 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "6096", "caller": "0x7fff584bc0fc", "parentcaller": "0x7fff58554170", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00002300" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\CustomAttributes" } ], "repeated": 0, "id": 6091 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "5596", "caller": "0x7fff584d8485", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000022e2" }, { "name": "SubKey", "value": "InprocServer32" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c2f03a33-21f5-47fa-b4bb-156362a2f239}\\InprocServer32" } ], "repeated": 0, "id": 6092 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "6096", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002300" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\RemoteServer" } ], "repeated": 0, "id": 6093 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "5596", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xc67\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\xe2\"\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xc77\\x0b\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 6094 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "6096", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002300" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\ActivateAsUser" } ], "repeated": 0, "id": 6095 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "5596", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000022e2" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{c2f03a33-21f5-47fa-b4bb-156362a2f239}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 6096 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "6096", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002300" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\ActivateInSharedBroker" } ], "repeated": 0, "id": 6097 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "5596", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xc67\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\xe2\"\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xc77\\x0b\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 6098 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "5596", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{c2f03a33-21f5-47fa-b4bb-156362a2f239}\\InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{c2f03a33-21f5-47fa-b4bb-156362a2f239}\\InprocHandler" } ], "repeated": 0, "id": 6099 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "6096", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002300" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 6100 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "5596", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000022e2" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c2f03a33-21f5-47fa-b4bb-156362a2f239}\\InprocHandler" } ], "repeated": 0, "id": 6101 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "6096", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58562222", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002300" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\Permissions" } ], "repeated": 0, "id": 6102 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "6096", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002300" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\ActivateOnHostFlags" } ], "repeated": 0, "id": 6103 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "6096", "caller": "0x7fff58557226", "parentcaller": "0x7fff5855ca23", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002300" } ], "repeated": 0, "id": 6104 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "6096", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff584c6d2f", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002300" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 6105 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "5596", "caller": "0x7fff584d7b74", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000034a" }, { "name": "SubKey", "value": "CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "Handle", "value": "0x000024ce" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" } ], "repeated": 0, "id": 6106 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "5596", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000024ce" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 6107 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "5596", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000024ce" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6108 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "5596", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xe0\\xb57\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\xce$\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xb67\\x0b\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 6109 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "5596", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\TreatAs" } ], "repeated": 0, "id": 6110 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "5596", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000024ce" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6111 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "5596", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000024ce" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\TreatAs" } ], "repeated": 0, "id": 6112 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "5596", "caller": "0x7fff585622e1", "parentcaller": "0x7fff584d7c1d", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000024ce" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 6113 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "5596", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d81f5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000024ce" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 6114 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "5596", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024ce" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)" } ], "repeated": 0, "id": 6115 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "5596", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024ce" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "PSFactoryBuffer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)" } ], "repeated": 0, "id": 6116 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "5596", "caller": "0x7fff584d8485", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000024ce" }, { "name": "SubKey", "value": "InprocServer32" }, { "name": "Handle", "value": "0x000024c2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocServer32" } ], "repeated": 0, "id": 6117 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "5596", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000024c2" }, { "name": "ValueName", "value": "InprocServer32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\InprocServer32" } ], "repeated": 0, "id": 6118 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "5596", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024c2" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 6119 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "5596", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024c2" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "C:\\Windows\\System32\\OneCoreUAPCommonProxyStub.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 6120 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "5596", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d8d32", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024c2" }, { "name": "ValueName", "value": "ThreadingModel" }, { "name": "Data", "value": "Both" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\ThreadingModel" } ], "repeated": 0, "id": 6121 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "5596", "caller": "0x7fff584d855f", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024c2" } ], "repeated": 0, "id": 6122 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "5596", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000024ce" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 6123 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "5596", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000024ce" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6124 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "5596", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "p\\xb47\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\xce$\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xb57\\x0b\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 6125 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "5596", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler32" } ], "repeated": 0, "id": 6126 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "5596", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000024ce" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6127 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "5596", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000024ce" }, { "name": "ObjectAttributesName", "value": "InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler32" } ], "repeated": 0, "id": 6128 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "5596", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000024ce" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 6129 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "5596", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000024ce" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6130 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "5596", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "p\\xb47\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\xce$\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xb57\\x0b\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 6131 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "5596", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler" } ], "repeated": 0, "id": 6132 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "5596", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000024ce" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6133 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "5596", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000024ce" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler" } ], "repeated": 0, "id": 6134 }, { "timestamp": "2026-05-29 01:05:24,305", "thread_id": "5596", "caller": "0x7fff584d8010", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024ce" } ], "repeated": 0, "id": 6135 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 6136 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 6137 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000568" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 6138 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "5000", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 6139 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "5596", "caller": "0x7fff58519794", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "F1C46D71-B791-4110-8D5C-7108F22C1010" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 6140 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 6141 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6142 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000024d8" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Cortana" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Cortana" } ], "repeated": 0, "id": 6143 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "5596", "caller": "0x7fff5855ddf7", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002438" }, { "name": "KeyInformation", "value": "N\\xffc1\\xffec\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00D\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00S\\x00t\\x00o\\x00r\\x00a\\x00g\\x00e\\x00.\\x00S\\x00t\\x00r\\x00e\\x00a\\x00m\\x00s\\x00.\\x00D\\x00a\\x00t\\x00a\\x00R\\x00e\\x00a\\x00d\\x00e\\x00r\\x00\\x00\\x00\\x00\\x00k\\xffb8\\xfff7Y\\xffff\\x7f\\x00\\x00\\x0e\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffa0\\xffe3n\\x07\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x15\\x01\\x00\\x00\\x00\\x00)\\xffcb7\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffc0\\xff8a%\\x01\\x00\\x00\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\xffc4\\x02%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \r%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0EzX\\xffff\\x7f\\x00\\x00x\\x7f\\xffad\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffcc7\\x0b\\x00\\x00\\x00\\x00\\xff87\\xff9dNX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80T\\xffad\\x0c\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\x7f\\xffad\\x0c\\x00\\x00\\x00\\x00\\xff80T\\xffad\\x0c\\x00\\x00\\x00\\x00\\xffb0\\xff96\\xffa8\\x0c\\x00\\x00\\x00\\x00\\xffc7\\xffb3\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\xfff6sNX\\xffff\\x7f\\x00\\x00\\x00\\xffc3\\xffb2\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffb0\\xff96\\xffa8\\x0c\\x00\\x00\\x00\\x00\\xfff0[\\xffad\\x0c\\x00\\x00\\x00\\x00\\xfff0[\\xffad\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80T\\xffad\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x006\\xff8cYX\\xffff\\x7f\\x00\\x00 v\\xffb3\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff0\\xffcc7\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff0\\xffcc7\\x0b\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 6144 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "5000", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024d8" } ], "repeated": 0, "id": 6145 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "5000", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "gdi32.dll" }, { "name": "ModuleHandle", "value": "0x7fff58350000" } ], "repeated": 0, "id": 6146 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "5000", "caller": "0x7fff577dac31", "parentcaller": "0x7fff4279d9d9", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "GDI32.dll" }, { "name": "ModuleHandle", "value": "0x7fff58350000" }, { "name": "FunctionName", "value": "BitBlt" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff58353a10" } ], "repeated": 0, "id": 6147 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "5000", "caller": "0x7fff577dac31", "parentcaller": "0x7fff4279d9d9", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "GDI32.dll" }, { "name": "ModuleHandle", "value": "0x7fff58350000" }, { "name": "FunctionName", "value": "CreateCompatibleBitmap" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff58354b30" } ], "repeated": 0, "id": 6148 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "5596", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\ActivationType" } ], "repeated": 0, "id": 6149 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "5000", "caller": "0x7fff577dac31", "parentcaller": "0x7fff4279d9d9", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "GDI32.dll" }, { "name": "ModuleHandle", "value": "0x7fff58350000" }, { "name": "FunctionName", "value": "CreateCompatibleDC" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff58353c00" } ], "repeated": 0, "id": 6150 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "5000", "caller": "0x7fff577dac31", "parentcaller": "0x7fff4279d9d9", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "GDI32.dll" }, { "name": "ModuleHandle", "value": "0x7fff58350000" }, { "name": "FunctionName", "value": "CreateDIBSection" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff58352820" } ], "repeated": 0, "id": 6151 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "5000", "caller": "0x7fff577dac31", "parentcaller": "0x7fff4279d9d9", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "GDI32.dll" }, { "name": "ModuleHandle", "value": "0x7fff58350000" }, { "name": "FunctionName", "value": "CreateFontIndirectW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff58351630" } ], "repeated": 0, "id": 6152 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "5000", "caller": "0x7fff577dac31", "parentcaller": "0x7fff4279d9d9", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "GDI32.dll" }, { "name": "ModuleHandle", "value": "0x7fff58350000" }, { "name": "FunctionName", "value": "CreateSolidBrush" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff58354c00" } ], "repeated": 0, "id": 6153 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "5000", "caller": "0x7fff577dac31", "parentcaller": "0x7fff4279d9d9", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "GDI32.dll" }, { "name": "ModuleHandle", "value": "0x7fff58350000" }, { "name": "FunctionName", "value": "DeleteDC" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff58352c70" } ], "repeated": 0, "id": 6154 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "5596", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\Server" } ], "repeated": 0, "id": 6155 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "5000", "caller": "0x7fff577dac31", "parentcaller": "0x7fff4279d9d9", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "GDI32.dll" }, { "name": "ModuleHandle", "value": "0x7fff58350000" }, { "name": "FunctionName", "value": "GetCurrentObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff58354910" } ], "repeated": 0, "id": 6156 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "5000", "caller": "0x7fff577dac31", "parentcaller": "0x7fff4279d9d9", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "GDI32.dll" }, { "name": "ModuleHandle", "value": "0x7fff58350000" }, { "name": "FunctionName", "value": "GetDIBits" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff583545f0" } ], "repeated": 0, "id": 6157 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "5000", "caller": "0x7fff577dac31", "parentcaller": "0x7fff4279d9d9", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "GDI32.dll" }, { "name": "ModuleHandle", "value": "0x7fff58350000" }, { "name": "FunctionName", "value": "GetDeviceCaps" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff58353290" } ], "repeated": 0, "id": 6158 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "5000", "caller": "0x7fff577dac31", "parentcaller": "0x7fff4279d9d9", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "GDI32.dll" }, { "name": "ModuleHandle", "value": "0x7fff58350000" }, { "name": "FunctionName", "value": "GetObjectW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff58354010" } ], "repeated": 0, "id": 6159 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "5000", "caller": "0x7fff577dac31", "parentcaller": "0x7fff4279d9d9", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "GDI32.dll" }, { "name": "ModuleHandle", "value": "0x7fff58350000" }, { "name": "FunctionName", "value": "GetStockObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff583539a0" } ], "repeated": 0, "id": 6160 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "5000", "caller": "0x7fff577dac31", "parentcaller": "0x7fff4279d9d9", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "GDI32.dll" }, { "name": "ModuleHandle", "value": "0x7fff58350000" }, { "name": "FunctionName", "value": "SelectObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff58353660" } ], "repeated": 0, "id": 6161 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "5000", "caller": "0x7fff577dac31", "parentcaller": "0x7fff4279d9d9", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "GDI32.dll" }, { "name": "ModuleHandle", "value": "0x7fff58350000" }, { "name": "FunctionName", "value": "SetBkMode" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff58353b60" } ], "repeated": 0, "id": 6162 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "5000", "caller": "0x7fff577dac31", "parentcaller": "0x7fff4279d9d9", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "GDI32.dll" }, { "name": "ModuleHandle", "value": "0x7fff58350000" }, { "name": "FunctionName", "value": "SetTextColor" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff58353cd0" } ], "repeated": 0, "id": 6163 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "5000", "caller": "0x7fff577f4f76", "parentcaller": "0x7fff4279d935", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "kernel32.dll" }, { "name": "ModuleHandle", "value": "0x7fff57fb0000" } ], "repeated": 0, "id": 6164 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "5596", "caller": "0x7fff577d3e41", "parentcaller": "0x7fff578543b9", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002438" }, { "name": "ValueName", "value": "DllPath" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "C:\\Windows\\System32\\WinTypes.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\DllPath" } ], "repeated": 0, "id": 6165 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "5000", "caller": "0x7fff577dac31", "parentcaller": "0x7fff4279d9d9", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x7fff57fb0000" }, { "name": "FunctionName", "value": "GetLocaleInfoEx" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff57fcce50" } ], "repeated": 0, "id": 6166 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "5000", "caller": "0x7fff577dac31", "parentcaller": "0x7fff4279d9d9", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x7fff57fb0000" }, { "name": "FunctionName", "value": "GetUserPreferredUILanguages" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff57fd08a0" } ], "repeated": 0, "id": 6167 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "5000", "caller": "0x7fff577dac31", "parentcaller": "0x7fff4279d9d9", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x7fff57fb0000" }, { "name": "FunctionName", "value": "LCIDToLocaleName" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff57fd0950" } ], "repeated": 0, "id": 6168 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "5000", "caller": "0x7fff577dac31", "parentcaller": "0x7fff4279d9d9", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x7fff57fb0000" }, { "name": "FunctionName", "value": "LocaleNameToLCID" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff57fce390" } ], "repeated": 0, "id": 6169 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "5000", "caller": "0x7fff577dac31", "parentcaller": "0x7fff4279d9d9", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x7fff57fb0000" }, { "name": "FunctionName", "value": "MulDiv" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff57fd5310" } ], "repeated": 0, "id": 6170 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "5000", "caller": "0x7fff577dac31", "parentcaller": "0x7fff4279d9d9", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x7fff57fb0000" }, { "name": "FunctionName", "value": "MultiByteToWideChar" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff57fc5b20" } ], "repeated": 0, "id": 6171 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "5000", "caller": "0x7fff577dac31", "parentcaller": "0x7fff4279d9d9", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x7fff57fb0000" }, { "name": "FunctionName", "value": "SleepEx" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff57fd4db0" } ], "repeated": 0, "id": 6172 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "5000", "caller": "0x7fff577f4f76", "parentcaller": "0x7fff4279d935", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 6173 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "5000", "caller": "0x7fff577dac31", "parentcaller": "0x7fff4279d9d9", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "WinSqmAddToStream" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fcffa0" } ], "repeated": 0, "id": 6174 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "5596", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "Threading" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\Threading" } ], "repeated": 0, "id": 6175 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "5000", "caller": "0x7fff577dac31", "parentcaller": "0x7fff4279d9d9", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "user32.dll" }, { "name": "ModuleHandle", "value": "0x7fff581b0000" }, { "name": "FunctionName", "value": "DrawTextExW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff581ce840" } ], "repeated": 0, "id": 6176 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "5000", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "user32.dll" }, { "name": "ModuleHandle", "value": "0x7fff581b0000" }, { "name": "FunctionName", "value": "EnumDisplaySettingsW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff581b88a0" } ], "repeated": 0, "id": 6177 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "5000", "caller": "0x7fff577dac31", "parentcaller": "0x7fff4279d9d9", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "user32.dll" }, { "name": "ModuleHandle", "value": "0x7fff581b0000" }, { "name": "FunctionName", "value": "FillRect" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff581d3340" } ], "repeated": 0, "id": 6178 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "5000", "caller": "0x7fff577dac31", "parentcaller": "0x7fff4279d9d9", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "user32.dll" }, { "name": "ModuleHandle", "value": "0x7fff581b0000" }, { "name": "FunctionName", "value": "GetDC" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff581d6200" } ], "repeated": 0, "id": 6179 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "5000", "caller": "0x7fff577dac31", "parentcaller": "0x7fff4279d9d9", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "user32.dll" }, { "name": "ModuleHandle", "value": "0x7fff581b0000" }, { "name": "FunctionName", "value": "GetDCEx" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff581e3fa0" } ], "repeated": 0, "id": 6180 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "5000", "caller": "0x7fff577dac31", "parentcaller": "0x7fff4279d9d9", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "user32.dll" }, { "name": "ModuleHandle", "value": "0x7fff581b0000" }, { "name": "FunctionName", "value": "GetDesktopWindow" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff581baeb0" } ], "repeated": 0, "id": 6181 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "5596", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\TrustLevel" } ], "repeated": 0, "id": 6182 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "5000", "caller": "0x7fff577dac31", "parentcaller": "0x7fff4279d9d9", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "user32.dll" }, { "name": "ModuleHandle", "value": "0x7fff581b0000" }, { "name": "FunctionName", "value": "GetProcessWindowStation" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff581e4220" } ], "repeated": 0, "id": 6183 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "5000", "caller": "0x7fff577dac31", "parentcaller": "0x7fff4279d9d9", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "user32.dll" }, { "name": "ModuleHandle", "value": "0x7fff581b0000" }, { "name": "FunctionName", "value": "GetSysColor" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff581d5f10" } ], "repeated": 0, "id": 6184 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "5000", "caller": "0x7fff577dac31", "parentcaller": "0x7fff4279d9d9", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "user32.dll" }, { "name": "ModuleHandle", "value": "0x7fff581b0000" }, { "name": "FunctionName", "value": "GetSystemMetrics" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff581d0f20" } ], "repeated": 0, "id": 6185 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "5000", "caller": "0x7fff577dac31", "parentcaller": "0x7fff4279d9d9", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "user32.dll" }, { "name": "ModuleHandle", "value": "0x7fff581b0000" }, { "name": "FunctionName", "value": "GetUserObjectInformationW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff581e4310" } ], "repeated": 0, "id": 6186 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "5000", "caller": "0x7fff577dac31", "parentcaller": "0x7fff4279d9d9", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "user32.dll" }, { "name": "ModuleHandle", "value": "0x7fff581b0000" }, { "name": "FunctionName", "value": "InvalidateRect" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff581e4510" } ], "repeated": 0, "id": 6187 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "5000", "caller": "0x7fff577dac31", "parentcaller": "0x7fff4279d9d9", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "user32.dll" }, { "name": "ModuleHandle", "value": "0x7fff581b0000" }, { "name": "FunctionName", "value": "LogicalToPhysicalPointForPerMonitorDPI" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff581e4640" } ], "repeated": 0, "id": 6188 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "5000", "caller": "0x7fff577dac31", "parentcaller": "0x7fff4279d9d9", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "user32.dll" }, { "name": "ModuleHandle", "value": "0x7fff581b0000" }, { "name": "FunctionName", "value": "MonitorFromWindow" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff581d11b0" } ], "repeated": 0, "id": 6189 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "5596", "caller": "0x7fff584bc0fc", "parentcaller": "0x7fff58554170", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00002438" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\CustomAttributes" } ], "repeated": 0, "id": 6190 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "5000", "caller": "0x7fff577dac31", "parentcaller": "0x7fff4279d9d9", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "user32.dll" }, { "name": "ModuleHandle", "value": "0x7fff581b0000" }, { "name": "FunctionName", "value": "ReleaseDC" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff581d3c10" } ], "repeated": 0, "id": 6191 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "5000", "caller": "0x7fff577dac31", "parentcaller": "0x7fff4279d9d9", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "user32.dll" }, { "name": "ModuleHandle", "value": "0x7fff581b0000" }, { "name": "FunctionName", "value": "SystemParametersInfoW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff581d33b0" } ], "repeated": 0, "id": 6192 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "5596", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\RemoteServer" } ], "repeated": 0, "id": 6193 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "5000", "caller": "0x7fff577dac31", "parentcaller": "0x7fff4279ff9a", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "NtQuerySystemInformation" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fed690" } ], "repeated": 0, "id": 6194 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "5596", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\ActivateAsUser" } ], "repeated": 0, "id": 6195 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "5596", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\ActivateInSharedBroker" } ], "repeated": 0, "id": 6196 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "5000", "caller": "0x7fff4279ffbc", "parentcaller": "0x7fff4279d3ca", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "134" } ], "repeated": 0, "id": 6197 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "5596", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 6198 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "5000", "caller": "0x7fff522d71e2", "parentcaller": "0x7fff522d5791", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\default\\Experience\\AllowCortana" }, { "name": "Handle", "value": "0x000024d8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Experience\\AllowCortana" } ], "repeated": 0, "id": 6199 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "5596", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58562222", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\Permissions" } ], "repeated": 0, "id": 6200 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "5000", "caller": "0x7fff522d723c", "parentcaller": "0x7fff522d5791", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024d8" }, { "name": "ValueName", "value": "PolicyType" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Experience\\AllowCortana\\PolicyType" } ], "repeated": 0, "id": 6201 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "5596", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\ActivateOnHostFlags" } ], "repeated": 0, "id": 6202 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "5000", "caller": "0x7fff522d72a8", "parentcaller": "0x7fff522d5791", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024d8" }, { "name": "ValueName", "value": "Behavior" }, { "name": "Data", "value": "73760" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Experience\\AllowCortana\\Behavior" } ], "repeated": 0, "id": 6203 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "5000", "caller": "0x7fff522d732c", "parentcaller": "0x7fff522d5791", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024d8" }, { "name": "ValueName", "value": "MergeAlgorithm" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Experience\\AllowCortana\\MergeAlgorithm" } ], "repeated": 0, "id": 6204 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "5596", "caller": "0x7fff58557226", "parentcaller": "0x7fff5855ca23", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 6205 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "5000", "caller": "0x7fff522d739f", "parentcaller": "0x7fff522d5791", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000024d8" }, { "name": "ValueName", "value": "RegKeyPathRedirectMapped" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Experience\\AllowCortana\\RegKeyPathRedirectMapped" } ], "repeated": 0, "id": 6206 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "5000", "caller": "0x7fff522d7402", "parentcaller": "0x7fff522d5791", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000024d8" }, { "name": "ValueName", "value": "RegKeyPathRedirect" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Experience\\AllowCortana\\RegKeyPathRedirect" } ], "repeated": 0, "id": 6207 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "5000", "caller": "0x7fff522d755e", "parentcaller": "0x7fff522d5791", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024d8" }, { "name": "ValueName", "value": "grouppolicyname" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Experience\\AllowCortana\\grouppolicyname" } ], "repeated": 0, "id": 6208 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "5000", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024d8" }, { "name": "ValueName", "value": "grouppolicypath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Experience\\AllowCortana\\grouppolicypath" } ], "repeated": 0, "id": 6209 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff5855ddf7", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000024cc" }, { "name": "KeyInformation", "value": "\\xfffci\\x0e\\xffd4\\xffde\\xffac\\xffd5\\x01\\x00\\x00\\x00\\x00`\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00I\\x00n\\x00t\\x00e\\x00r\\x00n\\x00a\\x00l\\x00.\\x00S\\x00t\\x00a\\x00t\\x00e\\x00R\\x00e\\x00p\\x00o\\x00s\\x00i\\x00t\\x00o\\x00r\\x00y\\x00.\\x00P\\x00a\\x00c\\x00k\\x00a\\x00g\\x00e\\x00L\\x00o\\x00c\\x00a\\x00t\\x00i\\x00o\\x00n\\x00\\xff80\\xffa6\\xffb6\\x08\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x15\\x01\\x00\\x00\\x00\\x00\\xff89\\xffe8\\xfff2\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x15%\\x01\\x00\\x00\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\xffc4\\x02%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffc0\\x0c%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0EzX\\xffff\\x7f\\x00\\x00\\xff98\\x18\\xffc5\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xffe9\\xfff2\\x02\\x00\\x00\\x00\\x00\\xff87\\xff9dNX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0001\\xffc5\\x0b\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\x18\\xffc5\\x0b\\x00\\x00\\x00\\x0001\\xffc5\\x0b\\x00\\x00\\x00\\x00\\x10Z\\xffc3\\x0b\\x00\\x00\\x00\\x00\\xffc7\\xffb3\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\xfff6sNX\\xffff\\x7f\\x00\\x00 W\\xffc5\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\x10Z\\xffc3\\x0b\\x00\\x00\\x00\\x00\\xffe0V~\\x03\\x00\\x00\\x00\\x00\\xffe0V~\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0001\\xffc5\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x15\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x006\\xff8cYX\\xffff\\x7f\\x00\\x00\\xffc0\\xffcf\\xffda\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xffea\\xfff2\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xffea\\xfff2\\x02\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 6210 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024cc" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.PackageLocation\\ActivationType" } ], "repeated": 0, "id": 6211 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "5000", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024d8" }, { "name": "ValueName", "value": "grouppolicypath" }, { "name": "Data", "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\Windows Search" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Experience\\AllowCortana\\grouppolicypath" } ], "repeated": 0, "id": 6212 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "5596", "caller": "0x7fff5855dd9d", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002438" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000430" }, { "name": "ObjectAttributesName", "value": "Windows.Foundation.PropertyValue" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue" } ], "repeated": 0, "id": 6213 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff585700bb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000024cc" }, { "name": "ValueName", "value": "DllPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.PackageLocation\\DllPath" } ], "repeated": 0, "id": 6214 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "5000", "caller": "0x7fff522d78f6", "parentcaller": "0x7fff522d5791", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000024d8" }, { "name": "ValueName", "value": "ADMXMetadataUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Experience\\AllowCortana\\ADMXMetadataUser" } ], "repeated": 0, "id": 6215 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000024cc" }, { "name": "ValueName", "value": "Threading" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.PackageLocation\\Threading" } ], "repeated": 0, "id": 6216 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "5000", "caller": "0x7fff522d7a6c", "parentcaller": "0x7fff522d5791", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000024d8" }, { "name": "ValueName", "value": "ADMXMetadataBoth" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Experience\\AllowCortana\\ADMXMetadataBoth" } ], "repeated": 0, "id": 6217 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024cc" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.PackageLocation\\TrustLevel" } ], "repeated": 0, "id": 6218 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff584bc0fc", "parentcaller": "0x7fff58554170", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000024cc" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.PackageLocation\\CustomAttributes" } ], "repeated": 0, "id": 6219 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000024cc" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.PackageLocation\\RemoteServer" } ], "repeated": 0, "id": 6220 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "5000", "caller": "0x7fff522d76a9", "parentcaller": "0x7fff522d5791", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024d8" } ], "repeated": 0, "id": 6221 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000024cc" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.PackageLocation\\ActivateAsUser" } ], "repeated": 0, "id": 6222 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "5000", "caller": "0x7fff522d6e85", "parentcaller": "0x7fff522d5800", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\Windows Search" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Windows Search" } ], "repeated": 0, "id": 6223 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000024cc" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.PackageLocation\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 6224 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58562222", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000024cc" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.PackageLocation\\Permissions" } ], "repeated": 0, "id": 6225 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "5000", "caller": "0x7fff427a8628", "parentcaller": "0x7fff427a8b84", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Cortana" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x00000002", "pretty_value": "KEY_SET_VALUE" }, { "name": "Handle", "value": "0x000024d8" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Cortana" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 6226 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000024cc" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.PackageLocation\\ActivateOnHostFlags" } ], "repeated": 0, "id": 6227 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "5000", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024d8" } ], "repeated": 0, "id": 6228 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024cc" } ], "repeated": 0, "id": 6229 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "5596", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "Threading" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\Threading" } ], "repeated": 0, "id": 6230 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "5596", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\TrustLevel" } ], "repeated": 0, "id": 6231 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "5596", "caller": "0x7fff584bc0fc", "parentcaller": "0x7fff58554170", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00002438" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\CustomAttributes" } ], "repeated": 0, "id": 6232 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "5596", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\RemoteServer" } ], "repeated": 0, "id": 6233 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "5596", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\ActivateAsUser" } ], "repeated": 0, "id": 6234 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "5596", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\ActivateInSharedBroker" } ], "repeated": 0, "id": 6235 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "5596", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 6236 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "5596", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58562222", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\Permissions" } ], "repeated": 0, "id": 6237 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 6238 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "5596", "caller": "0x7fff577d3e41", "parentcaller": "0x7fff578543b9", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00002438" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\ActivateOnHostFlags" } ], "repeated": 0, "id": 6239 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "5596", "caller": "0x7fff58557226", "parentcaller": "0x7fff5855ca23", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 6240 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "5596", "caller": "0x7fff585192b9", "parentcaller": "0x7fff584e8db3", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 6241 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 6242 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff5855dd9d", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002438" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000430" }, { "name": "ObjectAttributesName", "value": "Windows.ApplicationModel.Package" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Package" } ], "repeated": 0, "id": 6243 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff5855ddf7", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002438" }, { "name": "KeyInformation", "value": "\\xff97\\xfffc\\xffe7\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00@\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00A\\x00p\\x00p\\x00l\\x00i\\x00c\\x00a\\x00t\\x00i\\x00o\\x00n\\x00M\\x00o\\x00d\\x00e\\x00l\\x00.\\x00P\\x00a\\x00c\\x00k\\x00a\\x00g\\x00e\\x00j\\x00*\\x00\\x00\\x00\\x00\\x00k\\xffb8\\xfff7Y\\xffff\\x7f\\x00\\x00i\\x00\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\xffa6\\xffb6\\x08\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x15\\x01\\x00\\x00\\x00\\x00\\xff89\\xffe8\\xfff2\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x15%\\x01\\x00\\x00\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\xffc4\\x02%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffc0\\x0c%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0EzX\\xffff\\x7f\\x00\\x00h\\x1b\\xffc5\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xffe9\\xfff2\\x02\\x00\\x00\\x00\\x00\\xff87\\xff9dNX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`h~\\x03\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x1b\\xffc5\\x0b\\x00\\x00\\x00\\x00`h~\\x03\\x00\\x00\\x00\\x00\\xff90V\\xffc3\\x0b\\x00\\x00\\x00\\x00\\xffc7\\xffb3\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\xfff6sNX\\xffff\\x7f\\x00\\x00 W\\xffc5\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xff90V\\xffc3\\x0b\\x00\\x00\\x00\\x00pd~\\x03\\x00\\x00\\x00\\x00pd~\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`h~\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff2\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x006\\xff8cYX\\xffff\\x7f\\x00\\x00\\x00\\xffc7\\xffda\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xffea\\xfff2\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xffea\\xfff2\\x02\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 6244 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Package\\ActivationType" } ], "repeated": 0, "id": 6245 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Package\\Server" } ], "repeated": 0, "id": 6246 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff585700bb", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "DllPath" }, { "name": "Data", "value": "C:\\Windows\\System32\\Windows.ApplicationModel.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Package\\DllPath" } ], "repeated": 0, "id": 6247 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "Threading" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Package\\Threading" } ], "repeated": 0, "id": 6248 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Package\\TrustLevel" } ], "repeated": 0, "id": 6249 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff584bc0fc", "parentcaller": "0x7fff58554170", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00002438" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Package\\CustomAttributes" } ], "repeated": 0, "id": 6250 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Package\\RemoteServer" } ], "repeated": 0, "id": 6251 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Package\\ActivateAsUser" } ], "repeated": 0, "id": 6252 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Package\\ActivateInSharedBroker" } ], "repeated": 0, "id": 6253 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Package\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 6254 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58562222", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Package\\Permissions" } ], "repeated": 0, "id": 6255 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002438" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Package\\ActivateOnHostFlags" } ], "repeated": 0, "id": 6256 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff58557226", "parentcaller": "0x7fff5855ca23", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 6257 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfe\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\x17\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6096" } ], "repeated": 0, "id": 6258 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "4636", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xf9\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x1c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4636" } ], "repeated": 0, "id": 6259 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff584fb0ca", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 6260 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 6261 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff584d7b74", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000034a" }, { "name": "SubKey", "value": "CLSID\\{C2F03A33-21F5-47FA-B4BB-156362A2F239}" }, { "name": "Handle", "value": "0x0000243a" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{C2F03A33-21F5-47FA-B4BB-156362A2F239}" } ], "repeated": 0, "id": 6262 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000243a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{c2f03a33-21f5-47fa-b4bb-156362a2f239}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 6263 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000243a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6264 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xc8\\xf2\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00:$\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xc9\\xf2\\x02\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 6265 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{c2f03a33-21f5-47fa-b4bb-156362a2f239}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{c2f03a33-21f5-47fa-b4bb-156362a2f239}\\TreatAs" } ], "repeated": 0, "id": 6266 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000243a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6267 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000243a" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c2f03a33-21f5-47fa-b4bb-156362a2f239}\\TreatAs" } ], "repeated": 0, "id": 6268 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff585622e1", "parentcaller": "0x7fff584d7c1d", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000243a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{c2f03a33-21f5-47fa-b4bb-156362a2f239}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 6269 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d81f5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000243a" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c2f03a33-21f5-47fa-b4bb-156362a2f239}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 6270 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000243a" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c2f03a33-21f5-47fa-b4bb-156362a2f239}\\(Default)" } ], "repeated": 0, "id": 6271 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000243a" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "Immersive Shell" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c2f03a33-21f5-47fa-b4bb-156362a2f239}\\(Default)" } ], "repeated": 0, "id": 6272 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff584d8485", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x0000243a" }, { "name": "SubKey", "value": "InprocServer32" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c2f03a33-21f5-47fa-b4bb-156362a2f239}\\InprocServer32" } ], "repeated": 0, "id": 6273 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000243a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{c2f03a33-21f5-47fa-b4bb-156362a2f239}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 6274 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000243a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6275 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xe0\\xc6\\xf2\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00:$\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xc7\\xf2\\x02\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 6276 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{c2f03a33-21f5-47fa-b4bb-156362a2f239}\\InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{c2f03a33-21f5-47fa-b4bb-156362a2f239}\\InprocHandler32" } ], "repeated": 0, "id": 6277 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000243a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6278 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000243a" }, { "name": "ObjectAttributesName", "value": "InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c2f03a33-21f5-47fa-b4bb-156362a2f239}\\InprocHandler32" } ], "repeated": 0, "id": 6279 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000243a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{c2f03a33-21f5-47fa-b4bb-156362a2f239}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 6280 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000243a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6281 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xe0\\xc6\\xf2\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00:$\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xc7\\xf2\\x02\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 6282 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{c2f03a33-21f5-47fa-b4bb-156362a2f239}\\InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{c2f03a33-21f5-47fa-b4bb-156362a2f239}\\InprocHandler" } ], "repeated": 0, "id": 6283 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000243a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6284 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000243a" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c2f03a33-21f5-47fa-b4bb-156362a2f239}\\InprocHandler" } ], "repeated": 0, "id": 6285 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff584d8010", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000243a" } ], "repeated": 0, "id": 6286 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff5854fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000033a" }, { "name": "SubKey", "value": "Interface\\{BF63999F-7411-40DA-861C-DF72C0FFEE84}" }, { "name": "Handle", "value": "0x0000243a" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{BF63999F-7411-40DA-861C-DF72C0FFEE84}" } ], "repeated": 0, "id": 6287 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff5854fa51", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000243a" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x000024c2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{BF63999F-7411-40DA-861C-DF72C0FFEE84}\\ProxyStubClsid32" } ], "repeated": 0, "id": 6288 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff5854fa8c", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024c2" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{BF63999F-7411-40DA-861C-DF72C0FFEE84}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 6289 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff5854fad3", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024c2" } ], "repeated": 0, "id": 6290 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff5854fae4", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000243a" } ], "repeated": 0, "id": 6291 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff584d7b74", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000034a" }, { "name": "SubKey", "value": "CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "Handle", "value": "0x0000243a" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" } ], "repeated": 0, "id": 6292 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000243a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 6293 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000243a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6294 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "@\\xb6\\xf2\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00:$\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xb7\\xf2\\x02\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 6295 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\TreatAs" } ], "repeated": 0, "id": 6296 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000243a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6297 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000243a" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\TreatAs" } ], "repeated": 0, "id": 6298 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff585622e1", "parentcaller": "0x7fff584d7c1d", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000243a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 6299 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d81f5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000243a" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 6300 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000243a" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)" } ], "repeated": 0, "id": 6301 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000243a" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "PSFactoryBuffer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)" } ], "repeated": 0, "id": 6302 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff584d8485", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000243a" }, { "name": "SubKey", "value": "InprocServer32" }, { "name": "Handle", "value": "0x000024ce" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocServer32" } ], "repeated": 0, "id": 6303 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000024ce" }, { "name": "ValueName", "value": "InprocServer32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\InprocServer32" } ], "repeated": 0, "id": 6304 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024ce" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 6305 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024ce" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "C:\\Windows\\System32\\OneCoreUAPCommonProxyStub.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 6306 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d8d32", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024ce" }, { "name": "ValueName", "value": "ThreadingModel" }, { "name": "Data", "value": "Both" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\ThreadingModel" } ], "repeated": 0, "id": 6307 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff584d855f", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024ce" } ], "repeated": 0, "id": 6308 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000243a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 6309 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000243a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6310 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xd0\\xb4\\xf2\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00:$\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xb5\\xf2\\x02\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 6311 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler32" } ], "repeated": 0, "id": 6312 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000243a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6313 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000243a" }, { "name": "ObjectAttributesName", "value": "InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler32" } ], "repeated": 0, "id": 6314 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000243a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 6315 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000243a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6316 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xd0\\xb4\\xf2\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00:$\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xb5\\xf2\\x02\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 6317 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler" } ], "repeated": 0, "id": 6318 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000243a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6319 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000243a" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler" } ], "repeated": 0, "id": 6320 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff584d8010", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000243a" } ], "repeated": 0, "id": 6321 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff59f93f7a", "parentcaller": "0x7fff59770ed7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 6322 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff59770cd1", "parentcaller": "0x7fff5976f28f", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00002438" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 6323 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff5781026b", "parentcaller": "0x7fff59770daf", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000024cc" } ], "repeated": 0, "id": 6324 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff59f88cde", "parentcaller": "0x7fff59fc9c4e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": " \\xf1\\x02\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 6325 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff59fb6e46", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "xa\\xbf\\x0b\\x00\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x04]\\x88\\x8a\\xeb\\x1c\\xc9\\x11\\x9f\\xe8\\x08\\x00+\\x10H`\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00y:Fr\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00;\\x00\\x00\\x00" } ], "repeated": 0, "id": 6326 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff59fb6e9b", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xe0^\\xbf\\x0b\\x00\\x00\\x00\\x00`\\x00\\x00\\x00zz\\xbb\\x84\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\xeb\\x1c\\xc9\\x11\\x9f\\xe8\\x08\\x00+\\x10H`\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00;\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 6327 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff59fb6ec0", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 6328 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff59fb6f0e", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xc8\\xe7\\xd9\\x0b\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 6329 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff59fb6f37", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 6330 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff59fb6f8f", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "8n\\xbf\\x0b\\x00\\x00\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 6331 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff59fb7048", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x81\\x1a\\xff\\x7f\\x00\\x00\\xebPY\\x1a\\xff\\x7f\\x00\\x00\\xc8Q\\xf8x^t\\x00\\x00(N}\\x1a\\xff\\x7f\\x00\\x00\\x90\\xc4\\xf2\\x02\\x00\\x00\\x00\\x00\\x88\\xc4\\xf2\\x02\\x00\\x00\\x00\\x00X\\xc4\\xf2\\x02\\x00\\x00\\x00\\x00x\\xc4\\xf2\\x02" } ], "repeated": 0, "id": 6332 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff59fb707b", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000n\\xbf\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8Z\\x1a\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00x\\xc2\\xf2\\x02\\x00\\x00\\x00\\x00\\xcc$\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00$\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2}\\x1a" } ], "repeated": 0, "id": 6333 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff59f88cde", "parentcaller": "0x7fff59f8953a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": " \\xf1\\x02\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 6334 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff59fb6e46", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "X]\\xbf\\x0b\\x00\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x04]\\x88\\x8a\\xeb\\x1c\\xc9\\x11\\x9f\\xe8\\x08\\x00+\\x10H`\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00;\\x00\\x00\\x00" } ], "repeated": 0, "id": 6335 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff59fb6e9b", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\x80X\\xbf\\x0b\\x00\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00l\\x0e\\x00\\x00h\\x0e\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xf4\\x1d\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00" } ], "repeated": 0, "id": 6336 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff59fb6ec0", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 6337 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff59fb6f0e", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xd8\\xdd\\xd9\\x0b\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 6338 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff59fb6f37", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 6339 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff59fb6f8f", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xd8X\\xbf\\x0b\\x00\\x00\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 6340 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff59fb7048", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x81\\x1a\\xff\\x7f\\x00\\x00\\xebPY\\x1a\\xff\\x7f\\x00\\x00\\xa8U\\xf8x^t\\x00\\x00(N}\\x1a\\xff\\x7f\\x00\\x00\\xf0\\xc0\\xf2\\x02\\x00\\x00\\x00\\x00\\xe8\\xc0\\xf2\\x02\\x00\\x00\\x00\\x00\\xb8\\xc0\\xf2\\x02\\x00\\x00\\x00\\x00\\xd8\\xc0\\xf2\\x02" } ], "repeated": 0, "id": 6341 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff59fb707b", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0X\\xbf\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8Z\\x1a\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xd8\\xbe\\xf2\\x02\\x00\\x00\\x00\\x00\\xcc$\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00$\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2}\\x1a" } ], "repeated": 0, "id": 6342 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff59770e27", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 6343 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff59770e49", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024cc" } ], "repeated": 0, "id": 6344 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 6345 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000404" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 6346 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "4636", "caller": "0x7fff584d7b74", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000034a" }, { "name": "SubKey", "value": "CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}" }, { "name": "Handle", "value": "0x00002442" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}" } ], "repeated": 0, "id": 6347 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "4636", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002442" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 6348 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "4636", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002442" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6349 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "4636", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xc9(\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00B$\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\xca(\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 6350 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "4636", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\TreatAs" } ], "repeated": 0, "id": 6351 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "4636", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002442" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6352 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "4636", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00002442" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\TreatAs" } ], "repeated": 0, "id": 6353 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "4636", "caller": "0x7fff585622e1", "parentcaller": "0x7fff584d7c1d", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002442" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 6354 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "4636", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d81f5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002442" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 6355 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "4636", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002442" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\(Default)" } ], "repeated": 0, "id": 6356 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "4636", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002442" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "PSFactoryBuffer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\(Default)" } ], "repeated": 0, "id": 6357 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "4636", "caller": "0x7fff584d8485", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002442" }, { "name": "SubKey", "value": "InprocServer32" }, { "name": "Handle", "value": "0x00001e6a" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocServer32" } ], "repeated": 0, "id": 6358 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "4636", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001e6a" }, { "name": "ValueName", "value": "InprocServer32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\InprocServer32" } ], "repeated": 0, "id": 6359 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "4636", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001e6a" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 6360 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff42a0d2cd", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024cc" } ], "repeated": 0, "id": 6361 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "4636", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001e6a" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "C:\\Windows\\System32\\\\Windows.StateRepositoryPS.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 6362 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff41dcff5a", "parentcaller": "0x7fff426e60d5", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000100ec" }, { "name": "Message", "value": "0x0000c028" } ], "repeated": 0, "id": 6363 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff426f6e52", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 6364 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "6096", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff426f6e52", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024cc" }, { "name": "Milliseconds", "value": "5000" } ], "repeated": 0, "id": 6365 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "4636", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d8d32", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001e6a" }, { "name": "ValueName", "value": "ThreadingModel" }, { "name": "Data", "value": "Both" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\ThreadingModel" } ], "repeated": 0, "id": 6366 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "4636", "caller": "0x7fff584d855f", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001e6a" } ], "repeated": 0, "id": 6367 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "4636", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002442" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 6368 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "4696", "caller": "0x7ff79bc76bd8", "parentcaller": "0x7ff79bc8a0c8", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00010110" }, { "name": "Message", "value": "0x0000c028" } ], "repeated": 0, "id": 6369 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "4636", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002442" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6370 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "4636", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xc7(\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00B$\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\xc8(\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 6371 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "4636", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler32" } ], "repeated": 0, "id": 6372 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff42a0d2cd", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0xffffffff" } ], "repeated": 0, "id": 6373 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "4636", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002442" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6374 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "4636", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00002442" }, { "name": "ObjectAttributesName", "value": "InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler32" } ], "repeated": 0, "id": 6375 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "4636", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002442" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 6376 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "4636", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002442" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6377 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "4636", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xc7(\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00B$\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\xc8(\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 6378 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "4636", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler" } ], "repeated": 0, "id": 6379 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "4636", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002442" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6380 }, { "timestamp": "2026-05-29 01:05:24,321", "thread_id": "4636", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00002442" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler" } ], "repeated": 0, "id": 6381 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4636", "caller": "0x7fff584d8010", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002442" } ], "repeated": 0, "id": 6382 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 6383 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000404" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 6384 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4696", "caller": "0x7ff79bc1fa2e", "parentcaller": "0x7ff79bc7fc27", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000072" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 6385 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4696", "caller": "0x7ff79bca5b09", "parentcaller": "0x7ff79bc1fa68", "category": "synchronization", "api": "NtOpenEvent", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "Handle", "value": "0x7ff79bc7fc22" }, { "name": "EventName", "value": "{A1965210-3A9D-4bca-822B-433645B3F5A2}" } ], "repeated": 0, "id": 6386 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4696", "caller": "0x7ff79bc1faf5", "parentcaller": "0x7ff79bc1fa75", "category": "synchronization", "api": "NtOpenMutant", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "Handle", "value": "0x7ff79bc7fc22" }, { "name": "MutexName", "value": "Local\\__DDrawCheckExclMode__" } ], "repeated": 0, "id": 6387 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4696", "caller": "0x7ff79bc19217", "parentcaller": "0x7ff79bc1fa94", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 6388 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4696", "caller": "0x7ff79bc19217", "parentcaller": "0x7ff79bc1fa94", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6389 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4696", "caller": "0x7ff79bc19217", "parentcaller": "0x7ff79bc1fa94", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001e68" }, { "name": "DesiredAccess", "value": "0x00000101", "pretty_value": "KEY_QUERY_VALUE|KEY_WOW64_64KEY" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\RetailDemo\\OobeWrite" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\RetailDemo\\OobeWrite" } ], "repeated": 0, "id": 6390 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4696", "caller": "0x7ff79bc19217", "parentcaller": "0x7ff79bc1fa94", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001e68" }, { "name": "ValueName", "value": "Enabled" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RetailDemo\\OobeWrite\\Enabled" } ], "repeated": 0, "id": 6391 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4696", "caller": "0x7ff79bc19217", "parentcaller": "0x7ff79bc1fa94", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001e68" } ], "repeated": 0, "id": 6392 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4696", "caller": "0x7ff79bc19232", "parentcaller": "0x7ff79bc1fa94", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 6393 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000404" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 6394 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff41e05bb2", "parentcaller": "0x7fff41dd027e", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00010110" }, { "name": "Message", "value": "0x0000c028" } ], "repeated": 0, "id": 6395 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff58182302", "parentcaller": "0x7fff581ba0d6", "category": "misc", "api": "GetKeyboardLayout", "status": true, "return": "0x04090409", "arguments": [ { "name": "KeyboardLayout", "value": "0x00000409" }, { "name": "LanguageName", "value": "English (United States)" } ], "repeated": 0, "id": 6396 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4636", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5287472a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0xfffffffc" } ], "repeated": 0, "id": 6397 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4636", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xf9\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x1c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4636" } ], "repeated": 0, "id": 6398 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58085ee4", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002048" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 6399 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 6400 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff583abb10", "parentcaller": "0x7fff583b0d5e", "category": "misc", "api": "GetKeyboardLayout", "status": true, "return": "0x04090409", "arguments": [ { "name": "KeyboardLayout", "value": "0x00000409" }, { "name": "LanguageName", "value": "English (United States)" } ], "repeated": 0, "id": 6401 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff583abc5b", "parentcaller": "0x7fff583abb26", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x0000104e" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 6402 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4620", "caller": "0x7fff5855dd9d", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000024d8" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000430" }, { "name": "ObjectAttributesName", "value": "Windows.Internal.Tiles.TileQueryFilter" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileQueryFilter" } ], "repeated": 0, "id": 6403 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4620", "caller": "0x7fff5855ddf7", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000024d8" }, { "name": "KeyInformation", "value": "7_\\xffea\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00L\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00I\\x00n\\x00t\\x00e\\x00r\\x00n\\x00a\\x00l\\x00.\\x00T\\x00i\\x00l\\x00e\\x00s\\x00.\\x00T\\x00i\\x00l\\x00e\\x00Q\\x00u\\x00e\\x00r\\x00y\\x00F\\x00i\\x00l\\x00t\\x00e\\x00r\\x00\\xffff\\x7f\\x00\\x00\\x0f\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffe0\\xffdd\\xffa3\\x0c\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x15\\x01\\x00\\x00\\x00\\x00\\xffa9\\xfff3 \\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xff8c%\\x01\\x00\\x00\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\xffc4\\x02%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\r%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0EzX\\xffff\\x7f\\x00\\x00X\\x1ap\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\xfff4 \\x03\\x00\\x00\\x00\\x00\\xff87\\xff9dNX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\xfff7\\xffa7\\x0c\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x1ap\\x0c\\x00\\x00\\x00\\x00\\xff90\\xfff7\\xffa7\\x0c\\x00\\x00\\x00\\x00Pd\\xffc8\\x0b\\x00\\x00\\x00\\x00\\xffc7\\xffb3\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\xfff6sNX\\xffff\\x7f\\x00\\x00\\x10\\xffed\\xffa7\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffffPd\\xffc8\\x0b\\x00\\x00\\x00\\x00\\xffe0\\xffea\\xffaa\\x0c\\x00\\x00\\x00\\x00\\xffe0\\xffea\\xffaa\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\xfff7\\xffa7\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x006\\xff8cYX\\xffff\\x7f\\x00\\x00\\x10*\\xff85\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xfff5 \\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xfff5 \\x03\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 6404 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4620", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024d8" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileQueryFilter\\ActivationType" } ], "repeated": 0, "id": 6405 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4620", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000024d8" }, { "name": "ValueName", "value": "Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileQueryFilter\\Server" } ], "repeated": 0, "id": 6406 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4620", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff585700bb", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024d8" }, { "name": "ValueName", "value": "DllPath" }, { "name": "Data", "value": "C:\\Windows\\System32\\TileDataRepository.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileQueryFilter\\DllPath" } ], "repeated": 0, "id": 6407 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff583a44d8", "parentcaller": "0x7fff583a6df6", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002440" }, { "name": "SubKey", "value": "Software\\Microsoft\\CTF\\DirectSwitchHotkeys" }, { "name": "Handle", "value": "0x0000255c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\CTF\\DirectSwitchHotkeys" } ], "repeated": 0, "id": 6408 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4620", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024d8" }, { "name": "ValueName", "value": "Threading" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileQueryFilter\\Threading" } ], "repeated": 0, "id": 6409 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff583a453b", "parentcaller": "0x7fff583a6df6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002440" } ], "repeated": 0, "id": 6410 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff578553d6", "parentcaller": "0x7fff577d2048", "category": "registry", "api": "NtEnumerateKey", "status": false, "return": "0xffffffff8000001a", "pretty_return": "NO_MORE_ENTRIES", "arguments": [ { "name": "KeyHandle", "value": "0x0000255c" }, { "name": "Index", "value": "0" } ], "repeated": 0, "id": 6411 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff583a6e8a", "parentcaller": "0x7fff5839c2b3", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000255c" } ], "repeated": 0, "id": 6412 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4620", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024d8" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileQueryFilter\\TrustLevel" } ], "repeated": 0, "id": 6413 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4620", "caller": "0x7fff584bc0fc", "parentcaller": "0x7fff58554170", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000024d8" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileQueryFilter\\CustomAttributes" } ], "repeated": 0, "id": 6414 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4620", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000024d8" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileQueryFilter\\RemoteServer" } ], "repeated": 0, "id": 6415 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff577cf84f", "parentcaller": "0x7fff583ae663", "category": "synchronization", "api": "NtOpenEvent", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "Handle", "value": "0x0819e830" }, { "name": "EventName", "value": "Local\\1ImmersiveFocusTrackingActiveEvent" } ], "repeated": 0, "id": 6416 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4620", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000024d8" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileQueryFilter\\ActivateAsUser" } ], "repeated": 0, "id": 6417 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5108", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "GetSystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 6418 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5108", "caller": "0x7fff577d6785", "parentcaller": "0x7fff44bd525c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001aa8" } ], "repeated": 0, "id": 6419 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5108", "caller": "0x7fff577d6785", "parentcaller": "0x7fff42570a7d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022fc" } ], "repeated": 0, "id": 6420 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5108", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff426da18b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000ea0" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 6421 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4620", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000024d8" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileQueryFilter\\ActivateInSharedBroker" } ], "repeated": 0, "id": 6422 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4620", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000024d8" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileQueryFilter\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 6423 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff5781026b", "parentcaller": "0x7fff45584920", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000022fc" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000255c" } ], "repeated": 0, "id": 6424 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff45584c45", "parentcaller": "0x7fff45584941", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 6425 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4620", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58562222", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000024d8" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileQueryFilter\\Permissions" } ], "repeated": 0, "id": 6426 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff57fc2eeb", "parentcaller": "0x7fff581ba00f", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "MultimonitorActivationException" }, { "name": "Atom", "value": "0x0000c049" } ], "repeated": 0, "id": 6427 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4620", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000024d8" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileQueryFilter\\ActivateOnHostFlags" } ], "repeated": 0, "id": 6428 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff425ce2da", "parentcaller": "0x7fff4257d46e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 6429 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff57fc2eeb", "parentcaller": "0x7fff581ba00f", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "MultimonitorActivationException" }, { "name": "Atom", "value": "0x0000c049" } ], "repeated": 0, "id": 6430 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 2, "id": 6431 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58085ee4", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001e68" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 6432 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4344", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xfc\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\\x10\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4344" } ], "repeated": 0, "id": 6433 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "10916", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xa4*\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "10916" } ], "repeated": 0, "id": 6434 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4620", "caller": "0x7fff58557226", "parentcaller": "0x7fff5855ca23", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024d8" } ], "repeated": 0, "id": 6435 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4620", "caller": "0x7fff5855dd9d", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000020f8" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000430" }, { "name": "ObjectAttributesName", "value": "Windows.Internal.StateRepository.TileViewQueryFilter" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileViewQueryFilter" } ], "repeated": 0, "id": 6436 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4620", "caller": "0x7fff5855ddf7", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000020f8" }, { "name": "KeyInformation", "value": "\\xfffci\\x0e\\xffd4\\xffde\\xffac\\xffd5\\x01\\x00\\x00\\x00\\x00h\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00I\\x00n\\x00t\\x00e\\x00r\\x00n\\x00a\\x00l\\x00.\\x00S\\x00t\\x00a\\x00t\\x00e\\x00R\\x00e\\x00p\\x00o\\x00s\\x00i\\x00t\\x00o\\x00r\\x00y\\x00.\\x00T\\x00i\\x00l\\x00e\\x00V\\x00i\\x00e\\x00w\\x00Q\\x00u\\x00e\\x00r\\x00y\\x00F\\x00i\\x00l\\x00t\\x00e\\x00r\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x15\\x01\\x00\\x00\\x00\\x00i\\xfff0 \\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\xff8b%\\x01\\x00\\x00\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\xffc4\\x02%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\r%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0EzX\\xffff\\x7f\\x00\\x00\\xffb8\\xffb2\\xfff3\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xfff1 \\x03\\x00\\x00\\x00\\x00\\xff87\\xff9dNX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xffb1\\xfff3\\x08\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\xffb2\\xfff3\\x08\\x00\\x00\\x00\\x00p\\xffb1\\xfff3\\x08\\x00\\x00\\x00\\x00\\x00wy\\x0c\\x00\\x00\\x00\\x00\\xffc7\\xffb3\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\xfff6sNX\\xffff\\x7f\\x00\\x00 \\xffc5\\xffac\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\x00wy\\x0c\\x00\\x00\\x00\\x00\\xff90\\xffdcs\\x0c\\x00\\x00\\x00\\x00\\xff90\\xffdcs\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xffb1\\xfff3\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x006\\xff8cYX\\xffff\\x7f\\x00\\x00 ;|\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xfff2 \\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xfff2 \\x03\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 6437 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4620", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000020f8" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileViewQueryFilter\\ActivationType" } ], "repeated": 0, "id": 6438 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4620", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000020f8" }, { "name": "ValueName", "value": "Server" }, { "name": "Data", "value": "StateRepository" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileViewQueryFilter\\Server" } ], "repeated": 0, "id": 6439 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4620", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff585700bb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000020f8" }, { "name": "ValueName", "value": "DllPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileViewQueryFilter\\DllPath" } ], "repeated": 0, "id": 6440 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4620", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000020f8" }, { "name": "ValueName", "value": "Threading" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileViewQueryFilter\\Threading" } ], "repeated": 0, "id": 6441 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4620", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000020f8" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileViewQueryFilter\\TrustLevel" } ], "repeated": 0, "id": 6442 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4620", "caller": "0x7fff584bc0fc", "parentcaller": "0x7fff58554170", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000020f8" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileViewQueryFilter\\CustomAttributes" } ], "repeated": 0, "id": 6443 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4620", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000020f8" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileViewQueryFilter\\RemoteServer" } ], "repeated": 0, "id": 6444 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4620", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000020f8" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileViewQueryFilter\\ActivateAsUser" } ], "repeated": 0, "id": 6445 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4620", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000020f8" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileViewQueryFilter\\ActivateInSharedBroker" } ], "repeated": 0, "id": 6446 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4620", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000020f8" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileViewQueryFilter\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 6447 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4620", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58562222", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000020f8" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileViewQueryFilter\\Permissions" } ], "repeated": 0, "id": 6448 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4620", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000020f8" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileViewQueryFilter\\ActivateOnHostFlags" } ], "repeated": 0, "id": 6449 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4620", "caller": "0x7fff58557226", "parentcaller": "0x7fff5855ca23", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000020f8" } ], "repeated": 0, "id": 6450 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4500", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 6451 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4344", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xfc\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\\x10\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4344" } ], "repeated": 0, "id": 6452 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "6160", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 6453 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbd423", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000024d8" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 6454 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "6148", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x18\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6148" } ], "repeated": 0, "id": 6455 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff41dbd59f", "parentcaller": "0x7fff41dfc80c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001aa8" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "\\Device\\Bam" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 6456 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff41dbd603", "parentcaller": "0x7fff41dfc80c", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001aa8" }, { "name": "HandleName", "value": "\\Device\\Bam" }, { "name": "IoControlCode", "value": "0x00220004" }, { "name": "InputBuffer", "value": "\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd8$\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 6457 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "10916", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000100c4" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 1, "id": 6458 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "6160", "caller": "0x7fff428f7085", "parentcaller": "0x7fff4260a359", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "6B3B8D23-FA8D-40B9-8DBD-B950333E2C52" }, { "name": "ClsContext", "value": "0x00000004", "pretty_value": "CLSCTX_LOCAL_SERVER" }, { "name": "riid", "value": "6D5140C1-7436-11CE-8034-00AA006009FA" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 6459 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "10916", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000100c4" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 6460 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4696", "caller": "0x7ff79bc20e9e", "parentcaller": "0x7ff79bc20de0", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "TaskbarMonitor" }, { "name": "Atom", "value": "0x0000c045" } ], "repeated": 0, "id": 6461 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4696", "caller": "0x7ff79bc4d822", "parentcaller": "0x7ff79bc20f36", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 6462 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 6463 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4620", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0cb3f000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6464 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbddbb", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000020f8" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "6136" }, { "name": "ProcessName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe" } ], "repeated": 0, "id": 6465 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbddbb", "category": "process", "api": "NtOpenProcess", "status": false, "return": "0xffffffffc0000022", "pretty_return": "ACCESS_DENIED", "arguments": [ { "name": "ProcessHandle", "value": "0x000020f8" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "1048" } ], "repeated": 0, "id": 6466 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbddbb", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000022fc" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 6467 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbddbb", "category": "process", "api": "NtOpenProcess", "status": false, "return": "0xffffffffc0000022", "pretty_return": "ACCESS_DENIED", "arguments": [ { "name": "ProcessHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "1180" } ], "repeated": 0, "id": 6468 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbddbb", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000255c" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "5624" }, { "name": "ProcessName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe" } ], "repeated": 0, "id": 6469 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbddbb", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002440" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "5128" }, { "name": "ProcessName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe" } ], "repeated": 0, "id": 6470 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbddbb", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001af4" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "6400" }, { "name": "ProcessName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe" } ], "repeated": 0, "id": 6471 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 1, "id": 6472 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4344", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xfc\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\\x10\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4344" } ], "repeated": 0, "id": 6473 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 2, "id": 6474 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4344", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xfc\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\\x10\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4344" } ], "repeated": 0, "id": 6475 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 1, "id": 6476 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4344", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xfc\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\\x10\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4344" } ], "repeated": 0, "id": 6477 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 1, "id": 6478 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4344", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xfc\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\\x10\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4344" } ], "repeated": 0, "id": 6479 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 1, "id": 6480 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4344", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xfc\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\\x10\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4344" } ], "repeated": 0, "id": 6481 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 1, "id": 6482 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4344", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xfc\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\\x10\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4344" } ], "repeated": 0, "id": 6483 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 1, "id": 6484 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4344", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xfc\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\\x10\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4344" } ], "repeated": 0, "id": 6485 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 1, "id": 6486 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4344", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xfc\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\\x10\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4344" } ], "repeated": 2, "id": 6487 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff41dbe842", "parentcaller": "0x7fff41dbd62c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001ac4" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "\\Device\\Bam" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 6488 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4344", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xfc\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\\x10\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4344" } ], "repeated": 1, "id": 6489 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff41dbe8a3", "parentcaller": "0x7fff41dbd62c", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001ac4" }, { "name": "HandleName", "value": "\\Device\\Bam" }, { "name": "IoControlCode", "value": "0x00220004" }, { "name": "InputBuffer", "value": "\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf8 \\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfc\"\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9c\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\%\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@$\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf4\\x1a\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 6490 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff41dbe9a9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000020f8" } ], "repeated": 0, "id": 6491 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4344", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xfc\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\\x10\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4344" } ], "repeated": 0, "id": 6492 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff41dbe9a9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022fc" } ], "repeated": 0, "id": 6493 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff41dbe9a9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000255c" } ], "repeated": 0, "id": 6494 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff41dbe9a9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002440" } ], "repeated": 0, "id": 6495 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4344", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xfc\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\\x10\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4344" } ], "repeated": 0, "id": 6496 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff41dbe9a9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af4" } ], "repeated": 0, "id": 6497 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff41dbe9d8", "parentcaller": "0x7fff41dbd62c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ac4" } ], "repeated": 0, "id": 6498 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4344", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xfc\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\\x10\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4344" } ], "repeated": 0, "id": 6499 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff41dbd63b", "parentcaller": "0x7fff41dfc80c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001aa8" } ], "repeated": 0, "id": 6500 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024d8" } ], "repeated": 0, "id": 6501 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4344", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xfc\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\\x10\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4344" } ], "repeated": 0, "id": 6502 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4500", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 6503 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff5489080f", "parentcaller": "0x7fff5486709a", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00010128" }, { "name": "Message", "value": "0x00000060" } ], "repeated": 0, "id": 6504 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4696", "caller": "0x7ff79bc20f57", "parentcaller": "0x7ff79bc20de0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 2, "id": 6505 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff5489080f", "parentcaller": "0x7fff5486709a", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00010128" }, { "name": "Message", "value": "0x00000060" } ], "repeated": 0, "id": 6506 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4344", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xfc\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\\x10\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4344" } ], "repeated": 2, "id": 6507 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff42595b7f", "parentcaller": "0x7fff42595b24", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CloudExperienceHost" }, { "name": "Handle", "value": "0x00002454" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CloudExperienceHost" } ], "repeated": 0, "id": 6508 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002454" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6509 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4344", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xfc\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\\x10\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4344" } ], "repeated": 0, "id": 6510 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00002454" }, { "name": "ObjectAttributesName", "value": "Fullscreen" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CloudExperienceHost\\Fullscreen" } ], "repeated": 0, "id": 6511 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff426bfce2", "parentcaller": "0x7fff42595b24", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002454" } ], "repeated": 0, "id": 6512 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4344", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xfc\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\\x10\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4344" } ], "repeated": 1, "id": 6513 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff42595b7f", "parentcaller": "0x7fff42595b24", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CloudExperienceHost" }, { "name": "Handle", "value": "0x00002454" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CloudExperienceHost" } ], "repeated": 0, "id": 6514 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002454" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6515 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4344", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xfc\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\\x10\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4344" } ], "repeated": 0, "id": 6516 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00002454" }, { "name": "ObjectAttributesName", "value": "Fullscreen" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CloudExperienceHost\\Fullscreen" } ], "repeated": 0, "id": 6517 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4344", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xfc\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\\x10\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4344" } ], "repeated": 0, "id": 6518 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff42595b7f", "parentcaller": "0x7fff42595b24", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CloudExperienceHost" }, { "name": "Handle", "value": "0x00002454" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CloudExperienceHost" } ], "repeated": 0, "id": 6519 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002454" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6520 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00002454" }, { "name": "ObjectAttributesName", "value": "Fullscreen" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CloudExperienceHost\\Fullscreen" } ], "repeated": 0, "id": 6521 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4344", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xfc\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\\x10\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4344" } ], "repeated": 0, "id": 6522 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff426bfce2", "parentcaller": "0x7fff42595b24", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002454" } ], "repeated": 0, "id": 6523 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4344", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xfc\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\\x10\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4344" } ], "repeated": 1, "id": 6524 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff42595b7f", "parentcaller": "0x7fff42595b24", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CloudExperienceHost" }, { "name": "Handle", "value": "0x00002454" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CloudExperienceHost" } ], "repeated": 0, "id": 6525 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4344", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xfc\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\\x10\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4344" } ], "repeated": 0, "id": 6526 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00002454" }, { "name": "ObjectAttributesName", "value": "Fullscreen" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CloudExperienceHost\\Fullscreen" } ], "repeated": 0, "id": 6527 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4344", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xfc\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\\x10\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4344" } ], "repeated": 0, "id": 6528 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff426bfce2", "parentcaller": "0x7fff42595b24", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002454" } ], "repeated": 0, "id": 6529 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4344", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xfc\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\\x10\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4344" } ], "repeated": 0, "id": 6530 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff42595b7f", "parentcaller": "0x7fff42595b24", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CloudExperienceHost" }, { "name": "Handle", "value": "0x00002454" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CloudExperienceHost" } ], "repeated": 0, "id": 6531 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002454" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6532 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4344", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xfc\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\\x10\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4344" } ], "repeated": 0, "id": 6533 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00002454" }, { "name": "ObjectAttributesName", "value": "Fullscreen" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CloudExperienceHost\\Fullscreen" } ], "repeated": 0, "id": 6534 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4344", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xfc\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\\x10\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4344" } ], "repeated": 0, "id": 6535 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff426bfce2", "parentcaller": "0x7fff42595b24", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002454" } ], "repeated": 0, "id": 6536 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4344", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xfc\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\\x10\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4344" } ], "repeated": 0, "id": 6537 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff42592452", "parentcaller": "0x7fff425c65cb", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00010094" }, { "name": "Message", "value": "0x000005d1" } ], "repeated": 0, "id": 6538 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff5855dd9d", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002454" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000430" }, { "name": "ObjectAttributesName", "value": "Windows.Foundation.Collections.ValueSet" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet" } ], "repeated": 0, "id": 6539 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff5855ddf7", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002454" }, { "name": "KeyInformation", "value": "\\xff97\\xfffc\\xffe7\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00N\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00F\\x00o\\x00u\\x00n\\x00d\\x00a\\x00t\\x00i\\x00o\\x00n\\x00.\\x00C\\x00o\\x00l\\x00l\\x00e\\x00c\\x00t\\x00i\\x00o\\x00n\\x00s\\x00.\\x00V\\x00a\\x00l\\x00u\\x00e\\x00S\\x00e\\x00t\\x00\\x00\\x00\\x02\\x00\\x12\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\xffc3\\x1a\\x01\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x15\\x01\\x00\\x00\\x00\\x00\\xffd9\\xffda\\x19\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff8d%\\x01\\x00\\x00\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\xffc4\\x02%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0\r%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0EzX\\xffff\\x7f\\x00\\x00\\x18g\\xffa4\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0\\xffdb\\x19\\x08\\x00\\x00\\x00\\x00\\xff87\\xff9dNX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb05\\xffb3\\x0c\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff0f\\xffa4\\x0c\\x00\\x00\\x00\\x00\\xffb05\\xffb3\\x0c\\x00\\x00\\x00\\x00\\xffb0\\x1d\\xffb3\\x0c\\x00\\x00\\x00\\x00\\xffc7\\xffb3\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\xfff6sNX\\xffff\\x7f\\x00\\x000N\\xffb3\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffb0\\x1d\\xffb3\\x0c\\x00\\x00\\x00\\x00`\\xffde\\xffd8\\x08\\x00\\x00\\x00\\x00`\\xffde\\xffd8\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb05\\xffb3\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x006\\xff8cYX\\xffff\\x7f\\x00\\x00pH\\xffc8\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffa0\\xffdc\\x19\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffa0\\xffdc\\x19\\x08\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 6540 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4344", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xfc\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\\x10\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4344" } ], "repeated": 0, "id": 6541 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002454" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\ActivationType" } ], "repeated": 0, "id": 6542 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002454" }, { "name": "ValueName", "value": "Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\Server" } ], "repeated": 0, "id": 6543 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff585700bb", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002454" }, { "name": "ValueName", "value": "DllPath" }, { "name": "Data", "value": "C:\\Windows\\System32\\WinTypes.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\DllPath" } ], "repeated": 0, "id": 6544 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002454" }, { "name": "ValueName", "value": "Threading" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\Threading" } ], "repeated": 0, "id": 6545 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002454" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\TrustLevel" } ], "repeated": 0, "id": 6546 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff584bc0fc", "parentcaller": "0x7fff58554170", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00002454" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\CustomAttributes" } ], "repeated": 0, "id": 6547 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002454" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\RemoteServer" } ], "repeated": 0, "id": 6548 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002454" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\ActivateAsUser" } ], "repeated": 0, "id": 6549 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002454" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\ActivateInSharedBroker" } ], "repeated": 0, "id": 6550 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002454" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 6551 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58562222", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002454" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\Permissions" } ], "repeated": 0, "id": 6552 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002454" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\ActivateOnHostFlags" } ], "repeated": 0, "id": 6553 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff58557226", "parentcaller": "0x7fff5855ca23", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002454" } ], "repeated": 0, "id": 6554 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff5855dd9d", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002454" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000430" }, { "name": "ObjectAttributesName", "value": "Windows.Storage.Streams.DataWriter" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter" } ], "repeated": 0, "id": 6555 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff5855ddf7", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002454" }, { "name": "KeyInformation", "value": "N\\xffc1\\xffec\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00D\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00S\\x00t\\x00o\\x00r\\x00a\\x00g\\x00e\\x00.\\x00S\\x00t\\x00r\\x00e\\x00a\\x00m\\x00s\\x00.\\x00D\\x00a\\x00t\\x00a\\x00W\\x00r\\x00i\\x00t\\x00e\\x00r\\x00\\x00\\x00\\x00\\x00k\\xffb8\\xfff7Y\\xffff\\x7f\\x00\\x00\\x01\\x00\\x1a\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\xffc3\\x1a\\x01\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x15\\x01\\x00\\x00\\x00\\x00Y\\xffd6\\x19\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff8d%\\x01\\x00\\x00\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\xffc4\\x02%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0\r%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0EzX\\xffff\\x7f\\x00\\x00h\\\\xffa4\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xffd7\\x19\\x08\\x00\\x00\\x00\\x00\\xff87\\xff9dNX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffa0\\xffe3\\xffd8\\x08\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\\\xffa4\\x0c\\x00\\x00\\x00\\x00\\xffa0\\xffe3\\xffd8\\x08\\x00\\x00\\x00\\x00\\xffb0\\x1b\\xffb3\\x0c\\x00\\x00\\x00\\x00\\xffc7\\xffb3\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\xfff6sNX\\xffff\\x7f\\x00\\x0007\\xffb3\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffb0\\x1b\\xffb3\\x0c\\x00\\x00\\x00\\x00`\\xffde\\xffd8\\x08\\x00\\x00\\x00\\x00`\\xffde\\xffd8\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffa0\\xffe3\\xffd8\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00Y\\x1a\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x006\\xff8cYX\\xffff\\x7f\\x00\\x00pH\\xffc8\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\xffd8\\x19\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\xffd8\\x19\\x08\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 6556 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002454" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivationType" } ], "repeated": 0, "id": 6557 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002454" }, { "name": "ValueName", "value": "Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\Server" } ], "repeated": 0, "id": 6558 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff577d3e41", "parentcaller": "0x7fff578543b9", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002454" }, { "name": "ValueName", "value": "DllPath" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "C:\\Windows\\System32\\WinTypes.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\DllPath" } ], "repeated": 0, "id": 6559 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4620", "caller": "0x7fff4cbd12d2", "parentcaller": "0x7fff577adf5c", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache" }, { "name": "Handle", "value": "0x00002488" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache" } ], "repeated": 0, "id": 6560 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002454" }, { "name": "ValueName", "value": "Threading" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\Threading" } ], "repeated": 0, "id": 6561 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4620", "caller": "0x7fff4cbd1a81", "parentcaller": "0x7fff4cbd138a", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002488" }, { "name": "SubKey", "value": "Metadata" }, { "name": "Handle", "value": "0x0000237c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Metadata" } ], "repeated": 0, "id": 6562 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002454" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\TrustLevel" } ], "repeated": 0, "id": 6563 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002454" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6564 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577af579", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002488" }, { "name": "SubKey", "value": "Package\\Index\\PackageFullName\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" }, { "name": "Handle", "value": "0x00002458" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Index\\PackageFullName\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" } ], "repeated": 0, "id": 6565 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00002454" }, { "name": "ObjectAttributesName", "value": "CustomAttributes" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\CustomAttributes" } ], "repeated": 0, "id": 6566 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4620", "caller": "0x7fff4cbd1732", "parentcaller": "0x7fff577af7dc", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002458" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "22" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Index\\PackageFullName\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\22" } ], "repeated": 0, "id": 6567 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4620", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577af5fd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002458" } ], "repeated": 0, "id": 6568 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002454" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateAsUser" } ], "repeated": 0, "id": 6569 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4620", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff57815e8b", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x10\\x82y\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00" } ], "repeated": 0, "id": 6570 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002454" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateInSharedBroker" } ], "repeated": 0, "id": 6571 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002454" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 6572 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4620", "caller": "0x7fff4cbd1732", "parentcaller": "0x7fff577af7dc", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002458" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "3" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\User\\Index\\UserSid\\S-1-5-21-3968686040-3210279463-847977608-1001\\3" } ], "repeated": 0, "id": 6573 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4620", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577aec6d", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002458" } ], "repeated": 0, "id": 6574 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002454" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateOnHostFlags" } ], "repeated": 0, "id": 6575 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577ae9b0", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00002488" }, { "name": "SubKey", "value": "PackageExternalLocation\\Index\\UserAndPackage\\3^22" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\PackageExternalLocation\\Index\\UserAndPackage\\3^22" } ], "repeated": 0, "id": 6576 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff58557226", "parentcaller": "0x7fff5855ca23", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002454" } ], "repeated": 0, "id": 6577 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577ae9b0", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00002488" }, { "name": "SubKey", "value": "PackageExternalLocation\\Index\\UserAndPackage\\0^22" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\PackageExternalLocation\\Index\\UserAndPackage\\0^22" } ], "repeated": 0, "id": 6578 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4344", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xfc\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\\x10\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4344" } ], "repeated": 0, "id": 6579 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577af308", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002488" }, { "name": "SubKey", "value": "Package\\Data\\22" }, { "name": "Handle", "value": "0x00002458" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\22" } ], "repeated": 0, "id": 6580 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4620", "caller": "0x7fff4cbd15ac", "parentcaller": "0x7fff4cbd14ff", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002458" }, { "name": "ValueName", "value": "InstalledLocation" }, { "name": "Data", "value": "C:\\Windows\\SystemApps\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\22\\InstalledLocation" } ], "repeated": 0, "id": 6581 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4620", "caller": "0x7fff4cbd15ac", "parentcaller": "0x7fff4cbd14ff", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002458" }, { "name": "ValueName", "value": "MutableLink" }, { "name": "Data", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\22\\MutableLink" } ], "repeated": 0, "id": 6582 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4620", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577aed38", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002458" } ], "repeated": 0, "id": 6583 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4620", "caller": "0x7fff4cbd17f2", "parentcaller": "0x7fff577ae12f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000237c" } ], "repeated": 0, "id": 6584 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 6585 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4620", "caller": "0x7fff577d43a6", "parentcaller": "0x7fff4cbd180b", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" } ], "repeated": 0, "id": 6586 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58085ee4", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001e68" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 6587 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4620", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache" }, { "name": "Handle", "value": "0x00002488" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache" } ], "repeated": 0, "id": 6588 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "6148", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x18\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6148" } ], "repeated": 0, "id": 6589 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4620", "caller": "0x7fff4cbd1a81", "parentcaller": "0x7fff4cbd138a", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002488" }, { "name": "SubKey", "value": "Metadata" }, { "name": "Handle", "value": "0x0000237c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Metadata" } ], "repeated": 0, "id": 6590 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577af579", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002488" }, { "name": "SubKey", "value": "Package\\Index\\PackageFullName\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" }, { "name": "Handle", "value": "0x00002458" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Index\\PackageFullName\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" } ], "repeated": 0, "id": 6591 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4620", "caller": "0x7fff4cbd1732", "parentcaller": "0x7fff577af7dc", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002458" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "22" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Index\\PackageFullName\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\22" } ], "repeated": 0, "id": 6592 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4620", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577af5fd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002458" } ], "repeated": 0, "id": 6593 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "6148", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x18\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6148" } ], "repeated": 0, "id": 6594 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4620", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff57815e2d", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 6595 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4620", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff57815e8b", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x90yy\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00" } ], "repeated": 0, "id": 6596 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d0446", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 6597 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577aebe9", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002488" }, { "name": "SubKey", "value": "User\\Index\\UserSid\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "Handle", "value": "0x00002458" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\User\\Index\\UserSid\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 6598 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "6148", "caller": "0x7fff5781026b", "parentcaller": "0x7fff517e2c2a", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002438" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000024c0" } ], "repeated": 0, "id": 6599 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "6148", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff517e2c87", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 6600 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "6148", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024c0" } ], "repeated": 0, "id": 6601 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4620", "caller": "0x7fff4cbd1732", "parentcaller": "0x7fff577af7dc", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002458" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "3" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\User\\Index\\UserSid\\S-1-5-21-3968686040-3210279463-847977608-1001\\3" } ], "repeated": 0, "id": 6602 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "6148", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff517e29b1", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002438" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "5624" }, { "name": "ProcessName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe" } ], "repeated": 0, "id": 6603 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4620", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577aec6d", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002458" } ], "repeated": 0, "id": 6604 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024d8" }, { "name": "ValueName", "value": "TraySearchBoxVisible" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Buffer", "value": "0" }, { "name": "BufferLength", "value": "4" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\TraySearchBoxVisible" } ], "repeated": 0, "id": 6605 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "6148", "caller": "0x7fff59f9416d", "parentcaller": "0x7fff517e2a39", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "31" }, { "name": "TokenInformation", "value": "\\xf8\\xecQ\r\\x00\\x00\\x00\\x00\\x01\\x08\\x00\\x00\\x00\\x00\\x00\\x0f\\x02\\x00\\x00\\x00\\xdb\\xb8\\xbe\\x1e\\xb9\\x86\\x9f\\xa9\\x87m\\xb7o\\xc0W\\x08\r\\x15\\x81Y.\\xfc\\x10\\x92\\xffX\\xc90\\x088$\\x00\\x00\\x00\\x00\\x00\\x00\\xc2Tc\\x1a\\xff\\x7f\\x00\\x008$\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 6606 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "6148", "caller": "0x7fff59f941a8", "parentcaller": "0x7fff517e2a39", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "42" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 6607 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff577d43a6", "parentcaller": "0x7fff427435c1", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024d8" } ], "repeated": 0, "id": 6608 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "6148", "caller": "0x7fff59f941df", "parentcaller": "0x7fff517e2a39", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "12" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 6609 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577ae9b0", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00002488" }, { "name": "SubKey", "value": "PackageExternalLocation\\Index\\UserAndPackage\\0^22" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\PackageExternalLocation\\Index\\UserAndPackage\\0^22" } ], "repeated": 0, "id": 6610 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "6148", "caller": "0x7fff577d6785", "parentcaller": "0x7fff517e2a75", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 6611 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4620", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002488" }, { "name": "KeyInformation", "value": "\\x00\\x01\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6612 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "6148", "caller": "0x7fff577cf588", "parentcaller": "0x7fff517ead8b", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002438" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "Global\\Session\\1\\AppContainerNamedObjects\\S-1-15-2-515815643-2845804217-1874292103-218650560-777617685-4287762684-137415000\\15f8HWNDInterface:10170" } ], "repeated": 0, "id": 6613 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4620", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002458" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00002488" }, { "name": "ObjectAttributesName", "value": "Package\\Data\\22" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\22" } ], "repeated": 0, "id": 6614 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000024d8" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced" } ], "repeated": 0, "id": 6615 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "6160", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 6616 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "6148", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0cb42000" }, { "name": "RegionSize", "value": "0x00011000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6617 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff425e8fa6", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000024d8" }, { "name": "ValueName", "value": "TaskbarSmallIcons" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\TaskbarSmallIcons" } ], "repeated": 0, "id": 6618 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff577d3018", "parentcaller": "0x7fff425e8fa6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024d8" } ], "repeated": 0, "id": 6619 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4620", "caller": "0x7fff4cbd15ac", "parentcaller": "0x7fff4cbd14ff", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002458" }, { "name": "ValueName", "value": "MutableLink" }, { "name": "Data", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\22\\MutableLink" } ], "repeated": 0, "id": 6620 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 6621 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4620", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577aed38", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002458" } ], "repeated": 0, "id": 6622 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff577d3b20", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 6623 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4620", "caller": "0x7fff4cbd17f2", "parentcaller": "0x7fff577ae12f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000237c" } ], "repeated": 0, "id": 6624 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4620", "caller": "0x7fff4cbd180b", "parentcaller": "0x7fff577ae12f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" } ], "repeated": 0, "id": 6625 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" } ], "repeated": 0, "id": 6626 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 6627 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "6160", "caller": "0x7fff428f25a2", "parentcaller": "0x7fff4260a36f", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "6B3B8D23-FA8D-40B9-8DBD-B950333E2C52" }, { "name": "ClsContext", "value": "0x00000004", "pretty_value": "CLSCTX_LOCAL_SERVER" }, { "name": "riid", "value": "6D5140C1-7436-11CE-8034-00AA006009FA" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 6628 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff577d3b20", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 6629 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6630 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000024d8" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" } ], "repeated": 0, "id": 6631 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000024d8" }, { "name": "ValueName", "value": "Current" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Current" } ], "repeated": 0, "id": 6632 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "6148", "caller": "0x7fff4cbd1a81", "parentcaller": "0x7fff4cbd138a", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002438" }, { "name": "SubKey", "value": "Metadata" }, { "name": "Handle", "value": "0x000024c0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Metadata" } ], "repeated": 0, "id": 6633 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "6148", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002438" }, { "name": "KeyInformation", "value": "\\x00\\x01\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6634 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff5855dd9d", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000024d8" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000430" }, { "name": "ObjectAttributesName", "value": "Windows.UI.ViewManagement.UISettings" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.ViewManagement.UISettings" } ], "repeated": 0, "id": 6635 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000024d8" }, { "name": "KeyInformation", "value": "N\\xffc1\\xffec\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00H\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00U\\x00I\\x00.\\x00V\\x00i\\x00e\\x00w\\x00M\\x00a\\x00n\\x00a\\x00g\\x00e\\x00m\\x00e\\x00n\\x00t\\x00.\\x00U\\x00I\\x00S\\x00e\\x00t\\x00t\\x00i\\x00n\\x00g\\x00s\\x00k\\xffb8\\xfff7Y\\xffff\\x7f\\x00\\x00\\x01\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xffa0\\xffd6\\x08\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x15\\x01\\x00\\x00\\x00\\x00\\xff89\\xffd7\\x19\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff8d%\\x01\\x00\\x00\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\xffc4\\x02%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0\r%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0EzX\\xffff\\x7f\\x00\\x00\\xff88(\\xff82\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xffd8\\x19\\x08\\x00\\x00\\x00\\x00\\xff87\\xff9dNX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0\\x1c\\xff80\\x0c\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`(\\xff82\\x0c\\x00\\x00\\x00\\x00\\xffb0\\x1c\\xff80\\x0c\\x00\\x00\\x00\\x000\\x18\\xffb3\\x0c\\x00\\x00\\x00\\x00\\xffc7\\xffb3\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\xfff6sNX\\xffff\\x7f\\x00\\x0003\\xffb3\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff0\\x18\\xffb3\\x0c\\x00\\x00\\x00\\x00\\x10\\x1a\\xff80\\x0c\\x00\\x00\\x00\\x00\\x10\\x1a\\xff80\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0\\x1c\\xff80\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x19\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x006\\xff8cYX\\xffff\\x7f\\x00\\x00\\xffa0@\\xffc8\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xffd9\\x19\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xffd9\\x19\\x08\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 6636 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "6148", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "1f" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Index\\PackageFullName\\Microsoft.Windows.StartMenuExperienceHost_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\1f" } ], "repeated": 0, "id": 6637 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 6638 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "6148", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577af5fd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" } ], "repeated": 0, "id": 6639 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024d8" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.ViewManagement.UISettings\\ActivationType" } ], "repeated": 0, "id": 6640 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "6148", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577af308", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002438" }, { "name": "SubKey", "value": "Package\\Data\\1f" }, { "name": "Handle", "value": "0x00002488" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\1f" } ], "repeated": 0, "id": 6641 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff585700bb", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024d8" }, { "name": "ValueName", "value": "DllPath" }, { "name": "Data", "value": "C:\\Windows\\System32\\Windows.UI.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.ViewManagement.UISettings\\DllPath" } ], "repeated": 0, "id": 6642 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "6148", "caller": "0x7fff4cbd16ad", "parentcaller": "0x7fff5781d320", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" }, { "name": "ValueName", "value": "PackageOrigin" }, { "name": "Data", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\1f\\PackageOrigin" } ], "repeated": 0, "id": 6643 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024d8" }, { "name": "ValueName", "value": "Threading" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.ViewManagement.UISettings\\Threading" } ], "repeated": 0, "id": 6644 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "6148", "caller": "0x7fff577d43a6", "parentcaller": "0x7fff4cbd17f2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024c0" } ], "repeated": 0, "id": 6645 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024d8" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.ViewManagement.UISettings\\TrustLevel" } ], "repeated": 0, "id": 6646 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff584bc0fc", "parentcaller": "0x7fff58554170", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000024d8" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.ViewManagement.UISettings\\CustomAttributes" } ], "repeated": 0, "id": 6647 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4344", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff517e2bd6", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002454" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "6136" }, { "name": "ProcessName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe" } ], "repeated": 0, "id": 6648 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4344", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff517e2c87", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 6649 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000024d8" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.ViewManagement.UISettings\\RemoteServer" } ], "repeated": 0, "id": 6650 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4344", "caller": "0x7fff577d6785", "parentcaller": "0x7fff517e2cd5", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002454" } ], "repeated": 0, "id": 6651 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4344", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff517e29b1", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002454" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "6136" }, { "name": "ProcessName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe" } ], "repeated": 0, "id": 6652 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000024d8" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.ViewManagement.UISettings\\ActivateAsUser" } ], "repeated": 0, "id": 6653 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4344", "caller": "0x7fff5781026b", "parentcaller": "0x7fff517e29fb", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002454" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00001acc" } ], "repeated": 0, "id": 6654 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4344", "caller": "0x7fff59f9416d", "parentcaller": "0x7fff517e2a39", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "31" }, { "name": "TokenInformation", "value": "\\xf8\\xe8\\xee\t\\x00\\x00\\x00\\x00\\x01\\x08\\x00\\x00\\x00\\x00\\x00\\x0f\\x02\\x00\\x00\\x00<\\xe6\\xf3\\x1f\\x8a.\\x82*u\\xa8\\x8a?\\x1b(\\xed\\xbf9\\x8fA\\x14\\x0c\\xfc9u]5\n`T$\\x00\\x00\\x00\\x00\\x00\\x00\\xc2Tc\\x1a\\xff\\x7f\\x00\\x00T$\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 6655 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4620", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 6656 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4344", "caller": "0x7fff59f941a8", "parentcaller": "0x7fff517e2a39", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "42" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 6657 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4620", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6658 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4344", "caller": "0x7fff59f94256", "parentcaller": "0x7fff517e2a39", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "44" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x0b\\xe4s^t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xe8\\xee\\xee\t\\x00\\x00\\x00\\x00\\xf8\\x17\\x00\\x00\\x00\\x00\\x00\\x000a\\x88\\x10\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 6659 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000024d8" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.ViewManagement.UISettings\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 6660 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4344", "caller": "0x7fff577d6785", "parentcaller": "0x7fff517e2a75", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002454" } ], "repeated": 0, "id": 6661 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4620", "caller": "0x7fff577b26e8", "parentcaller": "0x7fff577b279b", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xf7 \\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00c\\x00r\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00l\\x00i\\x00e\\x00n\\x00t\\x00.\\x00C\\x00B\\x00S\\x00_\\x001\\x000\\x000\\x000\\x00.\\x001\\x009\\x000\\x005\\x003\\x00" } ], "repeated": 0, "id": 6662 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4620", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 6663 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58562222", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000024d8" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.ViewManagement.UISettings\\Permissions" } ], "repeated": 0, "id": 6664 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4344", "caller": "0x7fff577cf588", "parentcaller": "0x7fff517ead8b", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002454" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "Global\\Session\\1\\AppContainerNamedObjects\\S-1-15-2-536077884-713174666-1066051701-3219990555-339840825-1966734348-1611281757\\17f8HWNDInterface:1019e" } ], "repeated": 0, "id": 6665 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4620", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001258" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6666 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4620", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000237c" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00001258" }, { "name": "ObjectAttributesName", "value": "S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 6667 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4620", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000237c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6668 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff58557226", "parentcaller": "0x7fff5855ca23", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024d8" } ], "repeated": 0, "id": 6669 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4620", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002458" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x0000237c" }, { "name": "ObjectAttributesName", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" } ], "repeated": 0, "id": 6670 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4620", "caller": "0x7fff577b4086", "parentcaller": "0x7fff577b27b6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000237c" } ], "repeated": 0, "id": 6671 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4344", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff517eae5e", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0b290000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 6672 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4344", "caller": "0x7fff577d6785", "parentcaller": "0x7fff517eae6d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002454" } ], "repeated": 0, "id": 6673 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4620", "caller": "0x7fff577b40c3", "parentcaller": "0x7fff577b27b6", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002458" }, { "name": "ValueName", "value": "PackageStatus" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\PackageStatus" } ], "repeated": 0, "id": 6674 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff4bfd299f", "parentcaller": "0x7fff425e9098", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Accessibility" }, { "name": "Handle", "value": "0x000024d8" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Accessibility" } ], "repeated": 0, "id": 6675 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4620", "caller": "0x7fff577b40d4", "parentcaller": "0x7fff577b27b6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002458" } ], "repeated": 0, "id": 6676 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff4bfd2a24", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000024d8" }, { "name": "ValueName", "value": "TextScaleFactor" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Accessibility\\TextScaleFactor" } ], "repeated": 0, "id": 6677 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024d8" } ], "repeated": 0, "id": 6678 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000024d8" }, { "name": "ValueName", "value": "Current" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Current" } ], "repeated": 0, "id": 6679 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4344", "caller": "0x7fff577d3b20", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 6680 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff577d3018", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024d8" } ], "repeated": 0, "id": 6681 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4344", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6682 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 6683 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4344", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002458" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache" } ], "repeated": 0, "id": 6684 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff577d3b20", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 6685 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6686 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" } ], "repeated": 0, "id": 6687 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 6688 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 6689 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4344", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002458" }, { "name": "SubKey", "value": "Package\\Index\\PackageFullName\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy" }, { "name": "Handle", "value": "0x00001190" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Index\\PackageFullName\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy" } ], "repeated": 0, "id": 6690 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6691 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4344", "caller": "0x7fff4cbd1732", "parentcaller": "0x7fff577af7dc", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001190" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "1a" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Index\\PackageFullName\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\\1a" } ], "repeated": 0, "id": 6692 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024d8" } ], "repeated": 0, "id": 6693 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4344", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577af5fd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001190" } ], "repeated": 0, "id": 6694 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 6695 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4344", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577af308", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002458" }, { "name": "SubKey", "value": "Package\\Data\\1a" }, { "name": "Handle", "value": "0x00001190" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\1a" } ], "repeated": 0, "id": 6696 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6697 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "6148", "caller": "0x7fff59f93f7a", "parentcaller": "0x7fff59770ed7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 6698 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4344", "caller": "0x7fff4cbd16ad", "parentcaller": "0x7fff5781d320", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001190" }, { "name": "ValueName", "value": "PackageOrigin" }, { "name": "Data", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\1a\\PackageOrigin" } ], "repeated": 0, "id": 6699 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4620", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 6700 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "6148", "caller": "0x7fff59770cd1", "parentcaller": "0x7fff597a1530", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x000024cc" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 6701 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4344", "caller": "0x7fff59f88cde", "parentcaller": "0x7fff59fc9c4e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": " \\xf1\\x02\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 6702 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4344", "caller": "0x7fff59fb6e9b", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xe0C\\xa9\\x0c\\x00\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00F\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\xeb\\x1c\\xc9\\x11\\x9f\\xe8\\x08\\x00+\\x10H`\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00e\\x00r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00;\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 6703 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "6148", "caller": "0x7fff5781026b", "parentcaller": "0x7fff59770daf", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000024c0" } ], "repeated": 0, "id": 6704 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff4bfd299f", "parentcaller": "0x7fff425e9098", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Accessibility" }, { "name": "Handle", "value": "0x000024d8" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Accessibility" } ], "repeated": 0, "id": 6705 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4344", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "H\\x15\\xa9\\x0c\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 6706 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "6148", "caller": "0x7fff59f88cde", "parentcaller": "0x7fff59fc9c4e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": " \\xf1\\x02\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 6707 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4344", "caller": "0x7fff59fb6f37", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 6708 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff4bfd2a6a", "parentcaller": "0x7fff425e9098", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024d8" } ], "repeated": 0, "id": 6709 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "6148", "caller": "0x7fff59fb6e46", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\x98e\\xe5\\x08\\x00\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x04]\\x88\\x8a\\xeb\\x1c\\xc9\\x11\\x9f\\xe8\\x08\\x00+\\x10H`\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00;\\x00\\x00\\x00" } ], "repeated": 0, "id": 6710 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4344", "caller": "0x7fff59fb707b", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd8\\xd1\\xee\t\\x00\\x00\\x00\\x00\\x00\\x00\\x15\\x01\\x00\\x00\\x00\\x00\\xb9\\x00$\\x1a\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xd8\\xcf\\xee\t\\x00\\x00\\x00\\x00|#\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00$\\x1a\\xff\\x7f\\x00\\x00\\xef\\xbf\\xbf\\xf7\\xfe\\xff\\xf3\\xf7|#\\x00\\x00" } ], "repeated": 0, "id": 6711 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6712 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4344", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": " \\xf1\\x02\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 6713 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4344", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\xd8R\\xa9\\x0c\\x00\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x04]\\x88\\x8a\\xeb\\x1c\\xc9\\x11\\x9f\\xe8\\x08\\x00+\\x10H`\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00;\\x00\\x00\\x00" } ], "repeated": 0, "id": 6714 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" } ], "repeated": 0, "id": 6715 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4344", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 6716 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4344", "caller": "0x7fff59fb6f0e", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\x88\\x14\\xa9\\x0c\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 6717 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "6148", "caller": "0x7fff59fb6f0e", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xf8\\x16}\\x0c\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 6718 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000024d8" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" } ], "repeated": 0, "id": 6719 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4344", "caller": "0x7fff59fb6f37", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 6720 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4344", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\x98S\\xa9\\x0c\\x00\\x00\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 6721 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "6148", "caller": "0x7fff59fb6f37", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 6722 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4344", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x81\\x1a\\xff\\x7f\\x00\\x00\\xebPY\\x1a\\xff\\x7f\\x00\\x00\\x08(\\xe4s^t\\x00\\x00(N}\\x1a\\xff\\x7f\\x00\\x00P\\xce\\xee\t\\x00\\x00\\x00\\x00H\\xce\\xee\t\\x00\\x00\\x00\\x00\\x18\\xce\\xee\t\\x00\\x00\\x00\\x008\\xce\\xee\t" } ], "repeated": 0, "id": 6723 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff577d3018", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024d8" } ], "repeated": 0, "id": 6724 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4344", "caller": "0x7fff577d6785", "parentcaller": "0x7fff59770e27", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002458" } ], "repeated": 0, "id": 6725 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4344", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000237c" } ], "repeated": 0, "id": 6726 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 6727 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4344", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "NtQuerySystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 6728 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6729 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "6148", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": " \\xf1\\x02\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 6730 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" } ], "repeated": 0, "id": 6731 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "6148", "caller": "0x7fff59fb6e9b", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\x80d\\xe5\\x08\\x00\\x00\\x00\\x00`\\x00\\x00\\x00YIED\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\xeb\\x1c\\xc9\\x11\\x9f\\xe8\\x08\\x00+\\x10H`\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00r\\x00e\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00;\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 6732 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff577d3b20", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 6733 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 6734 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6735 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "6148", "caller": "0x7fff59fb6ec0", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 6736 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "6148", "caller": "0x7fff59fb6f0e", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "x\\x12}\\x0c\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 6737 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "6148", "caller": "0x7fff59fb6f37", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 6738 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 6739 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "6148", "caller": "0x7fff59fb6f8f", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\x18j\\xe5\\x08\\x00\\x00\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 6740 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4636", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5809da8f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001e68" } ], "repeated": 0, "id": 6741 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "6148", "caller": "0x7fff59fb7048", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x81\\x1a\\xff\\x7f\\x00\\x00\\xebPY\\x1a\\xff\\x7f\\x00\\x00\\x08$[w^t\\x00\\x00(N}\\x1a\\xff\\x7f\\x00\\x00P\\xd2Q\r\\x00\\x00\\x00\\x00H\\xd2Q\r\\x00\\x00\\x00\\x00\\x18\\xd2Q\r\\x00\\x00\\x00\\x008\\xd2Q\r" } ], "repeated": 0, "id": 6742 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "9572", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00d%\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "9572" } ], "repeated": 0, "id": 6743 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "6148", "caller": "0x7fff59fb707b", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10j\\xe5\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8Z\\x1a\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x008\\xd0Q\r\\x00\\x00\\x00\\x00\\xc0$\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00$\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2}\\x1a" } ], "repeated": 0, "id": 6744 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff57fc2a0e", "parentcaller": "0x7fff581d409e", "category": "synchronization", "api": "NtAddAtomEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "UIA_WindowVisibilityOverridden" }, { "name": "Atom", "value": "0x0000c042" } ], "repeated": 0, "id": 6745 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "6148", "caller": "0x7fff577d6785", "parentcaller": "0x7fff59770e27", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024cc" } ], "repeated": 0, "id": 6746 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 6747 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "6148", "caller": "0x7fff577d6785", "parentcaller": "0x7fff59770e49", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024c0" } ], "repeated": 0, "id": 6748 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4576", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\x11\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4576" } ], "repeated": 0, "id": 6749 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "6148", "caller": "0x7fff597a1630", "parentcaller": "0x7fff597a12cd", "category": "system", "api": "NtQuerySystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 6750 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 6751 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4576", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000177c" }, { "name": "ValueName", "value": "ZvpebfbsgJvaqbjf.Pyvrag.POF_pj5a1u2gklrjl!CnpxntrZrgnqngn" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\ZvpebfbsgJvaqbjf.Pyvrag.POF_pj5a1u2gklrjl!CnpxntrZrgnqngn" } ], "repeated": 1, "id": 6752 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4576", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\x11\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4576" } ], "repeated": 0, "id": 6753 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4560", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\x11\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4560" } ], "repeated": 0, "id": 6754 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 6755 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000404" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 6756 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4560", "caller": "0x7fff42597dbd", "parentcaller": "0x7fff42595ce9", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "25" }, { "name": "ProcessInformation", "value": "\\x00" } ], "repeated": 0, "id": 6757 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 6758 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58085ee4", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002048" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 6759 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 6760 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4560", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\x11\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4560" } ], "repeated": 0, "id": 6761 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 6762 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff57fcb8ed", "parentcaller": "0x7fff58085341", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x00001838", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x7fff580853d0" }, { "name": "Parameter", "value": "0x04b8a790" }, { "name": "CreationFlags", "value": "0x00000004" }, { "name": "ThreadId", "value": "12852" }, { "name": "ProcessId", "value": "4484" } ], "repeated": 0, "id": 6763 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff5781f430", "parentcaller": "0x7fff58085379", "category": "threading", "api": "NtResumeThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00001838" }, { "name": "SuspendCount", "value": "1" }, { "name": "ThreadId", "value": "12852" }, { "name": "ProcessId", "value": "4484" } ], "repeated": 0, "id": 6764 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff58085394", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001838" } ], "repeated": 0, "id": 6765 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58085f99", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001acc" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 6766 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 6767 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 6768 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000404" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 6769 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "12852", "caller": "0x7fff59fc507d", "parentcaller": "0x7fff59fc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 6770 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "12852", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7fff580853d0" }, { "name": "Parameter", "value": "0x04b8a790" } ], "repeated": 0, "id": 6771 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "12852", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x0042\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "12852" } ], "repeated": 0, "id": 6772 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 6773 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4500", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 6774 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6775 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001e68" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CloudExperienceHost" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CloudExperienceHost" } ], "repeated": 0, "id": 6776 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001e68" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6777 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00001e68" }, { "name": "ObjectAttributesName", "value": "Fullscreen" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CloudExperienceHost\\Fullscreen" } ], "repeated": 0, "id": 6778 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff426bfce2", "parentcaller": "0x7fff42595b24", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001e68" } ], "repeated": 0, "id": 6779 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4696", "caller": "0x7ff79bc4d822", "parentcaller": "0x7ff79bc20feb", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 6780 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "5000", "caller": "0x7fff5489080f", "parentcaller": "0x7fff5486709a", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00010128" }, { "name": "Message", "value": "0x00000060" } ], "repeated": 0, "id": 6781 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4696", "caller": "0x7ff79bc21348", "parentcaller": "0x7ff79bc21032", "category": "misc", "api": "GetCursorPos", "status": true, "return": "0x00000001", "arguments": [ { "name": "x", "value": "549" }, { "name": "y", "value": "702" } ], "repeated": 0, "id": 6782 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4696", "caller": "0x7ff79bc21768", "parentcaller": "0x7ff79bc215c3", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "TrayRaisedWindowProp" }, { "name": "Atom", "value": "0x0000c06d" } ], "repeated": 4, "id": 6783 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4500", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 6784 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "12852", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5978ef53", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000237c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 6785 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4696", "caller": "0x7ff79bc4d757", "parentcaller": "0x7ff79bc21410", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 2, "id": 6786 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "6148", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x18\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6148" } ], "repeated": 0, "id": 6787 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4696", "caller": "0x7ff79bc4d782", "parentcaller": "0x7ff79bc21410", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 1, "id": 6788 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 6789 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000360" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 6790 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "12852", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 4, "id": 6791 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 6792 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000404" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 6793 }, { "timestamp": "2026-05-29 01:05:24,337", "thread_id": "4500", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 1, "id": 6794 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4696", "caller": "0x7ff79bd39ee3", "parentcaller": "0x7ff79bc1757f", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000034a" }, { "name": "SubKey", "value": "CLSID\\{11659A23-5884-4D1B-9CF6-67D6F4F90B36}" }, { "name": "Handle", "value": "0x00001e6a" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{11659A23-5884-4D1B-9CF6-67D6F4F90B36}" } ], "repeated": 0, "id": 6795 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "12852", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 6796 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4696", "caller": "0x7ff79bd39ee3", "parentcaller": "0x7ff79bc1757f", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001e6a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 6797 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4696", "caller": "0x7ff79bd39ee3", "parentcaller": "0x7ff79bc1757f", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001e6a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6798 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4696", "caller": "0x7ff79bd39ee3", "parentcaller": "0x7ff79bc1757f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x90\\xc3\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00j\\x1e\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xc4\\\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 6799 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4696", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\TreatAs" } ], "repeated": 0, "id": 6800 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "12852", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 6801 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4696", "caller": "0x7ff79bd39ee3", "parentcaller": "0x7ff79bc1757f", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001e6a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6802 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4696", "caller": "0x7ff79bd39ee3", "parentcaller": "0x7ff79bc1757f", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00001e6a" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\TreatAs" } ], "repeated": 0, "id": 6803 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 6804 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000404" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 6805 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "12852", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x0042\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "12852" } ], "repeated": 0, "id": 6806 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4696", "caller": "0x7ff79bd39ee3", "parentcaller": "0x7ff79bc1757f", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001e6a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 6807 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4696", "caller": "0x7ff79bd39ee3", "parentcaller": "0x7ff79bc1757f", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001e6a" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 6808 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4696", "caller": "0x7ff79bd39ee3", "parentcaller": "0x7ff79bc1757f", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001e6a" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\(Default)" } ], "repeated": 0, "id": 6809 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4696", "caller": "0x7ff79bd39ee3", "parentcaller": "0x7ff79bc1757f", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001e6a" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "Ptype_PSFactory" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\(Default)" } ], "repeated": 0, "id": 6810 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4696", "caller": "0x7ff79bd39ee3", "parentcaller": "0x7ff79bc1757f", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00001e6a" }, { "name": "SubKey", "value": "InprocServer32" }, { "name": "Handle", "value": "0x0000183a" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\InprocServer32" } ], "repeated": 0, "id": 6811 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4696", "caller": "0x7ff79bd39ee3", "parentcaller": "0x7ff79bc1757f", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000183a" }, { "name": "ValueName", "value": "InprocServer32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\InProcServer32\\InprocServer32" } ], "repeated": 0, "id": 6812 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4696", "caller": "0x7ff79bd39ee3", "parentcaller": "0x7ff79bc1757f", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000183a" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 6813 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4696", "caller": "0x7ff79bd39ee3", "parentcaller": "0x7ff79bc1757f", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000183a" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "C:\\Windows\\System32\\WinTypes.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 6814 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4696", "caller": "0x7ff79bd39ee3", "parentcaller": "0x7ff79bc1757f", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000183a" }, { "name": "ValueName", "value": "ThreadingModel" }, { "name": "Data", "value": "Both" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\InProcServer32\\ThreadingModel" } ], "repeated": 0, "id": 6815 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4696", "caller": "0x7ff79bd39ee3", "parentcaller": "0x7ff79bc1757f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000183a" } ], "repeated": 0, "id": 6816 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4696", "caller": "0x7ff79bd39ee3", "parentcaller": "0x7ff79bc1757f", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001e6a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 6817 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4696", "caller": "0x7ff79bd39ee3", "parentcaller": "0x7ff79bc1757f", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001e6a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6818 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4696", "caller": "0x7ff79bd39ee3", "parentcaller": "0x7ff79bc1757f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xc2\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00j\\x1e\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\xc3\\\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 6819 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4696", "caller": "0x7ff79bd39ee3", "parentcaller": "0x7ff79bc1757f", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\InprocHandler32" } ], "repeated": 0, "id": 6820 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4696", "caller": "0x7ff79bd39ee3", "parentcaller": "0x7ff79bc1757f", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001e6a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6821 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4696", "caller": "0x7ff79bd39ee3", "parentcaller": "0x7ff79bc1757f", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00001e6a" }, { "name": "ObjectAttributesName", "value": "InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\InprocHandler32" } ], "repeated": 0, "id": 6822 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4696", "caller": "0x7ff79bd39ee3", "parentcaller": "0x7ff79bc1757f", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001e6a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 6823 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4696", "caller": "0x7ff79bd39ee3", "parentcaller": "0x7ff79bc1757f", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001e6a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6824 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4696", "caller": "0x7ff79bd39ee3", "parentcaller": "0x7ff79bc1757f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xc2\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00j\\x1e\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\xc3\\\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 6825 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4696", "caller": "0x7ff79bd39ee3", "parentcaller": "0x7ff79bc1757f", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\InprocHandler" } ], "repeated": 0, "id": 6826 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4696", "caller": "0x7ff79bd39ee3", "parentcaller": "0x7ff79bc1757f", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001e6a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6827 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4696", "caller": "0x7ff79bd39ee3", "parentcaller": "0x7ff79bc1757f", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00001e6a" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\InprocHandler" } ], "repeated": 0, "id": 6828 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4696", "caller": "0x7ff79bd39ee3", "parentcaller": "0x7ff79bc1757f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001e6a" } ], "repeated": 0, "id": 6829 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4696", "caller": "0x7ff79bd3a64b", "parentcaller": "0x7ff79bd3a979", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\xf9\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00X\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x01\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4696" } ], "repeated": 0, "id": 6830 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4576", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\x11\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4576" } ], "repeated": 0, "id": 6831 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4696", "caller": "0x7ff79bc69ac0", "parentcaller": "0x7ff79bc69f41", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 6832 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4696", "caller": "0x7ff79bc69b1e", "parentcaller": "0x7ff79bc69f41", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 6833 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4696", "caller": "0x7ff79bc69b1e", "parentcaller": "0x7ff79bc69f41", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6834 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4696", "caller": "0x7ff79bc69b1e", "parentcaller": "0x7ff79bc69f41", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001e68" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" } ], "repeated": 0, "id": 6835 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4576", "caller": "0x7fff58520e98", "parentcaller": "0x7fff5855be33", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 6836 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4696", "caller": "0x7ff79bc69b1e", "parentcaller": "0x7ff79bc69f41", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001e68" }, { "name": "ValueName", "value": "ColorPrevalence" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\\ColorPrevalence" } ], "repeated": 0, "id": 6837 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4696", "caller": "0x7ff79bc69b1e", "parentcaller": "0x7ff79bc69f41", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001e68" } ], "repeated": 0, "id": 6838 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4696", "caller": "0x7ff79bc69b4c", "parentcaller": "0x7ff79bc69f41", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "0\\xe4\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xf7\\x7f\\x00\\x00\\x88\\x84\\xfc\\x9b\\xf7\\x7f\\x00\\x00\\x88\\x84\\xfc\\x9b\\xf7\\x7f\\x00\\x00h\\x1e\\x00\\x00\\x00\\x00\\x00\\x00\\xb9E[\\x1a\\xff\\x7f\\x00\\x00\\x80\\xe4\\\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 6839 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4696", "caller": "0x7ff79bc69b4c", "parentcaller": "0x7ff79bc69f41", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001e68" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 6840 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4696", "caller": "0x7ff79bc69b4c", "parentcaller": "0x7ff79bc69f41", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001e68" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6841 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4696", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001838" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00001e68" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" } ], "repeated": 0, "id": 6842 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4636", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 6843 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4636", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000404" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 6844 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4576", "caller": "0x7fff58520e98", "parentcaller": "0x7fff5855be33", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000100c4" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 6845 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4500", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 6846 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4696", "caller": "0x7ff79bc69b4c", "parentcaller": "0x7ff79bc69f41", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001838" }, { "name": "ValueName", "value": "SystemUsesLightTheme" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\\SystemUsesLightTheme" } ], "repeated": 0, "id": 6847 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4696", "caller": "0x7ff79bc69b4c", "parentcaller": "0x7ff79bc69f41", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001838" } ], "repeated": 0, "id": 6848 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4500", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 6849 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4696", "caller": "0x7ff79bc69b4c", "parentcaller": "0x7ff79bc69f41", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001e68" } ], "repeated": 0, "id": 6850 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "5000", "caller": "0x7fff57fc2755", "parentcaller": "0x7fff57fc2699", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "{\\x00C\\x005\\x006\\x00C\\x005\\x007\\x009\\x009\\x00-\\x004\\x00B\\x00B\\x003\\x00-\\x007\\x00F\\x00A\\x00E\\x00-\\x007\\x00F\\x00A\\x00D\\x00-\\x004\\x00D\\x00B\\x002\\x00F\\x006\\x00A\\x005\\x003\\x00E\\x00F\\x00F\\x00}\\x00" }, { "name": "Size", "value": "76" }, { "name": "Atom", "value": "0x0000c05f" } ], "repeated": 0, "id": 6851 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4696", "caller": "0x7ff79bc69bb6", "parentcaller": "0x7ff79bc69f41", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 6852 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4500", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xfe\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x94\\x11\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4500" } ], "repeated": 0, "id": 6853 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4696", "caller": "0x7ff79bc69bb6", "parentcaller": "0x7ff79bc69f41", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001e68" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" } ], "repeated": 0, "id": 6854 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "5000", "caller": "0x7fff57fc2755", "parentcaller": "0x7fff57fc2699", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "{\\x00C\\x005\\x006\\x00C\\x005\\x007\\x009\\x009\\x00-\\x004\\x00B\\x00B\\x003\\x00-\\x007\\x00F\\x00A\\x00E\\x00-\\x007\\x00F\\x00A\\x00D\\x00-\\x004\\x00D\\x00B\\x002\\x00F\\x006\\x00A\\x005\\x003\\x00E\\x00F\\x00F\\x00}\\x00" }, { "name": "Size", "value": "76" }, { "name": "Atom", "value": "0x0000c05f" } ], "repeated": 0, "id": 6855 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4696", "caller": "0x7ff79bc69bb6", "parentcaller": "0x7ff79bc69f41", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001e68" }, { "name": "ValueName", "value": "EnableTransparency" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\\EnableTransparency" } ], "repeated": 0, "id": 6856 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "6096", "caller": "0x7fff58520e98", "parentcaller": "0x7fff5859b785", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 6857 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4696", "caller": "0x7ff79bc69bb6", "parentcaller": "0x7ff79bc69f41", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001e68" } ], "repeated": 0, "id": 6858 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "5000", "caller": "0x7fff5781026b", "parentcaller": "0x7fff517e2c2a", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002458" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00001190" } ], "repeated": 0, "id": 6859 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "5000", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff517e2c87", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 6860 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff517e2cbb", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001190" } ], "repeated": 0, "id": 6861 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4696", "caller": "0x7ff79bc69ac0", "parentcaller": "0x7ff79bc69c05", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 6862 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff517e2cd5", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002458" } ], "repeated": 0, "id": 6863 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 6864 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000404" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 6865 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4696", "caller": "0x7ff79bc69b1e", "parentcaller": "0x7ff79bc69c05", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 6866 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "5000", "caller": "0x7fff5781026b", "parentcaller": "0x7fff517e29fb", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002458" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00001190" } ], "repeated": 0, "id": 6867 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "5000", "caller": "0x7fff59f9413e", "parentcaller": "0x7fff517e2a39", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 6868 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "5000", "caller": "0x7fff59f9416d", "parentcaller": "0x7fff517e2a39", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "31" }, { "name": "TokenInformation", "value": "\\x98\\xdf\\x19\\x08\\x00\\x00\\x00\\x00\\x01\\x08\\x00\\x00\\x00\\x00\\x00\\x0f\\x02\\x00\\x00\\x00<\\xe6\\xf3\\x1f\\x8a.\\x82*u\\xa8\\x8a?\\x1b(\\xed\\xbf9\\x8fA\\x14\\x0c\\xfc9u]5\n`X$\\x00\\x00\\x00\\x00\\x00\\x00\\xc2Tc\\x1a\\xff\\x7f\\x00\\x00X$\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 6869 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4696", "caller": "0x7ff79bc69b1e", "parentcaller": "0x7ff79bc69c05", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6870 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "5000", "caller": "0x7fff59f941df", "parentcaller": "0x7fff517e2a39", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "12" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 6871 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4696", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001e68" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" } ], "repeated": 0, "id": 6872 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff517e2a75", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002458" } ], "repeated": 0, "id": 6873 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 6874 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000404" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 6875 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "5000", "caller": "0x7fff577cf588", "parentcaller": "0x7fff517ead8b", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002458" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "Global\\Session\\1\\AppContainerNamedObjects\\S-1-15-2-536077884-713174666-1066051701-3219990555-339840825-1966734348-1611281757\\17f8HWNDInterface:1019e" } ], "repeated": 0, "id": 6876 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4696", "caller": "0x7ff79bc69b1e", "parentcaller": "0x7ff79bc69c05", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001e68" }, { "name": "ValueName", "value": "ColorPrevalence" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\\ColorPrevalence" } ], "repeated": 0, "id": 6877 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "5000", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c232", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002458" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0b290000" }, { "name": "SectionOffset", "value": "0x0819e510" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6878 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4696", "caller": "0x7ff79bc69b1e", "parentcaller": "0x7ff79bc69c05", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001e68" } ], "repeated": 0, "id": 6879 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 6880 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000404" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 6881 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4696", "caller": "0x7ff79bc69b4c", "parentcaller": "0x7ff79bc69c05", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xf0\\xe3\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xf7\\x7f\\x00\\x00\\x88\\x84\\xfc\\x9b\\xf7\\x7f\\x00\\x00\\x88\\x84\\xfc\\x9b\\xf7\\x7f\\x00\\x00h\\x1e\\x00\\x00\\x00\\x00\\x00\\x00\\xb9E[\\x1a\\xff\\x7f\\x00\\x00@\\xe4\\\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 6882 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4636", "caller": "0x7fff557b4361", "parentcaller": "0x7fff557b3e47", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 6883 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "5000", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff517eae5e", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0b290000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 6884 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4696", "caller": "0x7ff79bc69b4c", "parentcaller": "0x7ff79bc69c05", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001e68" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 6885 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4636", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5287472a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0xfffffffc" } ], "repeated": 0, "id": 6886 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4696", "caller": "0x7ff79bc69b4c", "parentcaller": "0x7ff79bc69c05", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001e68" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6887 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4636", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xf9\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x1c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4636" } ], "repeated": 0, "id": 6888 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58085ee4", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002048" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 6889 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4696", "caller": "0x7ff79bc69b4c", "parentcaller": "0x7ff79bc69c05", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001838" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00001e68" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" } ], "repeated": 0, "id": 6890 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4696", "caller": "0x7ff79bc69b4c", "parentcaller": "0x7ff79bc69c05", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001838" }, { "name": "ValueName", "value": "SystemUsesLightTheme" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\\SystemUsesLightTheme" } ], "repeated": 0, "id": 6891 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4696", "caller": "0x7ff79bc69b4c", "parentcaller": "0x7ff79bc69c05", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001838" } ], "repeated": 0, "id": 6892 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4696", "caller": "0x7ff79bc69b4c", "parentcaller": "0x7ff79bc69c05", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001e68" } ], "repeated": 0, "id": 6893 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4696", "caller": "0x7ff79bc69bb6", "parentcaller": "0x7ff79bc69c05", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 6894 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4696", "caller": "0x7ff79bc69bb6", "parentcaller": "0x7ff79bc69c05", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6895 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4696", "caller": "0x7ff79bc69bb6", "parentcaller": "0x7ff79bc69c05", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001e68" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" } ], "repeated": 0, "id": 6896 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4696", "caller": "0x7ff79bc69bb6", "parentcaller": "0x7ff79bc69c05", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001e68" }, { "name": "ValueName", "value": "EnableTransparency" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\\EnableTransparency" } ], "repeated": 0, "id": 6897 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4696", "caller": "0x7ff79bc69bb6", "parentcaller": "0x7ff79bc69c05", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001e68" } ], "repeated": 0, "id": 6898 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4696", "caller": "0x7ff79bc8a9d0", "parentcaller": "0x7ff79bc69c32", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 6899 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4696", "caller": "0x7ff79bc8a9d0", "parentcaller": "0x7ff79bc69c32", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001e68" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced" } ], "repeated": 0, "id": 6900 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4696", "caller": "0x7ff79bc8a9d0", "parentcaller": "0x7ff79bc69c32", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00001e68" }, { "name": "ValueName", "value": "UseOLEDTaskbarTransparency" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\UseOLEDTaskbarTransparency" } ], "repeated": 0, "id": 6901 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4696", "caller": "0x7ff79bc8a9d0", "parentcaller": "0x7ff79bc69c32", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001e68" } ], "repeated": 0, "id": 6902 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4696", "caller": "0x7ff79bc69ac0", "parentcaller": "0x7ff79bc6986f", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 6903 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4696", "caller": "0x7ff79bc69b1e", "parentcaller": "0x7ff79bc6986f", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 6904 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "5000", "caller": "0x7fff58519794", "parentcaller": "0x7fff517eb1dd", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "F6C29334-47DC-4397-9150-F549CF1D4861" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 6905 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4696", "caller": "0x7ff79bc69b1e", "parentcaller": "0x7ff79bc6986f", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 6906 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4696", "caller": "0x7ff79bc69b1e", "parentcaller": "0x7ff79bc6986f", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001e68" }, { "name": "ValueName", "value": "ColorPrevalence" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\\ColorPrevalence" } ], "repeated": 0, "id": 6907 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 6908 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4696", "caller": "0x7ff79bc69b1e", "parentcaller": "0x7ff79bc6986f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001e68" } ], "repeated": 0, "id": 6909 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "6160", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x18\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6160" } ], "repeated": 0, "id": 6910 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4696", "caller": "0x7ff79bc69b4c", "parentcaller": "0x7ff79bc6986f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x00\\xe4\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xf7\\x7f\\x00\\x00\\x88\\x84\\xfc\\x9b\\xf7\\x7f\\x00\\x00\\x88\\x84\\xfc\\x9b\\xf7\\x7f\\x00\\x00h\\x1e\\x00\\x00\\x00\\x00\\x00\\x00\\xb9E[\\x1a\\xff\\x7f\\x00\\x00P\\xe4\\\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 6911 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4696", "caller": "0x7ff79bc69b4c", "parentcaller": "0x7ff79bc6986f", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001e68" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 6912 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "6160", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 6913 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4696", "caller": "0x7ff79bc69b4c", "parentcaller": "0x7ff79bc6986f", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001e68" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6914 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4696", "caller": "0x7ff79bc69b4c", "parentcaller": "0x7ff79bc6986f", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001838" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00001e68" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" } ], "repeated": 0, "id": 6915 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "6160", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 6916 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4696", "caller": "0x7ff79bc69b4c", "parentcaller": "0x7ff79bc6986f", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001838" }, { "name": "ValueName", "value": "SystemUsesLightTheme" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\\SystemUsesLightTheme" } ], "repeated": 0, "id": 6917 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4344", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xfc\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\\x10\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4344" } ], "repeated": 0, "id": 6918 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4696", "caller": "0x7ff79bc69b4c", "parentcaller": "0x7ff79bc6986f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001838" } ], "repeated": 0, "id": 6919 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "5000", "caller": "0x7fff4274356a", "parentcaller": "0x7fff42799839", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x00000002", "pretty_value": "KEY_SET_VALUE" }, { "name": "Handle", "value": "0x00002458" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 6920 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4344", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000024d8" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "6136" }, { "name": "ProcessName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe" } ], "repeated": 0, "id": 6921 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "5000", "caller": "0x7fff427435a9", "parentcaller": "0x7fff42799839", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002458" }, { "name": "ValueName", "value": "TraySearchBoxVisible" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Buffer", "value": "0" }, { "name": "BufferLength", "value": "4" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\TraySearchBoxVisible" } ], "repeated": 0, "id": 6922 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4344", "caller": "0x7fff577d6785", "parentcaller": "0x7fff517e2cbb", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001aa8" } ], "repeated": 0, "id": 6923 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4344", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024d8" } ], "repeated": 0, "id": 6924 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "5000", "caller": "0x7fff427435c1", "parentcaller": "0x7fff42799839", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002458" } ], "repeated": 0, "id": 6925 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4696", "caller": "0x7ff79bc69bb6", "parentcaller": "0x7ff79bc6986f", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 6926 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4344", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff517e29b1", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000024d8" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "6136" }, { "name": "ProcessName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe" } ], "repeated": 0, "id": 6927 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 6928 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4344", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000024d8" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00001aa8" } ], "repeated": 0, "id": 6929 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "5000", "caller": "0x7fff577d3b20", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 6930 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4344", "caller": "0x7fff59f9413e", "parentcaller": "0x7fff517e2a39", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 6931 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4696", "caller": "0x7ff79bc69bb6", "parentcaller": "0x7ff79bc6986f", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6932 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4344", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "31" }, { "name": "TokenInformation", "value": "\\xf8\\xe8\\xee\t\\x00\\x00\\x00\\x00\\x01\\x08\\x00\\x00\\x00\\x00\\x00\\x0f\\x02\\x00\\x00\\x00<\\xe6\\xf3\\x1f\\x8a.\\x82*u\\xa8\\x8a?\\x1b(\\xed\\xbf9\\x8fA\\x14\\x0c\\xfc9u]5\n`\\xd8$\\x00\\x00\\x00\\x00\\x00\\x00\\xc2Tc\\x1a\\xff\\x7f\\x00\\x00\\xd8$\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 6933 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6934 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4344", "caller": "0x7fff59f941df", "parentcaller": "0x7fff517e2a39", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "12" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 6935 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4344", "caller": "0x7fff59f94256", "parentcaller": "0x7fff517e2a39", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "44" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x0b\\xe4s^t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xe8\\xee\\xee\t\\x00\\x00\\x00\\x00\\xf8\\x17\\x00\\x00\\x00\\x00\\x00\\x000a\\x88\\x10\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 6936 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4696", "caller": "0x7ff79bc69bb6", "parentcaller": "0x7ff79bc6986f", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001e68" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" } ], "repeated": 0, "id": 6937 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4344", "caller": "0x7fff577d6785", "parentcaller": "0x7fff517e2a75", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024d8" } ], "repeated": 0, "id": 6938 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "5000", "caller": "0x7fff577d3018", "parentcaller": "0x7fff425e8fa6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002458" } ], "repeated": 0, "id": 6939 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4344", "caller": "0x7fff577cf588", "parentcaller": "0x7fff517ead8b", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000024d8" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "Global\\Session\\1\\AppContainerNamedObjects\\S-1-15-2-536077884-713174666-1066051701-3219990555-339840825-1966734348-1611281757\\17f8HWNDInterface:1019e" } ], "repeated": 0, "id": 6940 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 6941 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4696", "caller": "0x7ff79bc69bb6", "parentcaller": "0x7ff79bc6986f", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001e68" }, { "name": "ValueName", "value": "EnableTransparency" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\\EnableTransparency" } ], "repeated": 0, "id": 6942 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4344", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c232", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000024d8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0b290000" }, { "name": "SectionOffset", "value": "0x09eeee70" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6943 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6944 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" } ], "repeated": 0, "id": 6945 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 6946 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4344", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff517eae5e", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0b290000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 6947 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "5000", "caller": "0x7fff577d3b20", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 6948 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc69953", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 6949 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4344", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024d8" } ], "repeated": 0, "id": 6950 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6951 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002458" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" } ], "repeated": 0, "id": 6952 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "5000", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002458" }, { "name": "ValueName", "value": "Current" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Current" } ], "repeated": 0, "id": 6953 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4696", "caller": "0x7ff79bc21348", "parentcaller": "0x7ff79bc2129c", "category": "misc", "api": "GetCursorPos", "status": true, "return": "0x00000001", "arguments": [ { "name": "x", "value": "549" }, { "name": "y", "value": "702" } ], "repeated": 0, "id": 6954 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "5000", "caller": "0x7fff577d3018", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002458" } ], "repeated": 0, "id": 6955 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "5000", "caller": "0x7fff4bfd299f", "parentcaller": "0x7fff425e9098", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Accessibility" }, { "name": "Handle", "value": "0x00002458" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Accessibility" } ], "repeated": 0, "id": 6956 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4576", "caller": "0x7fff58520e98", "parentcaller": "0x7fff5855be33", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000100c4" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 6957 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "5000", "caller": "0x7fff4bfd2a6a", "parentcaller": "0x7fff425e9098", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002458" } ], "repeated": 0, "id": 6958 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 6959 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4344", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache" }, { "name": "Handle", "value": "0x000024d8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache" } ], "repeated": 0, "id": 6960 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "5000", "caller": "0x7fff577d3b20", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 6961 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "5000", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6962 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" } ], "repeated": 0, "id": 6963 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4576", "caller": "0x7fff58520e98", "parentcaller": "0x7fff5855be33", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000100c4" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 6964 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 6965 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6966 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002458" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" } ], "repeated": 0, "id": 6967 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "5000", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002458" }, { "name": "ValueName", "value": "Current" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Current" } ], "repeated": 0, "id": 6968 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4344", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577af5fd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ac4" } ], "repeated": 0, "id": 6969 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "5000", "caller": "0x7fff577d3018", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002458" } ], "repeated": 0, "id": 6970 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "5000", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 6971 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "5000", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002458" }, { "name": "ValueName", "value": "Current" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Current" } ], "repeated": 0, "id": 6972 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "5000", "caller": "0x7fff577d3018", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002458" } ], "repeated": 0, "id": 6973 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4344", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577af308", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000024d8" }, { "name": "SubKey", "value": "Package\\Data\\1a" }, { "name": "Handle", "value": "0x00001e68" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\1a" } ], "repeated": 0, "id": 6974 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4344", "caller": "0x7fff4cbd16ad", "parentcaller": "0x7fff5781d320", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001e68" }, { "name": "ValueName", "value": "PackageOrigin" }, { "name": "Data", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\1a\\PackageOrigin" } ], "repeated": 0, "id": 6975 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 6976 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4576", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\x11\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4576" } ], "repeated": 0, "id": 6977 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4344", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577aed38", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001e68" } ], "repeated": 0, "id": 6978 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6979 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4344", "caller": "0x7fff4cbd17f2", "parentcaller": "0x7fff577adcce", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001aa8" } ], "repeated": 0, "id": 6980 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4344", "caller": "0x7fff577d43a6", "parentcaller": "0x7fff4cbd180b", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024d8" } ], "repeated": 0, "id": 6981 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" } ], "repeated": 0, "id": 6982 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4344", "caller": "0x7fff59770cd1", "parentcaller": "0x7fff597a1530", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x000024d8" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 6983 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4344", "caller": "0x7fff5781026b", "parentcaller": "0x7fff59770daf", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00001aa8" } ], "repeated": 0, "id": 6984 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4344", "caller": "0x7fff59fb6e46", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "Hr\\xa7\\x0c\\x00\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x08\\x16\\xe4R\\xff\\x7f\\x00\\x003\\x00-\\x007\\x00F\\x00A\\x00E\\x00-\\x007\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x004\\x00D\\x00B\\x002\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\x15\\xe4R" } ], "repeated": 0, "id": 6985 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "5000", "caller": "0x7fff4bfd299f", "parentcaller": "0x7fff425e9098", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Accessibility" }, { "name": "Handle", "value": "0x00001ac4" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Accessibility" } ], "repeated": 0, "id": 6986 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4344", "caller": "0x7fff59fb6ec0", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 6987 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff4bfd2a24", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001ac4" }, { "name": "ValueName", "value": "TextScaleFactor" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Accessibility\\TextScaleFactor" } ], "repeated": 0, "id": 6988 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4344", "caller": "0x7fff59fb6f37", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 6989 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "5000", "caller": "0x7fff4bfd2a6a", "parentcaller": "0x7fff425e9098", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ac4" } ], "repeated": 0, "id": 6990 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4344", "caller": "0x7fff59fb6f8f", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xc8v\\xa7\\x0c\\x00\\x00\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 6991 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 6992 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4344", "caller": "0x7fff59fb7048", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x81\\x1a\\xff\\x7f\\x00\\x00\\xebPY\\x1a\\xff\\x7f\\x00\\x00\\xa8$\\xe4s^t\\x00\\x00(N}\\x1a\\xff\\x7f\\x00\\x00\\xf0\\xd1\\xee\t\\x00\\x00\\x00\\x00\\xe8\\xd1\\xee\t\\x00\\x00\\x00\\x00\\xb8\\xd1\\xee\t\\x00\\x00\\x00\\x00\\xd8\\xd1\\xee\t" } ], "repeated": 0, "id": 6993 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6994 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4344", "caller": "0x7fff59fb707b", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0v\\xa7\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8Z\\x1a\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xd8\\xcf\\xee\t\\x00\\x00\\x00\\x00\\xa8\\x1a\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00$\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2}\\x1a" } ], "repeated": 0, "id": 6995 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "5000", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" } ], "repeated": 0, "id": 6996 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4344", "caller": "0x7fff59fb6e46", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "(h\\xa7\\x0c\\x00\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x007\\x00-\\x009\\x005\\x001\\x00A\\x00-\\x000\\x00E\\x004\\x00E\\x00-\\x00E\\x009\\x008\\x00C\\x00E\\x00C\\x004\\x004\\x002\\x00E\\x00C\\x009\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 6997 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 6998 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4344", "caller": "0x7fff59fb6ec0", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 6999 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4344", "caller": "0x7fff59fb6f0e", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\x18\\xfd\\xa6\\x0c\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 7000 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4344", "caller": "0x7fff59fb6f37", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 7001 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "5000", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001ac4" }, { "name": "ValueName", "value": "Current" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Current" } ], "repeated": 0, "id": 7002 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4344", "caller": "0x7fff59fb7048", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x81\\x1a\\xff\\x7f\\x00\\x00\\xebPY\\x1a\\xff\\x7f\\x00\\x00\\x08(\\xe4s^t\\x00\\x00(N}\\x1a\\xff\\x7f\\x00\\x00P\\xce\\xee\t\\x00\\x00\\x00\\x00H\\xce\\xee\t\\x00\\x00\\x00\\x00\\x18\\xce\\xee\t\\x00\\x00\\x00\\x008\\xce\\xee\t" } ], "repeated": 0, "id": 7003 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "5000", "caller": "0x7fff577d3018", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ac4" } ], "repeated": 0, "id": 7004 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4344", "caller": "0x7fff59fb707b", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80t\\xa7\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8Z\\x1a\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x008\\xcc\\xee\t\\x00\\x00\\x00\\x00\\xa8\\x1a\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00$\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x84\\xa2}\\x1a" } ], "repeated": 0, "id": 7005 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 7006 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4344", "caller": "0x7fff577d6785", "parentcaller": "0x7fff59770e27", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024d8" } ], "repeated": 0, "id": 7007 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "5000", "caller": "0x7fff577d3b20", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 7008 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4344", "caller": "0x7fff577d6785", "parentcaller": "0x7fff59770e49", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001aa8" } ], "repeated": 0, "id": 7009 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 7010 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4344", "caller": "0x7fff597a1630", "parentcaller": "0x7fff597a12cd", "category": "system", "api": "NtQuerySystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7011 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" } ], "repeated": 0, "id": 7012 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 7013 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ac4" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" } ], "repeated": 0, "id": 7014 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "5000", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001ac4" }, { "name": "ValueName", "value": "Current" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Current" } ], "repeated": 0, "id": 7015 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "5000", "caller": "0x7fff577d3018", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ac4" } ], "repeated": 0, "id": 7016 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 7017 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 7018 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" } ], "repeated": 0, "id": 7019 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "10916", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xa4*\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "10916" } ], "repeated": 0, "id": 7020 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 7021 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "10916", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "oleaut32.dll" }, { "name": "ModuleHandle", "value": "0x7fff58860000" } ], "repeated": 0, "id": 7022 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 7023 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ac4" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" } ], "repeated": 0, "id": 7024 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "10916", "caller": "0x7fff5809b283", "parentcaller": "0x7fff58088b47", "category": "windows", "api": "PostThreadMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessId", "value": "4484" }, { "name": "ThreadId", "value": "4488" }, { "name": "Message", "value": "0" } ], "repeated": 0, "id": 7025 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "5000", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001ac4" }, { "name": "ValueName", "value": "Current" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Current" } ], "repeated": 0, "id": 7026 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "10916", "caller": "0x7fff5809b283", "parentcaller": "0x7fff58088b47", "category": "windows", "api": "PostThreadMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessId", "value": "4484" }, { "name": "ThreadId", "value": "4488" }, { "name": "Message", "value": "0" } ], "repeated": 0, "id": 7027 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "10916", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5809da8f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002530" } ], "repeated": 0, "id": 7028 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "5000", "caller": "0x7fff577d3018", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ac4" } ], "repeated": 0, "id": 7029 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "10916", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5809da8f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002534" } ], "repeated": 0, "id": 7030 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "10916", "caller": "0x7fff59fa467e", "parentcaller": "0x7fff5781f79a", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "12" }, { "name": "ThreadInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "10916" } ], "repeated": 0, "id": 7031 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 7032 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58085ee4", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ac4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7033 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4500", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xfe\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x94\\x11\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4500" } ], "repeated": 0, "id": 7034 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "10916", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5854360c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002528" } ], "repeated": 0, "id": 7035 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "6160", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 7036 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "6160", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x18\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6160" } ], "repeated": 0, "id": 7037 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4500", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xfe\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x94\\x11\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4500" } ], "repeated": 0, "id": 7038 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4500", "caller": "0x7fff577ce76a", "parentcaller": "0x7fff584cea0e", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "oleaut32.dll" }, { "name": "ModuleHandle", "value": "0x7fff58860000" } ], "repeated": 0, "id": 7039 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4500", "caller": "0x7fff5809b283", "parentcaller": "0x7fff58088b47", "category": "windows", "api": "PostThreadMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessId", "value": "4484" }, { "name": "ThreadId", "value": "4488" }, { "name": "Message", "value": "0" } ], "repeated": 1, "id": 7040 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4500", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5809da8f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 7041 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "10916", "caller": "0x7fff581815b8", "parentcaller": "0x7fff59f69a1d", "category": "misc", "api": "GetKeyboardLayout", "status": true, "return": "0x04090409", "arguments": [ { "name": "KeyboardLayout", "value": "0x00000409" }, { "name": "LanguageName", "value": "English (United States)" } ], "repeated": 0, "id": 7042 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "10916", "caller": "0x7fff577d6785", "parentcaller": "0x7fff597be41e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001c54" } ], "repeated": 0, "id": 7043 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "10916", "caller": "0x7fff577d6785", "parentcaller": "0x7fff597be4e4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002450" } ], "repeated": 0, "id": 7044 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "10916", "caller": "0x7fff59fa469e", "parentcaller": "0x7fff5781f79a", "category": "threading", "api": "NtTerminateThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00000000" }, { "name": "ExitStatus", "value": "0x00000000" }, { "name": "ThreadId", "value": "0" }, { "name": "ProcessId", "value": "0" } ], "repeated": 0, "id": 7045 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 7046 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4344", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xfc\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\\x10\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4344" } ], "repeated": 0, "id": 7047 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4344", "caller": "0x7fff577ce76a", "parentcaller": "0x7fff584cea0e", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "oleaut32.dll" }, { "name": "ModuleHandle", "value": "0x7fff58860000" } ], "repeated": 0, "id": 7048 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4344", "caller": "0x7fff5809b283", "parentcaller": "0x7fff58088b47", "category": "windows", "api": "PostThreadMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessId", "value": "4484" }, { "name": "ThreadId", "value": "4488" }, { "name": "Message", "value": "0" } ], "repeated": 1, "id": 7049 }, { "timestamp": "2026-05-29 01:05:24,352", "thread_id": "4344", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5809da8f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002504" } ], "repeated": 0, "id": 7050 }, { "timestamp": "2026-05-29 01:05:24,368", "thread_id": "4620", "caller": "0x7fff4cbd12d2", "parentcaller": "0x7fff577adf5c", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache" }, { "name": "Handle", "value": "0x00002504" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache" } ], "repeated": 0, "id": 7051 }, { "timestamp": "2026-05-29 01:05:24,368", "thread_id": "4620", "caller": "0x7fff4cbd1a81", "parentcaller": "0x7fff4cbd138a", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002504" }, { "name": "SubKey", "value": "Metadata" }, { "name": "Handle", "value": "0x00002534" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Metadata" } ], "repeated": 0, "id": 7052 }, { "timestamp": "2026-05-29 01:05:24,368", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577af579", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002504" }, { "name": "SubKey", "value": "Package\\Index\\PackageFullName\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" }, { "name": "Handle", "value": "0x00002530" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Index\\PackageFullName\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" } ], "repeated": 0, "id": 7053 }, { "timestamp": "2026-05-29 01:05:24,368", "thread_id": "4620", "caller": "0x7fff4cbd1732", "parentcaller": "0x7fff577af7dc", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002530" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "22" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Index\\PackageFullName\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\22" } ], "repeated": 0, "id": 7054 }, { "timestamp": "2026-05-29 01:05:24,368", "thread_id": "4620", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577af5fd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002530" } ], "repeated": 0, "id": 7055 }, { "timestamp": "2026-05-29 01:05:24,368", "thread_id": "4620", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff57815e2d", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 7056 }, { "timestamp": "2026-05-29 01:05:24,368", "thread_id": "4620", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff57815e8b", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xe0`\\xc8\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\x00-\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00" } ], "repeated": 0, "id": 7057 }, { "timestamp": "2026-05-29 01:05:24,368", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577aebe9", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002504" }, { "name": "SubKey", "value": "User\\Index\\UserSid\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "Handle", "value": "0x00002530" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\User\\Index\\UserSid\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 7058 }, { "timestamp": "2026-05-29 01:05:24,368", "thread_id": "4620", "caller": "0x7fff4cbd1732", "parentcaller": "0x7fff577af7dc", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002530" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "3" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\User\\Index\\UserSid\\S-1-5-21-3968686040-3210279463-847977608-1001\\3" } ], "repeated": 0, "id": 7059 }, { "timestamp": "2026-05-29 01:05:24,368", "thread_id": "4620", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577aec6d", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002530" } ], "repeated": 0, "id": 7060 }, { "timestamp": "2026-05-29 01:05:24,368", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577ae9b0", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00002504" }, { "name": "SubKey", "value": "PackageExternalLocation\\Index\\UserAndPackage\\3^22" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\PackageExternalLocation\\Index\\UserAndPackage\\3^22" } ], "repeated": 0, "id": 7061 }, { "timestamp": "2026-05-29 01:05:24,368", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577ae9b0", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00002504" }, { "name": "SubKey", "value": "PackageExternalLocation\\Index\\UserAndPackage\\0^22" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\PackageExternalLocation\\Index\\UserAndPackage\\0^22" } ], "repeated": 0, "id": 7062 }, { "timestamp": "2026-05-29 01:05:24,368", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577af308", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002504" }, { "name": "SubKey", "value": "Package\\Data\\22" }, { "name": "Handle", "value": "0x00002530" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\22" } ], "repeated": 0, "id": 7063 }, { "timestamp": "2026-05-29 01:05:24,368", "thread_id": "4620", "caller": "0x7fff4cbd15ac", "parentcaller": "0x7fff4cbd14ff", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002530" }, { "name": "ValueName", "value": "InstalledLocation" }, { "name": "Data", "value": "C:\\Windows\\SystemApps\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\22\\InstalledLocation" } ], "repeated": 0, "id": 7064 }, { "timestamp": "2026-05-29 01:05:24,368", "thread_id": "4620", "caller": "0x7fff4cbd15ac", "parentcaller": "0x7fff4cbd14ff", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002530" }, { "name": "ValueName", "value": "MutableLink" }, { "name": "Data", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\22\\MutableLink" } ], "repeated": 0, "id": 7065 }, { "timestamp": "2026-05-29 01:05:24,368", "thread_id": "4620", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577aed38", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002530" } ], "repeated": 0, "id": 7066 }, { "timestamp": "2026-05-29 01:05:24,368", "thread_id": "4620", "caller": "0x7fff4cbd17f2", "parentcaller": "0x7fff577ae12f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002534" } ], "repeated": 0, "id": 7067 }, { "timestamp": "2026-05-29 01:05:24,368", "thread_id": "4620", "caller": "0x7fff4cbd180b", "parentcaller": "0x7fff577ae12f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002504" } ], "repeated": 0, "id": 7068 }, { "timestamp": "2026-05-29 01:05:24,368", "thread_id": "4620", "caller": "0x7fff4cbd12d2", "parentcaller": "0x7fff577adf5c", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache" }, { "name": "Handle", "value": "0x00002504" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache" } ], "repeated": 0, "id": 7069 }, { "timestamp": "2026-05-29 01:05:24,368", "thread_id": "4620", "caller": "0x7fff4cbd1a81", "parentcaller": "0x7fff4cbd138a", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002504" }, { "name": "SubKey", "value": "Metadata" }, { "name": "Handle", "value": "0x00002534" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Metadata" } ], "repeated": 0, "id": 7070 }, { "timestamp": "2026-05-29 01:05:24,368", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577af579", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002504" }, { "name": "SubKey", "value": "Package\\Index\\PackageFullName\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" }, { "name": "Handle", "value": "0x00002530" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Index\\PackageFullName\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" } ], "repeated": 0, "id": 7071 }, { "timestamp": "2026-05-29 01:05:24,368", "thread_id": "4620", "caller": "0x7fff4cbd1732", "parentcaller": "0x7fff577af7dc", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002530" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "22" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Index\\PackageFullName\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\22" } ], "repeated": 0, "id": 7072 }, { "timestamp": "2026-05-29 01:05:24,368", "thread_id": "4620", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577af5fd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002530" } ], "repeated": 0, "id": 7073 }, { "timestamp": "2026-05-29 01:05:24,368", "thread_id": "4620", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff57815e2d", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 7074 }, { "timestamp": "2026-05-29 01:05:24,368", "thread_id": "4620", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff57815e8b", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xe0c\\xc8\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00" } ], "repeated": 0, "id": 7075 }, { "timestamp": "2026-05-29 01:05:24,368", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577aebe9", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002504" }, { "name": "SubKey", "value": "User\\Index\\UserSid\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "Handle", "value": "0x00002530" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\User\\Index\\UserSid\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 7076 }, { "timestamp": "2026-05-29 01:05:24,368", "thread_id": "4620", "caller": "0x7fff4cbd1732", "parentcaller": "0x7fff577af7dc", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002530" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "3" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\User\\Index\\UserSid\\S-1-5-21-3968686040-3210279463-847977608-1001\\3" } ], "repeated": 0, "id": 7077 }, { "timestamp": "2026-05-29 01:05:24,368", "thread_id": "4620", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577aec6d", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002530" } ], "repeated": 0, "id": 7078 }, { "timestamp": "2026-05-29 01:05:24,368", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577ae9b0", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00002504" }, { "name": "SubKey", "value": "PackageExternalLocation\\Index\\UserAndPackage\\3^22" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\PackageExternalLocation\\Index\\UserAndPackage\\3^22" } ], "repeated": 0, "id": 7079 }, { "timestamp": "2026-05-29 01:05:24,368", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577ae9b0", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00002504" }, { "name": "SubKey", "value": "PackageExternalLocation\\Index\\UserAndPackage\\0^22" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\PackageExternalLocation\\Index\\UserAndPackage\\0^22" } ], "repeated": 0, "id": 7080 }, { "timestamp": "2026-05-29 01:05:24,368", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577af308", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002504" }, { "name": "SubKey", "value": "Package\\Data\\22" }, { "name": "Handle", "value": "0x00002530" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\22" } ], "repeated": 0, "id": 7081 }, { "timestamp": "2026-05-29 01:05:24,368", "thread_id": "4620", "caller": "0x7fff4cbd15ac", "parentcaller": "0x7fff4cbd14ff", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002530" }, { "name": "ValueName", "value": "InstalledLocation" }, { "name": "Data", "value": "C:\\Windows\\SystemApps\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\22\\InstalledLocation" } ], "repeated": 0, "id": 7082 }, { "timestamp": "2026-05-29 01:05:24,368", "thread_id": "4620", "caller": "0x7fff4cbd15ac", "parentcaller": "0x7fff4cbd14ff", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002530" }, { "name": "ValueName", "value": "MutableLink" }, { "name": "Data", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\22\\MutableLink" } ], "repeated": 0, "id": 7083 }, { "timestamp": "2026-05-29 01:05:24,368", "thread_id": "4620", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577aed38", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002530" } ], "repeated": 0, "id": 7084 }, { "timestamp": "2026-05-29 01:05:24,368", "thread_id": "4620", "caller": "0x7fff4cbd17f2", "parentcaller": "0x7fff577ae12f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002534" } ], "repeated": 0, "id": 7085 }, { "timestamp": "2026-05-29 01:05:24,368", "thread_id": "4620", "caller": "0x7fff4cbd180b", "parentcaller": "0x7fff577ae12f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002504" } ], "repeated": 0, "id": 7086 }, { "timestamp": "2026-05-29 01:05:24,383", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 7087 }, { "timestamp": "2026-05-29 01:05:24,383", "thread_id": "4620", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 7088 }, { "timestamp": "2026-05-29 01:05:24,383", "thread_id": "4620", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 7089 }, { "timestamp": "2026-05-29 01:05:24,383", "thread_id": "4620", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateChange\\PackageList\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateChange\\PackageList\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" } ], "repeated": 0, "id": 7090 }, { "timestamp": "2026-05-29 01:05:24,383", "thread_id": "4620", "caller": "0x7fff577b26e8", "parentcaller": "0x7fff577b279b", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xf7 \\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00c\\x00r\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00l\\x00i\\x00e\\x00n\\x00t\\x00.\\x00C\\x00B\\x00S\\x00_\\x001\\x000\\x000\\x000\\x00.\\x001\\x009\\x000\\x005\\x003\\x00" } ], "repeated": 0, "id": 7091 }, { "timestamp": "2026-05-29 01:05:24,383", "thread_id": "4620", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 7092 }, { "timestamp": "2026-05-29 01:05:24,383", "thread_id": "4620", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001258" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 7093 }, { "timestamp": "2026-05-29 01:05:24,383", "thread_id": "4620", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002504" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00001258" }, { "name": "ObjectAttributesName", "value": "S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 7094 }, { "timestamp": "2026-05-29 01:05:24,383", "thread_id": "4620", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002504" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 7095 }, { "timestamp": "2026-05-29 01:05:24,383", "thread_id": "4620", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002534" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00002504" }, { "name": "ObjectAttributesName", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" } ], "repeated": 0, "id": 7096 }, { "timestamp": "2026-05-29 01:05:24,383", "thread_id": "4620", "caller": "0x7fff577b4086", "parentcaller": "0x7fff577b27b6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002504" } ], "repeated": 0, "id": 7097 }, { "timestamp": "2026-05-29 01:05:24,383", "thread_id": "4620", "caller": "0x7fff577b40c3", "parentcaller": "0x7fff577b27b6", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002534" }, { "name": "ValueName", "value": "PackageStatus" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\PackageStatus" } ], "repeated": 0, "id": 7098 }, { "timestamp": "2026-05-29 01:05:24,383", "thread_id": "4620", "caller": "0x7fff577b40d4", "parentcaller": "0x7fff577b27b6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002534" } ], "repeated": 0, "id": 7099 }, { "timestamp": "2026-05-29 01:05:24,383", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 7100 }, { "timestamp": "2026-05-29 01:05:24,383", "thread_id": "4620", "caller": "0x7fff54fcd469", "parentcaller": "0x7fff54fcd2ee", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 7101 }, { "timestamp": "2026-05-29 01:05:24,383", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 7102 }, { "timestamp": "2026-05-29 01:05:24,383", "thread_id": "4636", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5809da8f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ac4" } ], "repeated": 0, "id": 7103 }, { "timestamp": "2026-05-29 01:05:24,383", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 7104 }, { "timestamp": "2026-05-29 01:05:24,383", "thread_id": "4636", "caller": "0x7fff58c2c304", "parentcaller": "0x7fff44c012c7", "category": "windows", "api": "SendNotifyMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000100ac" }, { "name": "Message", "value": "0x00000403" } ], "repeated": 0, "id": 7105 }, { "timestamp": "2026-05-29 01:05:24,383", "thread_id": "4636", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xf9\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x1c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4636" } ], "repeated": 0, "id": 7106 }, { "timestamp": "2026-05-29 01:05:24,383", "thread_id": "4720", "caller": "0x7fff58c2ce12", "parentcaller": "0x7fff581be858", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000100ac" }, { "name": "Message", "value": "0x00000404" } ], "repeated": 0, "id": 7107 }, { "timestamp": "2026-05-29 01:05:24,383", "thread_id": "4576", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\x11\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4576" } ], "repeated": 0, "id": 7108 }, { "timestamp": "2026-05-29 01:05:24,383", "thread_id": "4576", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000177c" }, { "name": "ValueName", "value": "ZvpebfbsgJvaqbjf.Pyvrag.POF_pj5a1u2gklrjl!Tybony.Nppbhagf" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\ZvpebfbsgJvaqbjf.Pyvrag.POF_pj5a1u2gklrjl!Tybony.Nppbhagf" } ], "repeated": 1, "id": 7109 }, { "timestamp": "2026-05-29 01:05:24,383", "thread_id": "4576", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\x11\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4576" } ], "repeated": 0, "id": 7110 }, { "timestamp": "2026-05-29 01:05:24,383", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7111 }, { "timestamp": "2026-05-29 01:05:24,383", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000404" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7112 }, { "timestamp": "2026-05-29 01:05:24,383", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7113 }, { "timestamp": "2026-05-29 01:05:24,383", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000404" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7114 }, { "timestamp": "2026-05-29 01:05:24,383", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7115 }, { "timestamp": "2026-05-29 01:05:24,383", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000404" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7116 }, { "timestamp": "2026-05-29 01:05:24,383", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7117 }, { "timestamp": "2026-05-29 01:05:24,383", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000404" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7118 }, { "timestamp": "2026-05-29 01:05:24,383", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7119 }, { "timestamp": "2026-05-29 01:05:24,383", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000404" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7120 }, { "timestamp": "2026-05-29 01:05:24,383", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7121 }, { "timestamp": "2026-05-29 01:05:24,383", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000404" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7122 }, { "timestamp": "2026-05-29 01:05:24,383", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7123 }, { "timestamp": "2026-05-29 01:05:24,383", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000404" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7124 }, { "timestamp": "2026-05-29 01:05:24,383", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7125 }, { "timestamp": "2026-05-29 01:05:24,383", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000404" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7126 }, { "timestamp": "2026-05-29 01:05:24,383", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7127 }, { "timestamp": "2026-05-29 01:05:24,383", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000404" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7128 }, { "timestamp": "2026-05-29 01:05:24,383", "thread_id": "4636", "caller": "0x7fff557b4361", "parentcaller": "0x7fff557b3e47", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7129 }, { "timestamp": "2026-05-29 01:05:24,383", "thread_id": "4636", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5287472a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0xfffffffc" } ], "repeated": 0, "id": 7130 }, { "timestamp": "2026-05-29 01:05:24,383", "thread_id": "4636", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xf9\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x1c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4636" } ], "repeated": 0, "id": 7131 }, { "timestamp": "2026-05-29 01:05:24,383", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58085ee4", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002048" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7132 }, { "timestamp": "2026-05-29 01:05:24,383", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 7133 }, { "timestamp": "2026-05-29 01:05:24,383", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 7134 }, { "timestamp": "2026-05-29 01:05:24,383", "thread_id": "4620", "caller": "0x7fff4cbd12d2", "parentcaller": "0x7fff577adf5c", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache" }, { "name": "Handle", "value": "0x00002534" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache" } ], "repeated": 0, "id": 7135 }, { "timestamp": "2026-05-29 01:05:24,383", "thread_id": "4620", "caller": "0x7fff4cbd1a81", "parentcaller": "0x7fff4cbd138a", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002534" }, { "name": "SubKey", "value": "Metadata" }, { "name": "Handle", "value": "0x00001ac4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Metadata" } ], "repeated": 0, "id": 7136 }, { "timestamp": "2026-05-29 01:05:24,383", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577af579", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002534" }, { "name": "SubKey", "value": "Package\\Index\\PackageFullName\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" }, { "name": "Handle", "value": "0x00002504" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Index\\PackageFullName\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" } ], "repeated": 0, "id": 7137 }, { "timestamp": "2026-05-29 01:05:24,383", "thread_id": "4620", "caller": "0x7fff4cbd1732", "parentcaller": "0x7fff577af7dc", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002504" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "22" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Index\\PackageFullName\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\22" } ], "repeated": 0, "id": 7138 }, { "timestamp": "2026-05-29 01:05:24,383", "thread_id": "4620", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577af5fd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002504" } ], "repeated": 0, "id": 7139 }, { "timestamp": "2026-05-29 01:05:24,383", "thread_id": "4620", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff57815e2d", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 7140 }, { "timestamp": "2026-05-29 01:05:24,383", "thread_id": "4620", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff57815e8b", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x10wy\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00" } ], "repeated": 0, "id": 7141 }, { "timestamp": "2026-05-29 01:05:24,383", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577aebe9", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002534" }, { "name": "SubKey", "value": "User\\Index\\UserSid\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "Handle", "value": "0x00002504" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\User\\Index\\UserSid\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 7142 }, { "timestamp": "2026-05-29 01:05:24,383", "thread_id": "4620", "caller": "0x7fff4cbd1732", "parentcaller": "0x7fff577af7dc", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002504" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "3" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\User\\Index\\UserSid\\S-1-5-21-3968686040-3210279463-847977608-1001\\3" } ], "repeated": 0, "id": 7143 }, { "timestamp": "2026-05-29 01:05:24,383", "thread_id": "4620", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577aec6d", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002504" } ], "repeated": 0, "id": 7144 }, { "timestamp": "2026-05-29 01:05:24,383", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577ae9b0", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00002534" }, { "name": "SubKey", "value": "PackageExternalLocation\\Index\\UserAndPackage\\3^22" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\PackageExternalLocation\\Index\\UserAndPackage\\3^22" } ], "repeated": 0, "id": 7145 }, { "timestamp": "2026-05-29 01:05:24,383", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577ae9b0", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00002534" }, { "name": "SubKey", "value": "PackageExternalLocation\\Index\\UserAndPackage\\0^22" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\PackageExternalLocation\\Index\\UserAndPackage\\0^22" } ], "repeated": 0, "id": 7146 }, { "timestamp": "2026-05-29 01:05:24,383", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577af308", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002534" }, { "name": "SubKey", "value": "Package\\Data\\22" }, { "name": "Handle", "value": "0x00002504" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\22" } ], "repeated": 0, "id": 7147 }, { "timestamp": "2026-05-29 01:05:24,383", "thread_id": "4620", "caller": "0x7fff4cbd15ac", "parentcaller": "0x7fff4cbd14ff", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002504" }, { "name": "ValueName", "value": "InstalledLocation" }, { "name": "Data", "value": "C:\\Windows\\SystemApps\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\22\\InstalledLocation" } ], "repeated": 0, "id": 7148 }, { "timestamp": "2026-05-29 01:05:24,383", "thread_id": "4620", "caller": "0x7fff4cbd15ac", "parentcaller": "0x7fff4cbd14ff", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002504" }, { "name": "ValueName", "value": "MutableLink" }, { "name": "Data", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\22\\MutableLink" } ], "repeated": 0, "id": 7149 }, { "timestamp": "2026-05-29 01:05:24,383", "thread_id": "4620", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577aed38", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002504" } ], "repeated": 0, "id": 7150 }, { "timestamp": "2026-05-29 01:05:24,383", "thread_id": "4620", "caller": "0x7fff4cbd17f2", "parentcaller": "0x7fff577ae12f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ac4" } ], "repeated": 0, "id": 7151 }, { "timestamp": "2026-05-29 01:05:24,383", "thread_id": "4620", "caller": "0x7fff4cbd180b", "parentcaller": "0x7fff577ae12f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002534" } ], "repeated": 0, "id": 7152 }, { "timestamp": "2026-05-29 01:05:24,383", "thread_id": "4620", "caller": "0x7fff4cbd12d2", "parentcaller": "0x7fff577adf5c", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache" }, { "name": "Handle", "value": "0x00002534" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache" } ], "repeated": 0, "id": 7153 }, { "timestamp": "2026-05-29 01:05:24,383", "thread_id": "4620", "caller": "0x7fff4cbd1a81", "parentcaller": "0x7fff4cbd138a", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002534" }, { "name": "SubKey", "value": "Metadata" }, { "name": "Handle", "value": "0x00001ac4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Metadata" } ], "repeated": 0, "id": 7154 }, { "timestamp": "2026-05-29 01:05:24,383", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577af579", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002534" }, { "name": "SubKey", "value": "Package\\Index\\PackageFullName\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" }, { "name": "Handle", "value": "0x00002504" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Index\\PackageFullName\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" } ], "repeated": 0, "id": 7155 }, { "timestamp": "2026-05-29 01:05:24,383", "thread_id": "4620", "caller": "0x7fff4cbd1732", "parentcaller": "0x7fff577af7dc", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002504" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "22" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Index\\PackageFullName\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\22" } ], "repeated": 0, "id": 7156 }, { "timestamp": "2026-05-29 01:05:24,383", "thread_id": "4620", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577af5fd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002504" } ], "repeated": 0, "id": 7157 }, { "timestamp": "2026-05-29 01:05:24,383", "thread_id": "4620", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff57815e2d", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 7158 }, { "timestamp": "2026-05-29 01:05:24,383", "thread_id": "4620", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff57815e8b", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x10~y\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00" } ], "repeated": 0, "id": 7159 }, { "timestamp": "2026-05-29 01:05:24,383", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577aebe9", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002534" }, { "name": "SubKey", "value": "User\\Index\\UserSid\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "Handle", "value": "0x00002504" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\User\\Index\\UserSid\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 7160 }, { "timestamp": "2026-05-29 01:05:24,383", "thread_id": "4620", "caller": "0x7fff4cbd1732", "parentcaller": "0x7fff577af7dc", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002504" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "3" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\User\\Index\\UserSid\\S-1-5-21-3968686040-3210279463-847977608-1001\\3" } ], "repeated": 0, "id": 7161 }, { "timestamp": "2026-05-29 01:05:24,383", "thread_id": "4620", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577aec6d", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002504" } ], "repeated": 0, "id": 7162 }, { "timestamp": "2026-05-29 01:05:24,383", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577ae9b0", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00002534" }, { "name": "SubKey", "value": "PackageExternalLocation\\Index\\UserAndPackage\\3^22" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\PackageExternalLocation\\Index\\UserAndPackage\\3^22" } ], "repeated": 0, "id": 7163 }, { "timestamp": "2026-05-29 01:05:24,383", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577ae9b0", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00002534" }, { "name": "SubKey", "value": "PackageExternalLocation\\Index\\UserAndPackage\\0^22" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\PackageExternalLocation\\Index\\UserAndPackage\\0^22" } ], "repeated": 0, "id": 7164 }, { "timestamp": "2026-05-29 01:05:24,383", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577af308", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002534" }, { "name": "SubKey", "value": "Package\\Data\\22" }, { "name": "Handle", "value": "0x00002504" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\22" } ], "repeated": 0, "id": 7165 }, { "timestamp": "2026-05-29 01:05:24,383", "thread_id": "4620", "caller": "0x7fff4cbd15ac", "parentcaller": "0x7fff4cbd14ff", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002504" }, { "name": "ValueName", "value": "InstalledLocation" }, { "name": "Data", "value": "C:\\Windows\\SystemApps\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\22\\InstalledLocation" } ], "repeated": 0, "id": 7166 }, { "timestamp": "2026-05-29 01:05:24,383", "thread_id": "4620", "caller": "0x7fff4cbd15ac", "parentcaller": "0x7fff4cbd14ff", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002504" }, { "name": "ValueName", "value": "MutableLink" }, { "name": "Data", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\22\\MutableLink" } ], "repeated": 0, "id": 7167 }, { "timestamp": "2026-05-29 01:05:24,383", "thread_id": "4620", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577aed38", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002504" } ], "repeated": 0, "id": 7168 }, { "timestamp": "2026-05-29 01:05:24,383", "thread_id": "4620", "caller": "0x7fff4cbd17f2", "parentcaller": "0x7fff577ae12f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ac4" } ], "repeated": 0, "id": 7169 }, { "timestamp": "2026-05-29 01:05:24,383", "thread_id": "4620", "caller": "0x7fff4cbd180b", "parentcaller": "0x7fff577ae12f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002534" } ], "repeated": 0, "id": 7170 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 7171 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4620", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 7172 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4620", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 7173 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4620", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateChange\\PackageList\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateChange\\PackageList\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" } ], "repeated": 0, "id": 7174 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4620", "caller": "0x7fff577b26e8", "parentcaller": "0x7fff577b279b", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xf7 \\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00c\\x00r\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00l\\x00i\\x00e\\x00n\\x00t\\x00.\\x00C\\x00B\\x00S\\x00_\\x001\\x000\\x000\\x000\\x00.\\x001\\x009\\x000\\x005\\x003\\x00" } ], "repeated": 0, "id": 7175 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4620", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 7176 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4620", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001258" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 7177 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4620", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002488" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00001258" }, { "name": "ObjectAttributesName", "value": "S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 7178 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4620", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002488" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 7179 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4620", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002534" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00002488" }, { "name": "ObjectAttributesName", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" } ], "repeated": 0, "id": 7180 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4620", "caller": "0x7fff577b4086", "parentcaller": "0x7fff577b27b6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" } ], "repeated": 0, "id": 7181 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4620", "caller": "0x7fff577b40c3", "parentcaller": "0x7fff577b27b6", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002534" }, { "name": "ValueName", "value": "PackageStatus" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\PackageStatus" } ], "repeated": 0, "id": 7182 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4620", "caller": "0x7fff577b40d4", "parentcaller": "0x7fff577b27b6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002534" } ], "repeated": 0, "id": 7183 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 7184 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4620", "caller": "0x7fff54fcd469", "parentcaller": "0x7fff54fcd2ee", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 7185 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 7186 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 7187 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4636", "caller": "0x7fff58c2c304", "parentcaller": "0x7fff44c012c7", "category": "windows", "api": "SendNotifyMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000100ac" }, { "name": "Message", "value": "0x00000403" } ], "repeated": 0, "id": 7188 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4636", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xf9\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x1c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4636" } ], "repeated": 0, "id": 7189 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4720", "caller": "0x7fff58c2ce12", "parentcaller": "0x7fff581be858", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000100ac" }, { "name": "Message", "value": "0x00000404" } ], "repeated": 0, "id": 7190 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4576", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000177c" }, { "name": "ValueName", "value": "ZvpebfbsgJvaqbjf.Pyvrag.POF_pj5a1u2gklrjl!Tybony.NccYvfgOnpxhc" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\ZvpebfbsgJvaqbjf.Pyvrag.POF_pj5a1u2gklrjl!Tybony.NccYvfgOnpxhc" } ], "repeated": 1, "id": 7191 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4576", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\x11\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4576" } ], "repeated": 0, "id": 7192 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7193 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000404" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7194 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7195 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000404" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7196 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7197 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000404" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7198 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7199 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000404" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7200 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7201 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000404" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7202 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7203 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000404" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7204 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7205 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000404" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7206 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7207 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000404" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7208 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7209 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000404" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7210 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4636", "caller": "0x7fff557b4361", "parentcaller": "0x7fff557b3e47", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7211 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4636", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5287472a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0xfffffffc" } ], "repeated": 0, "id": 7212 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4636", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xf9\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x1c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4636" } ], "repeated": 0, "id": 7213 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58085ee4", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002048" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7214 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 7215 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 7216 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4620", "caller": "0x7fff4cbd12d2", "parentcaller": "0x7fff577adf5c", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache" }, { "name": "Handle", "value": "0x00002534" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache" } ], "repeated": 0, "id": 7217 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4620", "caller": "0x7fff4cbd1a81", "parentcaller": "0x7fff4cbd138a", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002534" }, { "name": "SubKey", "value": "Metadata" }, { "name": "Handle", "value": "0x00002488" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Metadata" } ], "repeated": 0, "id": 7218 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577af579", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002534" }, { "name": "SubKey", "value": "Package\\Index\\PackageFullName\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" }, { "name": "Handle", "value": "0x00001ac4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Index\\PackageFullName\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" } ], "repeated": 0, "id": 7219 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4620", "caller": "0x7fff4cbd1732", "parentcaller": "0x7fff577af7dc", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ac4" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "22" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Index\\PackageFullName\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\22" } ], "repeated": 0, "id": 7220 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4620", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577af5fd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ac4" } ], "repeated": 0, "id": 7221 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4620", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff57815e2d", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 7222 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4620", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff57815e8b", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x10zy\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00" } ], "repeated": 0, "id": 7223 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577aebe9", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002534" }, { "name": "SubKey", "value": "User\\Index\\UserSid\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "Handle", "value": "0x00001ac4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\User\\Index\\UserSid\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 7224 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4620", "caller": "0x7fff4cbd1732", "parentcaller": "0x7fff577af7dc", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ac4" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "3" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\User\\Index\\UserSid\\S-1-5-21-3968686040-3210279463-847977608-1001\\3" } ], "repeated": 0, "id": 7225 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4620", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577aec6d", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ac4" } ], "repeated": 0, "id": 7226 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577ae9b0", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00002534" }, { "name": "SubKey", "value": "PackageExternalLocation\\Index\\UserAndPackage\\3^22" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\PackageExternalLocation\\Index\\UserAndPackage\\3^22" } ], "repeated": 0, "id": 7227 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577ae9b0", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00002534" }, { "name": "SubKey", "value": "PackageExternalLocation\\Index\\UserAndPackage\\0^22" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\PackageExternalLocation\\Index\\UserAndPackage\\0^22" } ], "repeated": 0, "id": 7228 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577af308", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002534" }, { "name": "SubKey", "value": "Package\\Data\\22" }, { "name": "Handle", "value": "0x00001ac4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\22" } ], "repeated": 0, "id": 7229 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4620", "caller": "0x7fff4cbd15ac", "parentcaller": "0x7fff4cbd14ff", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ac4" }, { "name": "ValueName", "value": "InstalledLocation" }, { "name": "Data", "value": "C:\\Windows\\SystemApps\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\22\\InstalledLocation" } ], "repeated": 0, "id": 7230 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4620", "caller": "0x7fff4cbd15ac", "parentcaller": "0x7fff4cbd14ff", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ac4" }, { "name": "ValueName", "value": "MutableLink" }, { "name": "Data", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\22\\MutableLink" } ], "repeated": 0, "id": 7231 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4620", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577aed38", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ac4" } ], "repeated": 0, "id": 7232 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4620", "caller": "0x7fff4cbd17f2", "parentcaller": "0x7fff577ae12f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" } ], "repeated": 0, "id": 7233 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4620", "caller": "0x7fff4cbd180b", "parentcaller": "0x7fff577ae12f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002534" } ], "repeated": 0, "id": 7234 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4620", "caller": "0x7fff4cbd12d2", "parentcaller": "0x7fff577adf5c", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache" }, { "name": "Handle", "value": "0x00002534" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache" } ], "repeated": 0, "id": 7235 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4620", "caller": "0x7fff4cbd1a81", "parentcaller": "0x7fff4cbd138a", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002534" }, { "name": "SubKey", "value": "Metadata" }, { "name": "Handle", "value": "0x00002504" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Metadata" } ], "repeated": 0, "id": 7236 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577af579", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002534" }, { "name": "SubKey", "value": "Package\\Index\\PackageFullName\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" }, { "name": "Handle", "value": "0x00002530" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Index\\PackageFullName\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" } ], "repeated": 0, "id": 7237 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4620", "caller": "0x7fff4cbd1732", "parentcaller": "0x7fff577af7dc", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002530" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "22" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Index\\PackageFullName\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\22" } ], "repeated": 0, "id": 7238 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4620", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577af5fd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002530" } ], "repeated": 0, "id": 7239 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4620", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff57815e2d", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 7240 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4620", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff57815e8b", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x10zy\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00" } ], "repeated": 0, "id": 7241 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577aebe9", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002534" }, { "name": "SubKey", "value": "User\\Index\\UserSid\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "Handle", "value": "0x00002530" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\User\\Index\\UserSid\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 7242 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4620", "caller": "0x7fff4cbd1732", "parentcaller": "0x7fff577af7dc", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002530" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "3" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\User\\Index\\UserSid\\S-1-5-21-3968686040-3210279463-847977608-1001\\3" } ], "repeated": 0, "id": 7243 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4620", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577aec6d", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002530" } ], "repeated": 0, "id": 7244 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577ae9b0", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00002534" }, { "name": "SubKey", "value": "PackageExternalLocation\\Index\\UserAndPackage\\3^22" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\PackageExternalLocation\\Index\\UserAndPackage\\3^22" } ], "repeated": 0, "id": 7245 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577ae9b0", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00002534" }, { "name": "SubKey", "value": "PackageExternalLocation\\Index\\UserAndPackage\\0^22" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\PackageExternalLocation\\Index\\UserAndPackage\\0^22" } ], "repeated": 0, "id": 7246 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577af308", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002534" }, { "name": "SubKey", "value": "Package\\Data\\22" }, { "name": "Handle", "value": "0x00002530" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\22" } ], "repeated": 0, "id": 7247 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4620", "caller": "0x7fff4cbd15ac", "parentcaller": "0x7fff4cbd14ff", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002530" }, { "name": "ValueName", "value": "InstalledLocation" }, { "name": "Data", "value": "C:\\Windows\\SystemApps\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\22\\InstalledLocation" } ], "repeated": 0, "id": 7248 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4620", "caller": "0x7fff4cbd15ac", "parentcaller": "0x7fff4cbd14ff", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002530" }, { "name": "ValueName", "value": "MutableLink" }, { "name": "Data", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\22\\MutableLink" } ], "repeated": 0, "id": 7249 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4620", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577aed38", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002530" } ], "repeated": 0, "id": 7250 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4620", "caller": "0x7fff4cbd17f2", "parentcaller": "0x7fff577ae12f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002504" } ], "repeated": 0, "id": 7251 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4620", "caller": "0x7fff4cbd180b", "parentcaller": "0x7fff577ae12f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002534" } ], "repeated": 0, "id": 7252 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 7253 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4696", "caller": "0x7ff79bc76bd8", "parentcaller": "0x7ff79bc8a0c8", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00010110" }, { "name": "Message", "value": "0x0000c028" } ], "repeated": 0, "id": 7254 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "5000", "caller": "0x7fff57fc2eeb", "parentcaller": "0x7fff581ba00f", "category": "synchronization", "api": "NtFindAtom", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "AtomName", "value": "Windows.Internal.Shell.Holographic.Win32PortedView" }, { "name": "Atom", "value": "0x00000000" } ], "repeated": 0, "id": 7255 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 7256 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4620", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 7257 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4620", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 7258 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4620", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateChange\\PackageList\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateChange\\PackageList\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" } ], "repeated": 0, "id": 7259 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4620", "caller": "0x7fff577b26e8", "parentcaller": "0x7fff577b279b", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xf7 \\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00c\\x00r\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00l\\x00i\\x00e\\x00n\\x00t\\x00.\\x00C\\x00B\\x00S\\x00_\\x001\\x000\\x000\\x000\\x00.\\x001\\x009\\x000\\x005\\x003\\x00" } ], "repeated": 0, "id": 7260 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4620", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 7261 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4620", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001258" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 7262 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4620", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001838" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00001258" }, { "name": "ObjectAttributesName", "value": "S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 7263 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4620", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001838" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 7264 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4620", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002290" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00001838" }, { "name": "ObjectAttributesName", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" } ], "repeated": 0, "id": 7265 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4620", "caller": "0x7fff577b4086", "parentcaller": "0x7fff577b27b6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001838" } ], "repeated": 0, "id": 7266 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4620", "caller": "0x7fff577b40c3", "parentcaller": "0x7fff577b27b6", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002290" }, { "name": "ValueName", "value": "PackageStatus" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\PackageStatus" } ], "repeated": 0, "id": 7267 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4620", "caller": "0x7fff577b40d4", "parentcaller": "0x7fff577b27b6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002290" } ], "repeated": 0, "id": 7268 }, { "timestamp": "2026-05-29 01:05:24,399", "thread_id": "4696", "caller": "0x7fff41e05bb2", "parentcaller": "0x7fff41dd027e", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00010110" }, { "name": "Message", "value": "0x0000c028" } ], "repeated": 0, "id": 7269 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 7270 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "4696", "caller": "0x7ff79bc76bd8", "parentcaller": "0x7ff79bc8a0c8", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00010110" }, { "name": "Message", "value": "0x0000c028" } ], "repeated": 1, "id": 7271 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 7272 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "4620", "caller": "0x7fff54fcd469", "parentcaller": "0x7fff54fcd2ee", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 7273 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "4696", "caller": "0x7ff79bc76bd8", "parentcaller": "0x7ff79bc8a0c8", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00010110" }, { "name": "Message", "value": "0x0000c028" } ], "repeated": 0, "id": 7274 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 7275 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff455848a6", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001aa8" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "12860" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\conhost.exe" } ], "repeated": 0, "id": 7276 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "5000", "caller": "0x7fff5781026b", "parentcaller": "0x7fff45584920", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001aa8" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002524" } ], "repeated": 0, "id": 7277 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "5000", "caller": "0x7fff45584c45", "parentcaller": "0x7fff45584941", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 7278 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "5000", "caller": "0x7fff45584ce5", "parentcaller": "0x7fff45584941", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xe0k\\xc6\\x0b\\x00\\x00\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00\\x08l\\xc6\\x0b\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00(l\\xc6\\x0b\\x00\\x00\\x00\\x00T\\x00S\\x00A\\x00:\\x00/\\x00/\\x00P\\x00r\\x00o\\x00c\\x00U\\x00n\\x00i\\x00q\\x00u\\x00e\\x00\\xaa\\x00\\x00\\x00\\x00\\x00\\x00\\x00a\\x96\\x0c\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 7279 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff45584956", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002524" } ], "repeated": 0, "id": 7280 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff455a1181", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001aa8" } ], "repeated": 0, "id": 7281 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "5000", "caller": "0x7fff57fc2eeb", "parentcaller": "0x7fff581ba00f", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "MultimonitorActivationException" }, { "name": "Atom", "value": "0x0000c049" } ], "repeated": 0, "id": 7282 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "5000", "caller": "0x7fff57fc2eeb", "parentcaller": "0x7fff581ba00f", "category": "synchronization", "api": "NtFindAtom", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "AtomName", "value": "Windows.Internal.Shell.Holographic.Win32PortedView" }, { "name": "Atom", "value": "0x00000000" } ], "repeated": 1, "id": 7283 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "4696", "caller": "0x7ff79bc1fa2e", "parentcaller": "0x7ff79bc7fc27", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000072" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 7284 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "4696", "caller": "0x7ff79bca5b09", "parentcaller": "0x7ff79bc1fa68", "category": "synchronization", "api": "NtOpenEvent", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "Handle", "value": "0x7ff79bc7fc22" }, { "name": "EventName", "value": "{A1965210-3A9D-4bca-822B-433645B3F5A2}" } ], "repeated": 0, "id": 7285 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "4696", "caller": "0x7ff79bc1faf5", "parentcaller": "0x7ff79bc1fa75", "category": "synchronization", "api": "NtOpenMutant", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "Handle", "value": "0x7ff79bc7fc22" }, { "name": "MutexName", "value": "Local\\__DDrawCheckExclMode__" } ], "repeated": 0, "id": 7286 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "4696", "caller": "0x7ff79bc19217", "parentcaller": "0x7ff79bc1fa94", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 7287 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "4696", "caller": "0x7ff79bc19217", "parentcaller": "0x7ff79bc1fa94", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 7288 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 7289 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "4696", "caller": "0x7ff79bc19217", "parentcaller": "0x7ff79bc1fa94", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000024d8" }, { "name": "DesiredAccess", "value": "0x00000101", "pretty_value": "KEY_QUERY_VALUE|KEY_WOW64_64KEY" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\RetailDemo\\OobeWrite" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\RetailDemo\\OobeWrite" } ], "repeated": 0, "id": 7290 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "4696", "caller": "0x7ff79bc19217", "parentcaller": "0x7ff79bc1fa94", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024d8" }, { "name": "ValueName", "value": "Enabled" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RetailDemo\\OobeWrite\\Enabled" } ], "repeated": 0, "id": 7291 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "4696", "caller": "0x7ff79bc19217", "parentcaller": "0x7ff79bc1fa94", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024d8" } ], "repeated": 0, "id": 7292 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "4696", "caller": "0x7ff79bc19232", "parentcaller": "0x7ff79bc1fa94", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7293 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 7294 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "4636", "caller": "0x7fff58c2c304", "parentcaller": "0x7fff44c012c7", "category": "windows", "api": "SendNotifyMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000100ac" }, { "name": "Message", "value": "0x00000403" } ], "repeated": 0, "id": 7295 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "4636", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xf9\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x1c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4636" } ], "repeated": 0, "id": 7296 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "4720", "caller": "0x7fff58c2ce12", "parentcaller": "0x7fff581be858", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000100ac" }, { "name": "Message", "value": "0x00000404" } ], "repeated": 0, "id": 7297 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "4576", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\x11\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4576" } ], "repeated": 0, "id": 7298 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "4576", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000177c" }, { "name": "ValueName", "value": "ZvpebfbsgJvaqbjf.Pyvrag.POF_pj5a1u2gklrjl!Tybony.OnpxhcOnaare" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\ZvpebfbsgJvaqbjf.Pyvrag.POF_pj5a1u2gklrjl!Tybony.OnpxhcOnaare" } ], "repeated": 1, "id": 7299 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "4576", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\x11\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4576" } ], "repeated": 0, "id": 7300 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7301 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000404" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7302 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7303 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000404" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7304 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff455848a6", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001aa8" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "12844" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" } ], "repeated": 0, "id": 7305 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "5000", "caller": "0x7fff5781026b", "parentcaller": "0x7fff45584920", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001aa8" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002520" } ], "repeated": 0, "id": 7306 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "5000", "caller": "0x7fff45584c45", "parentcaller": "0x7fff45584941", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 7307 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "5000", "caller": "0x7fff45584ce5", "parentcaller": "0x7fff45584941", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00`\\xa0\\xc6\\x0b\\x00\\x00\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00\\x88\\xa0\\xc6\\x0b\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa8\\xa0\\xc6\\x0b\\x00\\x00\\x00\\x00T\\x00S\\x00A\\x00:\\x00/\\x00/\\x00P\\x00r\\x00o\\x00c\\x00U\\x00n\\x00i\\x00q\\x00u\\x00e\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00<\\x8b\\x0c\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 7308 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff45584956", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002520" } ], "repeated": 0, "id": 7309 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff455a1181", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001aa8" } ], "repeated": 0, "id": 7310 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 7311 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "4696", "caller": "0x7ff79bc76bd8", "parentcaller": "0x7ff79bc8a0c8", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00010110" }, { "name": "Message", "value": "0x0000c028" } ], "repeated": 0, "id": 7312 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "5000", "caller": "0x7fff57fc2eeb", "parentcaller": "0x7fff581ba00f", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "MultimonitorActivationException" }, { "name": "Atom", "value": "0x0000c049" } ], "repeated": 0, "id": 7313 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "5000", "caller": "0x7fff57fc2eeb", "parentcaller": "0x7fff581ba00f", "category": "synchronization", "api": "NtFindAtom", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "AtomName", "value": "Windows.Internal.Shell.Holographic.Win32PortedView" }, { "name": "Atom", "value": "0x00000000" } ], "repeated": 1, "id": 7314 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff455848a6", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002524" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "12844" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" } ], "repeated": 0, "id": 7315 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "5000", "caller": "0x7fff5781026b", "parentcaller": "0x7fff45584920", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002524" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000024d8" } ], "repeated": 0, "id": 7316 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "5000", "caller": "0x7fff45584c45", "parentcaller": "0x7fff45584941", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 7317 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "5000", "caller": "0x7fff45584ce5", "parentcaller": "0x7fff45584941", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x90\\x7f\\xc6\\x0b\\x00\\x00\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00\\xb8\\x7f\\xc6\\x0b\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd8\\x7f\\xc6\\x0b\\x00\\x00\\x00\\x00T\\x00S\\x00A\\x00:\\x00/\\x00/\\x00P\\x00r\\x00o\\x00c\\x00U\\x00n\\x00i\\x00q\\x00u\\x00e\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00<\\x8b\\x0c\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 7318 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff45584956", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024d8" } ], "repeated": 0, "id": 7319 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff455a1181", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002524" } ], "repeated": 0, "id": 7320 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 7321 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "5000", "caller": "0x7fff57fc2eeb", "parentcaller": "0x7fff581ba00f", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "MultimonitorActivationException" }, { "name": "Atom", "value": "0x0000c049" } ], "repeated": 0, "id": 7322 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "5000", "caller": "0x7fff57fc2eeb", "parentcaller": "0x7fff581ba00f", "category": "synchronization", "api": "NtFindAtom", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "AtomName", "value": "Windows.Internal.Shell.Holographic.Win32PortedView" }, { "name": "Atom", "value": "0x00000000" } ], "repeated": 1, "id": 7323 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7324 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000404" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7325 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff455848a6", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002524" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "12860" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" } ], "repeated": 0, "id": 7326 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "5000", "caller": "0x7fff5781026b", "parentcaller": "0x7fff45584920", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002524" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000024d8" } ], "repeated": 0, "id": 7327 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "5000", "caller": "0x7fff45584c45", "parentcaller": "0x7fff45584941", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 7328 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "5000", "caller": "0x7fff45584ce5", "parentcaller": "0x7fff45584941", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xb0\\x8c\\xc6\\x0b\\x00\\x00\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00\\xd8\\x8c\\xc6\\x0b\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\\x8c\\xc6\\x0b\\x00\\x00\\x00\\x00T\\x00S\\x00A\\x00:\\x00/\\x00/\\x00P\\x00r\\x00o\\x00c\\x00U\\x00n\\x00i\\x00q\\x00u\\x00e\\x00\\xaa\\x00\\x00\\x00\\x00\\x00\\x00\\x00a\\x96\\x0c\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 7329 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff45584956", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024d8" } ], "repeated": 0, "id": 7330 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff455a1181", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002524" } ], "repeated": 0, "id": 7331 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "5000", "caller": "0x7fff57fc2eeb", "parentcaller": "0x7fff581ba00f", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "MultimonitorActivationException" }, { "name": "Atom", "value": "0x0000c049" } ], "repeated": 0, "id": 7332 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 2, "id": 7333 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "5108", "caller": "0x7fff426da250", "parentcaller": "0x7fff57fc7344", "category": "system", "api": "GetSystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7334 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "4620", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 7335 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "5108", "caller": "0x7fff5781026b", "parentcaller": "0x7fff42570dc8", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002524" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000024d8" } ], "repeated": 0, "id": 7336 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "5108", "caller": "0x7fff42570e03", "parentcaller": "0x7fff42570a6b", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 7337 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "5108", "caller": "0x7fff42570e77", "parentcaller": "0x7fff42570a6b", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xd0\\x99\\xc6\\x0b\\x00\\x00\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00\\xf8\\x99\\xc6\\x0b\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x9a\\xc6\\x0b\\x00\\x00\\x00\\x00T\\x00S\\x00A\\x00:\\x00/\\x00/\\x00P\\x00r\\x00o\\x00c\\x00U\\x00n\\x00i\\x00q\\x00u\\x00e\\x00\\xaa\\x00\\x00\\x00\\x00\\x00\\x00\\x00a\\x96\\x0c\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 7338 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "5108", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024d8" } ], "repeated": 0, "id": 7339 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "5108", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff44bd4f06", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000024d8" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "12860" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" } ], "repeated": 0, "id": 7340 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "5108", "caller": "0x7fff5781026b", "parentcaller": "0x7fff44c0f8f9", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000024d8" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00001e68" } ], "repeated": 0, "id": 7341 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "5108", "caller": "0x7fff44c0f5ac", "parentcaller": "0x7fff44c0f931", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 7342 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7343 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000404" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7344 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "5108", "caller": "0x7fff577d6785", "parentcaller": "0x7fff44c0f944", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001e68" } ], "repeated": 0, "id": 7345 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "5108", "caller": "0x7fff577d6785", "parentcaller": "0x7fff44bd525c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024d8" } ], "repeated": 0, "id": 7346 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "5108", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff44bd1afb", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000024d8" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "12860" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" } ], "repeated": 0, "id": 7347 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "5108", "caller": "0x7fff577d6785", "parentcaller": "0x7fff44bd1b59", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024d8" } ], "repeated": 0, "id": 7348 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "5108", "caller": "0x7fff577cc85a", "parentcaller": "0x7fff57815818", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "12" }, { "name": "ProcessInformation", "value": "\\x00\\x80\\x00\\x00" } ], "repeated": 0, "id": 7349 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "5108", "caller": "0x7fff577d07f5", "parentcaller": "0x7fff57815826", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\conhost.exe" } ], "repeated": 0, "id": 7350 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001aa8" } ], "repeated": 0, "id": 7351 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "5108", "caller": "0x7fff57815984", "parentcaller": "0x7fff44bd1baf", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x0c7004d0", "arguments": [ { "name": "FileName", "value": "C:\\Windows" }, { "name": "FirstCreateTimeLow", "value": "0x3a6eea36" }, { "name": "FirstCreateTimeHigh", "value": "0x01ca0431" } ], "repeated": 0, "id": 7352 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "5108", "caller": "0x7fff577cbe1d", "parentcaller": "0x7fff5781599a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002290" } ], "repeated": 0, "id": 7353 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "5108", "caller": "0x7fff57815984", "parentcaller": "0x7fff44bd1baf", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x0c700050", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32" }, { "name": "FirstCreateTimeLow", "value": "0x3a6eea36" }, { "name": "FirstCreateTimeHigh", "value": "0x01d5acdd" } ], "repeated": 0, "id": 7354 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7355 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000404" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7356 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "5108", "caller": "0x7fff57815984", "parentcaller": "0x7fff44bd1baf", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x0c6ffff0", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\conhost.exe" }, { "name": "FirstCreateTimeLow", "value": "0x70b91e83" }, { "name": "FirstCreateTimeHigh", "value": "0x01da265c" } ], "repeated": 0, "id": 7357 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "5108", "caller": "0x7fff577cbe1d", "parentcaller": "0x7fff5781599a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002290" } ], "repeated": 0, "id": 7358 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "5000", "caller": "0x7fff57fc2eeb", "parentcaller": "0x7fff581ba00f", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "MultimonitorActivationException" }, { "name": "Atom", "value": "0x0000c049" } ], "repeated": 0, "id": 7359 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7360 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000404" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7361 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "5000", "caller": "0x7fff57fc2eeb", "parentcaller": "0x7fff581ba00f", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "ITaskList_Deleted" }, { "name": "Atom", "value": "0x0000c086" } ], "repeated": 0, "id": 7362 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 7363 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "4620", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 7364 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7365 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000404" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7366 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "4620", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000b04" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 7367 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 7368 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "4620", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000b04" }, { "name": "ObjectAttributesName", "value": "W32:000000000003044E" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1\\ApplicationViewManagement\\W32:000000000003044E" } ], "repeated": 0, "id": 7369 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "4620", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000b04" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 7370 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "4620", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000b04" }, { "name": "ObjectAttributesName", "value": "W32:000000000003044E" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1\\ApplicationViewManagement\\W32:000000000003044E" } ], "repeated": 0, "id": 7371 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7372 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000404" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7373 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "4620", "caller": "0x7fff42568962", "parentcaller": "0x7fff42567e38", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001011a" }, { "name": "Message", "value": "0x00000401" } ], "repeated": 0, "id": 7374 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "5000", "caller": "0x7fff57fc2eeb", "parentcaller": "0x7fff581ba00f", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "{9F4C2855-9F79-4B39-A8D0-E1D42DE1D5F3} 5" }, { "name": "Atom", "value": "0x0000c067" } ], "repeated": 0, "id": 7375 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff4258c7cd", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002520" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "12844" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" } ], "repeated": 0, "id": 7376 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff4258cea5", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002450" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "12844" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" } ], "repeated": 0, "id": 7377 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "5000", "caller": "0x7fff5781026b", "parentcaller": "0x7fff42570dc8", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002450" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00001c54" } ], "repeated": 0, "id": 7378 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "5000", "caller": "0x7fff42570e03", "parentcaller": "0x7fff4258cec1", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 7379 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "5000", "caller": "0x7fff42570e77", "parentcaller": "0x7fff4258cec1", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00y\\xc6\\x0b\\x00\\x00\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00(y\\xc6\\x0b\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00Hy\\xc6\\x0b\\x00\\x00\\x00\\x00T\\x00S\\x00A\\x00:\\x00/\\x00/\\x00P\\x00r\\x00o\\x00c\\x00U\\x00n\\x00i\\x00q\\x00u\\x00e\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00<\\x8b\\x0c\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 7380 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff42570eff", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001c54" } ], "repeated": 0, "id": 7381 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff4258ced7", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002450" } ], "repeated": 0, "id": 7382 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff4258c837", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002520" } ], "repeated": 0, "id": 7383 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 1, "id": 7384 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7385 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000404" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7386 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "4636", "caller": "0x7fff557b4361", "parentcaller": "0x7fff557b3e47", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7387 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "4636", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5287472a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0xfffffffc" } ], "repeated": 0, "id": 7388 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "4636", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xf9\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x1c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4636" } ], "repeated": 0, "id": 7389 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58085ee4", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002048" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7390 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 7391 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 7392 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "5108", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff44bd4c11", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002290" }, { "name": "DesiredAccess", "value": "0x00000410", "pretty_value": "PROCESS_VM_READ|PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "12860" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" } ], "repeated": 0, "id": 7393 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "5108", "caller": "0x7fff44bd4a8f", "parentcaller": "0x7fff44bd4c3d", "category": "process", "api": "ReadProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0x00002290" }, { "name": "BaseAddress", "value": "0x356da1000" }, { "name": "Size", "value": "0x000007c8" }, { "name": "Buffer", "value": "\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x00\\x00\\x86\\xbf\\xf7\\x7f\\x00\\x00\\xc0\\xc4\\x0bZ\\xff\\x7f\\x00\\x00\\xa0\\x1b\\x85\\xc2\\xc9\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x85\\xc2\\xc9\\x01\\x00\\x00\\xe0\\xc0\\x0bZ\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\x00$X\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00q\\xc2\\xc9\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xc4\\x0bZ\\xff\\x7f\\x00\\x00\\xff\\xff\\xff\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\xc8`\\xf4}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\x07\\xc8`\\xf4}\\x00\\x00\\x00\\x00\\xdcb\\xf5}\\x00\\x00(\\x02\\xddb\\xf5}\\x00\\x00P\\x06\\xdeb\\xf5}\\x00\\x00\\x06\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x9b\\x07m\\xe8\\xff\\xff\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x10\\x00\\x00\\x00@\\xad\\x0bZ\\xff\\x7f\\x00\\x00\\x00\\x00\\xc2\\xc2\\xc9\\x01\\x00\\x00" } ], "repeated": 0, "id": 7394 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "5108", "caller": "0x7fff44bd4ae2", "parentcaller": "0x7fff44bd4c3d", "category": "process", "api": "ReadProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0x00002290" }, { "name": "BaseAddress", "value": "0x1c9c2851ba0" }, { "name": "Size", "value": "0x00000440" }, { "name": "Buffer", "value": "\\x06\\x07\\x00\\x00\\x06\\x07\\x00\\x00\\x01@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x16\\x00\\x08\\x02\\x00\\x00\\x00\\x00\\x00'\\x85\\xc2\\xc9\\x01\\x00\\x00D\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00>\\x00@\\x00\\x00\\x00\\x00\\x00\\xf0!\\x85\\xc2\\xc9\\x01\\x00\\x00N\\x00P\\x00\\x00\\x00\\x00\\x000\"\\x85\\xc2\\xc9\\x01\\x00\\x00\\xe0\\x0f\\x85\\xc2\\xc9\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\xa0\"\\x85\\xc2\\xc9\\x01\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\xa2\"\\x85\\xc2\\xc9\\x01\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\xa4\"\\x85\\xc2\\xc9\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 7395 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "5108", "caller": "0x7fff44bd4b4f", "parentcaller": "0x7fff44bd4c3d", "category": "process", "api": "ReadProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0x00002290" }, { "name": "BaseAddress", "value": "0x1c9c2852230" }, { "name": "Size", "value": "0x0000004e" }, { "name": "Buffer", "value": "\\\\x00?\\x00?\\x00\\\\x00C\\x00:\\x00\\\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00\\\\x00s\\x00y\\x00s\\x00t\\x00e\\x00m\\x003\\x002\\x00\\\\x00c\\x00o\\x00n\\x00h\\x00o\\x00s\\x00t\\x00.\\x00e\\x00x\\x00e\\x00 \\x000\\x00x\\x004\\x00" } ], "repeated": 0, "id": 7396 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "5108", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5287472a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0xfffffffc" } ], "repeated": 0, "id": 7397 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "5108", "caller": "0x7fff577d6785", "parentcaller": "0x7fff44bd4e5f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002290" } ], "repeated": 0, "id": 7398 }, { "timestamp": "2026-05-29 01:05:24,415", "thread_id": "5108", "caller": "0x7fff58081596", "parentcaller": "0x7fff58ac668d", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "Applications\\conhost.exe" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\Applications\\conhost.exe" } ], "repeated": 1, "id": 7399 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5108", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5287472a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0xfffffffc" } ], "repeated": 0, "id": 7400 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5108", "caller": "0x7fff577d6785", "parentcaller": "0x7fff42570a7d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002524" } ], "repeated": 0, "id": 7401 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5108", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff426da18b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000ea0" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7402 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "4620", "caller": "0x7fff4cbd12d2", "parentcaller": "0x7fff577adf5c", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache" }, { "name": "Handle", "value": "0x0000256c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache" } ], "repeated": 0, "id": 7403 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "4620", "caller": "0x7fff4cbd1a81", "parentcaller": "0x7fff4cbd138a", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000256c" }, { "name": "SubKey", "value": "Metadata" }, { "name": "Handle", "value": "0x00001ae0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Metadata" } ], "repeated": 0, "id": 7404 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577af579", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000256c" }, { "name": "SubKey", "value": "Package\\Index\\PackageFullName\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" }, { "name": "Handle", "value": "0x00001af0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Index\\PackageFullName\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" } ], "repeated": 0, "id": 7405 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "4620", "caller": "0x7fff4cbd1732", "parentcaller": "0x7fff577af7dc", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "22" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Index\\PackageFullName\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\22" } ], "repeated": 0, "id": 7406 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "4620", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577af5fd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 7407 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "4620", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff57815e2d", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 7408 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "4620", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff57815e8b", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "@\\x9b\\xa8\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00o\\x00b\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00" } ], "repeated": 0, "id": 7409 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577aebe9", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000256c" }, { "name": "SubKey", "value": "User\\Index\\UserSid\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "Handle", "value": "0x00001af0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\User\\Index\\UserSid\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 7410 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "4620", "caller": "0x7fff4cbd1732", "parentcaller": "0x7fff577af7dc", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "3" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\User\\Index\\UserSid\\S-1-5-21-3968686040-3210279463-847977608-1001\\3" } ], "repeated": 0, "id": 7411 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "4620", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577aec6d", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 7412 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577ae9b0", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x0000256c" }, { "name": "SubKey", "value": "PackageExternalLocation\\Index\\UserAndPackage\\3^22" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\PackageExternalLocation\\Index\\UserAndPackage\\3^22" } ], "repeated": 0, "id": 7413 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577ae9b0", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x0000256c" }, { "name": "SubKey", "value": "PackageExternalLocation\\Index\\UserAndPackage\\0^22" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\PackageExternalLocation\\Index\\UserAndPackage\\0^22" } ], "repeated": 0, "id": 7414 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577af308", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000256c" }, { "name": "SubKey", "value": "Package\\Data\\22" }, { "name": "Handle", "value": "0x00001af0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\22" } ], "repeated": 0, "id": 7415 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "4620", "caller": "0x7fff4cbd15ac", "parentcaller": "0x7fff4cbd14ff", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "ValueName", "value": "InstalledLocation" }, { "name": "Data", "value": "C:\\Windows\\SystemApps\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\22\\InstalledLocation" } ], "repeated": 0, "id": 7416 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "4620", "caller": "0x7fff4cbd15ac", "parentcaller": "0x7fff4cbd14ff", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "ValueName", "value": "MutableLink" }, { "name": "Data", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\22\\MutableLink" } ], "repeated": 0, "id": 7417 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "4620", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577aed38", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 7418 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "4620", "caller": "0x7fff4cbd17f2", "parentcaller": "0x7fff577ae12f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ae0" } ], "repeated": 0, "id": 7419 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "4620", "caller": "0x7fff4cbd180b", "parentcaller": "0x7fff577ae12f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 7420 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "4620", "caller": "0x7fff4cbd12d2", "parentcaller": "0x7fff577adf5c", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache" }, { "name": "Handle", "value": "0x0000256c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache" } ], "repeated": 0, "id": 7421 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "4620", "caller": "0x7fff4cbd1a81", "parentcaller": "0x7fff4cbd138a", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000256c" }, { "name": "SubKey", "value": "Metadata" }, { "name": "Handle", "value": "0x00001ae0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Metadata" } ], "repeated": 0, "id": 7422 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577af579", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000256c" }, { "name": "SubKey", "value": "Package\\Index\\PackageFullName\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" }, { "name": "Handle", "value": "0x00001af0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Index\\PackageFullName\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" } ], "repeated": 0, "id": 7423 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "4620", "caller": "0x7fff4cbd1732", "parentcaller": "0x7fff577af7dc", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "22" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Index\\PackageFullName\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\22" } ], "repeated": 0, "id": 7424 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "4620", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577af5fd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 7425 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "4620", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff57815e2d", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 7426 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "4620", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff57815e8b", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\x9c\\xa8\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\\\x00S\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00" } ], "repeated": 0, "id": 7427 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577aebe9", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000256c" }, { "name": "SubKey", "value": "User\\Index\\UserSid\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "Handle", "value": "0x00001af0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\User\\Index\\UserSid\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 7428 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "4620", "caller": "0x7fff4cbd1732", "parentcaller": "0x7fff577af7dc", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "3" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\User\\Index\\UserSid\\S-1-5-21-3968686040-3210279463-847977608-1001\\3" } ], "repeated": 0, "id": 7429 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "4620", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577aec6d", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 7430 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577ae9b0", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x0000256c" }, { "name": "SubKey", "value": "PackageExternalLocation\\Index\\UserAndPackage\\3^22" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\PackageExternalLocation\\Index\\UserAndPackage\\3^22" } ], "repeated": 0, "id": 7431 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577ae9b0", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x0000256c" }, { "name": "SubKey", "value": "PackageExternalLocation\\Index\\UserAndPackage\\0^22" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\PackageExternalLocation\\Index\\UserAndPackage\\0^22" } ], "repeated": 0, "id": 7432 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577af308", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000256c" }, { "name": "SubKey", "value": "Package\\Data\\22" }, { "name": "Handle", "value": "0x00001af0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\22" } ], "repeated": 0, "id": 7433 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "4620", "caller": "0x7fff4cbd15ac", "parentcaller": "0x7fff4cbd14ff", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "ValueName", "value": "InstalledLocation" }, { "name": "Data", "value": "C:\\Windows\\SystemApps\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\22\\InstalledLocation" } ], "repeated": 0, "id": 7434 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "4620", "caller": "0x7fff4cbd15ac", "parentcaller": "0x7fff4cbd14ff", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "ValueName", "value": "MutableLink" }, { "name": "Data", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\22\\MutableLink" } ], "repeated": 0, "id": 7435 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "4620", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577aed38", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 7436 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "4620", "caller": "0x7fff4cbd17f2", "parentcaller": "0x7fff577ae12f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ae0" } ], "repeated": 0, "id": 7437 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "4620", "caller": "0x7fff4cbd180b", "parentcaller": "0x7fff577ae12f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 7438 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 7439 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "4620", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 7440 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "4620", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 7441 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "4620", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateChange\\PackageList\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateChange\\PackageList\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" } ], "repeated": 0, "id": 7442 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "4620", "caller": "0x7fff577b26e8", "parentcaller": "0x7fff577b279b", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xf7 \\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00c\\x00r\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00l\\x00i\\x00e\\x00n\\x00t\\x00.\\x00C\\x00B\\x00S\\x00_\\x001\\x000\\x000\\x000\\x00.\\x001\\x009\\x000\\x005\\x003\\x00" } ], "repeated": 0, "id": 7443 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "4620", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 7444 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "4620", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001258" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 7445 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "4620", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ac4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00001258" }, { "name": "ObjectAttributesName", "value": "S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 7446 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "4620", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ac4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 7447 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "4620", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002534" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00001ac4" }, { "name": "ObjectAttributesName", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" } ], "repeated": 0, "id": 7448 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "4620", "caller": "0x7fff577b4086", "parentcaller": "0x7fff577b27b6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ac4" } ], "repeated": 0, "id": 7449 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "4620", "caller": "0x7fff577b40c3", "parentcaller": "0x7fff577b27b6", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002534" }, { "name": "ValueName", "value": "PackageStatus" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\PackageStatus" } ], "repeated": 0, "id": 7450 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "4620", "caller": "0x7fff577b40d4", "parentcaller": "0x7fff577b27b6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002534" } ], "repeated": 0, "id": 7451 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 7452 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "4620", "caller": "0x7fff54fcd469", "parentcaller": "0x7fff54fcd2ee", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 7453 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff425a5af2", "parentcaller": "0x7fff425e7317", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000b04" }, { "name": "SubKey", "value": "W32:000000000003044E" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x00020006", "pretty_value": "KEY_WRITE" }, { "name": "Handle", "value": "0x000024d8" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1\\ApplicationViewManagement\\W32:000000000003044E" }, { "name": "Disposition", "value": "1", "pretty_value": "REG_CREATED_NEW_KEY" } ], "repeated": 0, "id": 7454 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff425a5b27", "parentcaller": "0x7fff425e7317", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024d8" }, { "name": "ValueName", "value": "VirtualDesktop" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x0000DV\\xc5l,\\xbb$\\x88YC\\x86\\xcf\\xa5\\xbe\\x90V:4" }, { "name": "BufferLength", "value": "24" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1\\ApplicationViewManagement\\W32:000000000003044E\\VirtualDesktop" } ], "repeated": 0, "id": 7455 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff425a5b4d", "parentcaller": "0x7fff425e7317", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024d8" } ], "repeated": 0, "id": 7456 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 7457 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "6160", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x18\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6160" } ], "repeated": 0, "id": 7458 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff57fc2eeb", "parentcaller": "0x7fff581ba00f", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "ShellPositionerManager:PriorityList" }, { "name": "Atom", "value": "0x0000c081" } ], "repeated": 0, "id": 7459 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff57fc2eeb", "parentcaller": "0x7fff581ba00f", "category": "synchronization", "api": "NtFindAtom", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "AtomName", "value": "Windows.Graphics.Holographic.HolographicSpace" }, { "name": "Atom", "value": "0x00000000" } ], "repeated": 0, "id": 7460 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff57fc2eeb", "parentcaller": "0x7fff581ba00f", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "{9F4C2855-9F79-4B39-A8D0-E1D42DE1D5F3} 5" }, { "name": "Atom", "value": "0x0000c067" } ], "repeated": 0, "id": 7461 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 7462 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff4258c7cd", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000024d8" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "12844" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" } ], "repeated": 0, "id": 7463 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff4258cea5", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001e68" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "12844" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" } ], "repeated": 0, "id": 7464 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff5781026b", "parentcaller": "0x7fff42570dc8", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001e68" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002458" } ], "repeated": 0, "id": 7465 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 7466 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff42570e77", "parentcaller": "0x7fff4258cec1", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00 \\x86\\xc6\\x0b\\x00\\x00\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00H\\x86\\xc6\\x0b\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x86\\xc6\\x0b\\x00\\x00\\x00\\x00T\\x00S\\x00A\\x00:\\x00/\\x00/\\x00P\\x00r\\x00o\\x00c\\x00U\\x00n\\x00i\\x00q\\x00u\\x00e\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00<\\x8b\\x0c\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 7467 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff42570eff", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002458" } ], "repeated": 0, "id": 7468 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff4258ced7", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001e68" } ], "repeated": 0, "id": 7469 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "6160", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 7470 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff4258c837", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024d8" } ], "repeated": 0, "id": 7471 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 7472 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff57fc2eeb", "parentcaller": "0x7fff581ba00f", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "{9F4C2855-9F79-4B39-A8D0-E1D42DE1D5F3} 5" }, { "name": "Atom", "value": "0x0000c067" } ], "repeated": 0, "id": 7473 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff4258c7cd", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000024d8" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "12844" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" } ], "repeated": 0, "id": 7474 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff4258cea5", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001e68" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "12844" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" } ], "repeated": 0, "id": 7475 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff5781026b", "parentcaller": "0x7fff42570dc8", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001e68" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002550" } ], "repeated": 0, "id": 7476 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff42570e03", "parentcaller": "0x7fff4258cec1", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 7477 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff42570e77", "parentcaller": "0x7fff4258cec1", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xb0\\x8c\\xc6\\x0b\\x00\\x00\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00\\xd8\\x8c\\xc6\\x0b\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\\x8c\\xc6\\x0b\\x00\\x00\\x00\\x00T\\x00S\\x00A\\x00:\\x00/\\x00/\\x00P\\x00r\\x00o\\x00c\\x00U\\x00n\\x00i\\x00q\\x00u\\x00e\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00<\\x8b\\x0c\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 7478 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff42570eff", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 0, "id": 7479 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff4258ced7", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001e68" } ], "repeated": 0, "id": 7480 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff4258c837", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024d8" } ], "repeated": 0, "id": 7481 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff426b684b", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000024d8" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "12844" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" } ], "repeated": 0, "id": 7482 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff5781026b", "parentcaller": "0x7fff42570dc8", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000024d8" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00001e68" } ], "repeated": 0, "id": 7483 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff42570e03", "parentcaller": "0x7fff42a0e71e", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 7484 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff42570e77", "parentcaller": "0x7fff42a0e71e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00@\\x93\\xc6\\x0b\\x00\\x00\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00h\\x93\\xc6\\x0b\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x93\\xc6\\x0b\\x00\\x00\\x00\\x00T\\x00S\\x00A\\x00:\\x00/\\x00/\\x00P\\x00r\\x00o\\x00c\\x00U\\x00n\\x00i\\x00q\\x00u\\x00e\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00<\\x8b\\x0c\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 7485 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff42570eff", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001e68" } ], "repeated": 0, "id": 7486 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 7487 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff42a0e757", "parentcaller": "0x7fff426b686e", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 7488 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff44bd4f06", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001e68" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "12844" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" } ], "repeated": 0, "id": 7489 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff5781026b", "parentcaller": "0x7fff44c0f8f9", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001e68" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002550" } ], "repeated": 0, "id": 7490 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff44c0f5ac", "parentcaller": "0x7fff44c0f931", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 7491 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff44c0f65d", "parentcaller": "0x7fff44c0f931", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00`\\xa0\\xc6\\x0b\\x00\\x00\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00\\x88\\xa0\\xc6\\x0b\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa8\\xa0\\xc6\\x0b\\x00\\x00\\x00\\x00T\\x00S\\x00A\\x00:\\x00/\\x00/\\x00P\\x00r\\x00o\\x00c\\x00U\\x00n\\x00i\\x00q\\x00u\\x00e\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00<\\x8b\\x0c\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 7492 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff44c0f944", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 0, "id": 7493 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff44bcef5f", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002550" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "12844" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" } ], "repeated": 0, "id": 7494 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff5781026b", "parentcaller": "0x7fff44bcef88", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002550" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000254c" } ], "repeated": 0, "id": 7495 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff44c0efc1", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "`\\x0f\\xa5\\x0c\\x00\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 7496 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff44bcefd6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000254c" } ], "repeated": 0, "id": 7497 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff44bceff8", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 0, "id": 7498 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 7499 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff57812a0c", "parentcaller": "0x7fff44c0f12b", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002550" }, { "name": "DesiredAccess", "value": "0x00020000", "pretty_value": "READ_CONTROL" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 7500 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff57812a7e", "parentcaller": "0x7fff44c0f12b", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 0, "id": 7501 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 7502 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff57812a0c", "parentcaller": "0x7fff44c0f12b", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002550" }, { "name": "DesiredAccess", "value": "0x00020000", "pretty_value": "READ_CONTROL" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 7503 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff57812a7e", "parentcaller": "0x7fff44c0f12b", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 0, "id": 7504 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 7505 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff44bd525c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001e68" } ], "repeated": 0, "id": 7506 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 7507 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000039e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 7508 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000039e" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 1, "id": 7509 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000008", "pretty_value": "KEY_ENUMERATE_SUB_KEYS" }, { "name": "ObjectAttributesHandle", "value": "0x0000039e" }, { "name": "ObjectAttributesName", "value": "Drive\\shellex\\FolderExtensions" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Drive\\shellex\\FolderExtensions" } ], "repeated": 0, "id": 7510 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001e68" }, { "name": "DesiredAccess", "value": "0x00000008", "pretty_value": "KEY_ENUMERATE_SUB_KEYS" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\Drive\\shellex\\FolderExtensions" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\Drive\\shellex\\FolderExtensions" } ], "repeated": 0, "id": 7511 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff55840a0a", "parentcaller": "0x7fff55853d54", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001e6a" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "{fbeb8a05-beee-4442-804e-409d6c4515e9}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Drive\\shellex\\FolderExtensions\\{fbeb8a05-beee-4442-804e-409d6c4515e9}" } ], "repeated": 0, "id": 7512 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff5808b68e", "parentcaller": "0x7fff558766ff", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "Drive\\shellex\\FolderExtensions\\{fbeb8a05-beee-4442-804e-409d6c4515e9}" }, { "name": "Handle", "value": "0x00002552" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\Drive\\shellex\\FolderExtensions\\{fbeb8a05-beee-4442-804e-409d6c4515e9}" } ], "repeated": 0, "id": 7513 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b6b7", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002552" }, { "name": "ValueName", "value": "DriveMask" }, { "name": "Data", "value": "32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Drive\\shellex\\FolderExtensions\\{fbeb8a05-beee-4442-804e-409d6c4515e9}\\DriveMask" } ], "repeated": 0, "id": 7514 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff5808b6c5", "parentcaller": "0x7fff558766ff", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002552" } ], "repeated": 0, "id": 7515 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff55840a0a", "parentcaller": "0x7fff55853d54", "category": "registry", "api": "RegEnumKeyExW", "status": false, "return": "0x00000103", "pretty_return": "NO_MORE_ITEMS", "arguments": [ { "name": "Handle", "value": "0x00001e6a" }, { "name": "Index", "value": "1" }, { "name": "Name", "value": "" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Drive\\shellex\\FolderExtensions\\" } ], "repeated": 0, "id": 7516 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff55840a5e", "parentcaller": "0x7fff55853d54", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001e6a" } ], "repeated": 0, "id": 7517 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577ced78", "parentcaller": "0x7fff5807fb58", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "MutexName", "value": "" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 7518 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000254c" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7519 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7520 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7521 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7522 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 0, "id": 7523 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "4636", "caller": "0x7fff58c2c304", "parentcaller": "0x7fff44c012c7", "category": "windows", "api": "SendNotifyMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000100ac" }, { "name": "Message", "value": "0x00000403" } ], "repeated": 0, "id": 7524 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577d5783", "parentcaller": "0x7fff58090260", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000254c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk" }, { "name": "Buffer", "value": "L\\x00\\x00\\x00\\x01\\x14\\x02\\x00\\x00\\x00\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00F\\xdf\\x02\\x00\\x00 \\x00\\x00\\x00\\x9b\\xaf\\x96\\xb7\\xcdj\\xcd\\x01\\x9b\\xaf\\x96\\xb7\\xcdj\\xcd\\x01\\x80\\x1d\\x02\\xa8\\xddj\\xcd\\x01\\x00\\xf0\\x06\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf1\\x01\\x14\\x00\\x1fP\\xe0O\\xd0 \\xea:i\\x10\\xa2\\xd8\\x08\\x00+00\\x9d\\x19\\x00/C:\\\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00R\\x001\\x00\\x00\\x00\\x00\\x00\\xc7B\\x02\\xb00\\x00Windows\\x00<\\x00\\x08\\x00\\x04\\x00\\xef\\xbe\\xfa@\\xc0,\\xc7B\\x02\\xb0*\\x00\\x00\\x00\\x1f\\x10\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00\\x00\\x00\\x16\\x00V\\x001\\x00\\x00\\x00\\x00\\x00\\xc7B]\\x050\\x00System32\\x00\\x00>\\x00\\x08\\x00\\x04\\x00\\xef\\xbe\\xfa@\\xc1,\\xc7B]\\x05*\\x00\\x00\\x00\n\\x18\\x00\\x00\\x00\\x00\\x01" }, { "name": "Length", "value": "2539" } ], "repeated": 0, "id": 7525 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "4576", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\x11\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4576" } ], "repeated": 0, "id": 7526 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 1, "id": 7527 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7528 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7529 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7530 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 0, "id": 7531 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7532 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7533 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 1, "id": 7534 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7535 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7536 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7537 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 0, "id": 7538 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7539 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7540 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 1, "id": 7541 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7542 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7543 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7544 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 0, "id": 7545 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7546 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7547 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 1, "id": 7548 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 7549 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 7550 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000256c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 7551 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 7552 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 7553 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 7554 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 7555 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000256c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 7556 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7557 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000404" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7558 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "ValueName", "value": "MonitorRegistry" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\MonitorRegistry" } ], "repeated": 0, "id": 7559 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 7560 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577d3b20", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 7561 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 7562 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7563 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000404" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7564 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000256c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" } ], "repeated": 0, "id": 7565 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 7566 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 7567 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 7568 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 7569 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000256c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" } ], "repeated": 0, "id": 7570 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "ValueName", "value": "MonitorRegistry" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\MonitorRegistry" } ], "repeated": 0, "id": 7571 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 7572 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7573 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7574 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7575 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 0, "id": 7576 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff5780b767", "parentcaller": "0x7fff58085024", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000254c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk" }, { "name": "FileInformationClass", "value": "4", "pretty_value": "FileBasicInformation" }, { "name": "FileInformation", "value": "\\\\xbd\\xd6\\x9c\\xb6\\xee\\xdc\\x01L\n\\xc9:\\x07\\xef\\xdc\\x01z\\xe4:{\\xde\\xac\\xd5\\x01\\xbe7\\xc0\\xa1\\xb7\\xee\\xdc\\x01 \\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 7577 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff5780b767", "parentcaller": "0x7fff5808504b", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000254c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xeb\t\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 7578 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7579 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7580 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 1, "id": 7581 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7582 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7583 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7584 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 0, "id": 7585 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7586 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7587 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 1, "id": 7588 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7589 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7590 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7591 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 0, "id": 7592 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7593 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7594 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 1, "id": 7595 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7596 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7597 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7598 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 0, "id": 7599 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7600 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7601 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 1, "id": 7602 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7603 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7604 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7605 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 0, "id": 7606 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7607 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7608 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 1, "id": 7609 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7610 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7611 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7612 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 0, "id": 7613 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7614 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7615 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 1, "id": 7616 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7617 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7618 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7619 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 0, "id": 7620 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7621 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7622 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 1, "id": 7623 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7624 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7625 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7626 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 0, "id": 7627 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7628 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7629 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 1, "id": 7630 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7631 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7632 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7633 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 0, "id": 7634 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7635 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7636 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 1, "id": 7637 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7638 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7639 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7640 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 0, "id": 7641 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7642 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7643 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 1, "id": 7644 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7645 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7646 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7647 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 0, "id": 7648 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7649 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7650 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 1, "id": 7651 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7652 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7653 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7654 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 0, "id": 7655 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7656 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7657 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 1, "id": 7658 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7659 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7660 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7661 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 0, "id": 7662 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7663 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7664 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 1, "id": 7665 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7666 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7667 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7668 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 0, "id": 7669 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7670 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7671 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 1, "id": 7672 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7673 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7674 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7675 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 0, "id": 7676 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7677 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7678 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 1, "id": 7679 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7680 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7681 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7682 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 0, "id": 7683 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7684 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7685 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 1, "id": 7686 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7687 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7688 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7689 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 0, "id": 7690 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7691 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7692 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 1, "id": 7693 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7694 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7695 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7696 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 0, "id": 7697 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7698 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7699 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 1, "id": 7700 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7701 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7702 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7703 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 0, "id": 7704 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7705 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7706 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 1, "id": 7707 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7708 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7709 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7710 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 0, "id": 7711 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7712 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7713 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 1, "id": 7714 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7715 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7716 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7717 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 0, "id": 7718 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7719 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7720 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 1, "id": 7721 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7722 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7723 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7724 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 0, "id": 7725 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7726 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7727 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 1, "id": 7728 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7729 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7730 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7731 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 0, "id": 7732 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7733 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7734 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 1, "id": 7735 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7736 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7737 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7738 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 0, "id": 7739 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7740 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7741 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 1, "id": 7742 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff557b4361", "parentcaller": "0x7fff557b3e47", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7743 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58080032", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7744 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5807fd7f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000254c" } ], "repeated": 0, "id": 7745 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5807fdaa", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 0, "id": 7746 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5807fdca", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 0, "id": 7747 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 7748 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 7749 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002550" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 7750 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 7751 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 0, "id": 7752 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 7753 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 7754 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002550" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 7755 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "ValueName", "value": "MonitorRegistry" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\MonitorRegistry" } ], "repeated": 0, "id": 7756 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 0, "id": 7757 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 7758 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 7759 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002550" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" } ], "repeated": 0, "id": 7760 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 7761 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 0, "id": 7762 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 7763 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 7764 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002550" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" } ], "repeated": 0, "id": 7765 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002550" }, { "name": "ValueName", "value": "MonitorRegistry" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\MonitorRegistry" } ], "repeated": 0, "id": 7766 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 0, "id": 7767 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff55848063", "parentcaller": "0x7fff55848ae6", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" }, { "name": "Handle", "value": "0x00002550" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" } ], "repeated": 0, "id": 7768 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff558480b3", "parentcaller": "0x7fff55848ae6", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002550" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 7769 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff558480df", "parentcaller": "0x7fff55848ae6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 0, "id": 7770 }, { "timestamp": "2026-05-29 01:05:24,430", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5287472a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0xfffffffc" } ], "repeated": 0, "id": 7771 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff557c0016", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001e68" } ], "repeated": 0, "id": 7772 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5287472a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0xfffffffc" } ], "repeated": 0, "id": 7773 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5000", "caller": "0x7fff5781026b", "parentcaller": "0x7fff5585204d", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00001e68" } ], "repeated": 0, "id": 7774 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5000", "caller": "0x7fff558520a2", "parentcaller": "0x7fff55851f69", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "18" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 7775 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5000", "caller": "0x7fff55852301", "parentcaller": "0x7fff55851f69", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "20" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 7776 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5585211d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001e68" } ], "repeated": 0, "id": 7777 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5000", "caller": "0x7fff58081596", "parentcaller": "0x7fff58ac668d", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": ".exe" }, { "name": "Handle", "value": "0x00001e6a" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\.exe" } ], "repeated": 0, "id": 7778 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5000", "caller": "0x7fff5808ab55", "parentcaller": "0x7fff5585290f", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001e6a" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "exefile" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.exe\\(Default)" } ], "repeated": 0, "id": 7779 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5000", "caller": "0x7fff55853405", "parentcaller": "0x7fff55852415", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "exefile" }, { "name": "Handle", "value": "0x00002552" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\exefile" } ], "repeated": 0, "id": 7780 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7781 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000404" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7782 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5000", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002552" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 7783 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5000", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x90\\xbe\\x19\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00R%\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xbf\\x19\\x08\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 7784 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5000", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\exefile\\CurVer" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\exefile\\CurVer" } ], "repeated": 0, "id": 7785 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5000", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00002552" }, { "name": "ObjectAttributesName", "value": "CurVer" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\CurVer" } ], "repeated": 0, "id": 7786 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7787 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000404" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7788 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5000", "caller": "0x7fff58081596", "parentcaller": "0x7fff58ac668d", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002552" }, { "name": "SubKey", "value": "" }, { "name": "Handle", "value": "0x0000254e" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\" } ], "repeated": 0, "id": 7789 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5000", "caller": "0x7fff55852456", "parentcaller": "0x7fff5585298d", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002552" } ], "repeated": 0, "id": 7790 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7791 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000404" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7792 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5000", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b51c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000254e" }, { "name": "ValueName", "value": "IsShortcut" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\IsShortcut" } ], "repeated": 0, "id": 7793 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5000", "caller": "0x7fff58081596", "parentcaller": "0x7fff580a2f64", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000254e" }, { "name": "SubKey", "value": "shell\\runas" }, { "name": "Handle", "value": "0x00002552" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\shell\\runas" } ], "repeated": 0, "id": 7794 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5000", "caller": "0x7fff58095eff", "parentcaller": "0x7fff580969fb", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001e6a" } ], "repeated": 0, "id": 7795 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7796 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000404" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7797 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5000", "caller": "0x7fff577d43a6", "parentcaller": "0x7fff58095eff", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000254e" } ], "repeated": 0, "id": 7798 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5000", "caller": "0x7fff58095eff", "parentcaller": "0x7fff580969fb", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002552" } ], "repeated": 0, "id": 7799 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5000", "caller": "0x7fff577f4f76", "parentcaller": "0x7fff56174710", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 7800 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5000", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5617478c", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "NtQuerySystemInformation" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fed690" } ], "repeated": 0, "id": 7801 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7802 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000404" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7803 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7804 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000404" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7805 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "4636", "caller": "0x7fff557b4361", "parentcaller": "0x7fff557b3e47", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7806 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "4636", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5287472a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0xfffffffc" } ], "repeated": 0, "id": 7807 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "4636", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xf9\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x1c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4636" } ], "repeated": 0, "id": 7808 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58085ee4", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002048" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7809 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 7810 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5000", "caller": "0x7fff561747c7", "parentcaller": "0x7fff44bead16", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "134" } ], "repeated": 0, "id": 7811 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff426b6953", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024d8" } ], "repeated": 0, "id": 7812 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5000", "caller": "0x7fff4257b9c6", "parentcaller": "0x7fff4257e0b8", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7813 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 7814 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "6148", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x18\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6148" } ], "repeated": 0, "id": 7815 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff425c1dd9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001aa8" } ], "repeated": 0, "id": 7816 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5000", "caller": "0x7fff57fc2eeb", "parentcaller": "0x7fff581ba00f", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "{9F4C2855-9F79-4B39-A8D0-E1D42DE1D5F3} 5" }, { "name": "Atom", "value": "0x0000c067" } ], "repeated": 0, "id": 7817 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "6148", "caller": "0x7fff577d07f5", "parentcaller": "0x7fff577cc03b", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" } ], "repeated": 0, "id": 7818 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff4258cadf", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001aa8" } ], "repeated": 0, "id": 7819 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "6148", "caller": "0x7fff577d6785", "parentcaller": "0x7fff40c784bd", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0xfffffffc" } ], "repeated": 0, "id": 7820 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "6148", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff40c61423", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002504" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "12844" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" } ], "repeated": 0, "id": 7821 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "6148", "caller": "0x7fff577d6785", "parentcaller": "0x7fff40c6148a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002504" } ], "repeated": 0, "id": 7822 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "6148", "caller": "0x7fff577d6785", "parentcaller": "0x7fff40c784bd", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0xfffffffc" } ], "repeated": 0, "id": 7823 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5000", "caller": "0x7fff57fc2eeb", "parentcaller": "0x7fff581ba00f", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "{9F4C2855-9F79-4B39-A8D0-E1D42DE1D5F3} 5" }, { "name": "Atom", "value": "0x0000c067" } ], "repeated": 0, "id": 7824 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff4258c7cd", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001aa8" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "12844" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" } ], "repeated": 0, "id": 7825 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff4258cea5", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000024d8" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "12844" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" } ], "repeated": 0, "id": 7826 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5000", "caller": "0x7fff5781026b", "parentcaller": "0x7fff42570dc8", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000024d8" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002550" } ], "repeated": 0, "id": 7827 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "6148", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff517e2503", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001ae0" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "12844" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" } ], "repeated": 0, "id": 7828 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5000", "caller": "0x7fff42570e03", "parentcaller": "0x7fff4258cec1", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 7829 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5000", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00 \\x86\\xc6\\x0b\\x00\\x00\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00H\\x86\\xc6\\x0b\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x86\\xc6\\x0b\\x00\\x00\\x00\\x00T\\x00S\\x00A\\x00:\\x00/\\x00/\\x00P\\x00r\\x00o\\x00c\\x00U\\x00n\\x00i\\x00q\\x00u\\x00e\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00<\\x8b\\x0c\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 7830 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff42570eff", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 0, "id": 7831 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff4258ced7", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024d8" } ], "repeated": 0, "id": 7832 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "6148", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff517e2582", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001af0" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "12844" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" } ], "repeated": 0, "id": 7833 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5000", "caller": "0x7fff57fc2eeb", "parentcaller": "0x7fff581ba00f", "category": "synchronization", "api": "NtFindAtom", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "AtomName", "value": "Windows.Graphics.Holographic.HolographicSpace" }, { "name": "Atom", "value": "0x00000000" } ], "repeated": 0, "id": 7834 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5000", "caller": "0x7fff57fc2a0e", "parentcaller": "0x7fff581d409e", "category": "synchronization", "api": "NtAddAtomEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "ShellPositionerManager:PriorityList" }, { "name": "Atom", "value": "0x0000c081" } ], "repeated": 0, "id": 7835 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "6148", "caller": "0x7fff5781026b", "parentcaller": "0x7fff517e25cc", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001af0" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002504" } ], "repeated": 0, "id": 7836 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "6148", "caller": "0x7fff59f9413e", "parentcaller": "0x7fff517e260a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 7837 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "6148", "caller": "0x7fff59f941a8", "parentcaller": "0x7fff517e260a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "42" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 7838 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "6148", "caller": "0x7fff59f941df", "parentcaller": "0x7fff517e260a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "12" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 7839 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "6148", "caller": "0x7fff59f94256", "parentcaller": "0x7fff517e260a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "44" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x008\\x0e[w^t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\xecQ\r\\x00\\x00\\x00\\x00,2\\x00\\x00\\x00\\x00\\x00\\x00@b\\x88\\x10\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 7840 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "6148", "caller": "0x7fff577d6785", "parentcaller": "0x7fff517e262c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002504" } ], "repeated": 0, "id": 7841 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "6148", "caller": "0x7fff577d6785", "parentcaller": "0x7fff517e2646", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 7842 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "6148", "caller": "0x7fff577d6785", "parentcaller": "0x7fff517e26db", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ae0" } ], "repeated": 0, "id": 7843 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5000", "caller": "0x7fff577cf84f", "parentcaller": "0x7fff583ae663", "category": "synchronization", "api": "NtOpenEvent", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "Handle", "value": "0x0819f710" }, { "name": "EventName", "value": "Local\\1ImmersiveFocusTrackingActiveEvent" } ], "repeated": 0, "id": 7844 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "6148", "caller": "0x7fff577cf588", "parentcaller": "0x7fff517f1181", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "Global\\Session\\1\\ApplicationService:322c1dcef073ab985d2" } ], "repeated": 0, "id": 7845 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "6148", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x18\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6148" } ], "repeated": 0, "id": 7846 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "4696", "caller": "0x7ff79bc76bd8", "parentcaller": "0x7ff79bc8a0c8", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00010110" }, { "name": "Message", "value": "0x0000c028" } ], "repeated": 0, "id": 7847 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "4696", "caller": "0x7ff79bc7b16d", "parentcaller": "0x7ff79bc77060", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "ITaskList_Deleted" }, { "name": "Atom", "value": "0x0000c086" } ], "repeated": 0, "id": 7848 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "4696", "caller": "0x7ff79bd390f4", "parentcaller": "0x7ff79bc7abf8", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\xf9\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00X\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x01\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4696" } ], "repeated": 0, "id": 7849 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "4696", "caller": "0x7ff79bc7ac3c", "parentcaller": "0x7ff79bc7aa5a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001aa8" } ], "repeated": 0, "id": 7850 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "6148", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x18\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6148" } ], "repeated": 0, "id": 7851 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "4696", "caller": "0x7ff79bc7b354", "parentcaller": "0x7ff79bc7b12e", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "CLSID\\{56AD4C5D-B908-4F85-8FF1-7940C29B3BCF}\\Instance" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\CLSID\\{56AD4C5D-B908-4F85-8FF1-7940C29B3BCF}\\Instance" } ], "repeated": 0, "id": 7852 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "4696", "caller": "0x7ff79bc7b354", "parentcaller": "0x7ff79bc7b12e", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 7853 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "4696", "caller": "0x7ff79bc7b354", "parentcaller": "0x7ff79bc7b12e", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff58be0000", "arguments": [ { "name": "lpLibFileName", "value": "shell32.dll" }, { "name": "dwFlags", "value": "0x00004000" } ], "repeated": 0, "id": 7854 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "4696", "caller": "0x7ff79bc7b354", "parentcaller": "0x7ff79bc7b12e", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "SHELL32.dll" }, { "name": "ModuleHandle", "value": "0x7fff58be0000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff58c378f0" } ], "repeated": 0, "id": 7855 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "4696", "caller": "0x7ff79bc7b388", "parentcaller": "0x7ff79bc7b12e", "category": "synchronization", "api": "NtFindAtom", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "AtomName", "value": "{57086C23-86C6-478F-AFB2-236188C8F47F} 3" }, { "name": "Atom", "value": "0x00000000" } ], "repeated": 0, "id": 7856 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff557c3a98", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xfd\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00d\\x14\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5220" } ], "repeated": 0, "id": 7857 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "6148", "caller": "0x7ff79bc3ca89", "parentcaller": "0x7ff79bc3c93f", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002488" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\apppatch\\sysmain.sdb" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7858 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5000", "caller": "0x7fff57fc2eeb", "parentcaller": "0x7fff581ba00f", "category": "synchronization", "api": "NtFindAtom", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "AtomName", "value": "Windows.Internal.Shell.Holographic.Win32PortedView" }, { "name": "Atom", "value": "0x00000000" } ], "repeated": 0, "id": 7859 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a7b1", "parentcaller": "0x7ff79bc7a75a", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000024d8" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "12844" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" } ], "repeated": 0, "id": 7860 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "4696", "caller": "0x7ff79bc9cc23", "parentcaller": "0x7ff79bc70f02", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7861 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "4696", "caller": "0x7ff79bc521d5", "parentcaller": "0x7ff79bc4fce7", "category": "system", "api": "GetLastInputInfo", "status": true, "return": "0x00000001", "arguments": [], "repeated": 0, "id": 7862 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5000", "caller": "0x7fff57fc2eeb", "parentcaller": "0x7fff581ba00f", "category": "synchronization", "api": "NtFindAtom", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "AtomName", "value": "Windows.Internal.Shell.Holographic.Win32PortedView" }, { "name": "Atom", "value": "0x00000000" } ], "repeated": 0, "id": 7863 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff455848a6", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002458" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "12844" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" } ], "repeated": 0, "id": 7864 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "4696", "caller": "0x7ff79bc521fe", "parentcaller": "0x7ff79bc4fce7", "category": "device", "api": "NtPowerInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "InformationLevel", "value": "16" }, { "name": "InputBuffer", "value": "" }, { "name": "OutputBuffer", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 7865 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5000", "caller": "0x7fff5781026b", "parentcaller": "0x7fff45584920", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002458" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002534" } ], "repeated": 0, "id": 7866 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5000", "caller": "0x7fff45584c45", "parentcaller": "0x7fff45584941", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 7867 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7bdd2", "parentcaller": "0x7ff79bc7a52a", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" } ], "repeated": 0, "id": 7868 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5000", "caller": "0x7fff57fc2eeb", "parentcaller": "0x7fff581ba00f", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "MultimonitorActivationException" }, { "name": "Atom", "value": "0x0000c049" } ], "repeated": 0, "id": 7869 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "4696", "caller": "0x7ff79bc77e17", "parentcaller": "0x7ff79bc773fa", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00010094" }, { "name": "Message", "value": "0x000004f3" } ], "repeated": 0, "id": 7870 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7bdd2", "parentcaller": "0x7ff79bc7a52a", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x08e9ac60", "arguments": [ { "name": "FileName", "value": "C:\\Windows" }, { "name": "FirstCreateTimeLow", "value": "0x3a6eea36" }, { "name": "FirstCreateTimeHigh", "value": "0x01ca0431" } ], "repeated": 0, "id": 7871 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5000", "caller": "0x7fff57fc2eeb", "parentcaller": "0x7fff581ba00f", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "Microsoft.Windows.WindowFactory.ViewId" }, { "name": "Atom", "value": "0x0000c050" } ], "repeated": 0, "id": 7872 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "4696", "caller": "0x7ff79bc521fe", "parentcaller": "0x7ff79bc51a67", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ae0" } ], "repeated": 0, "id": 7873 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7bdd2", "parentcaller": "0x7ff79bc7a52a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024d8" } ], "repeated": 0, "id": 7874 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "4696", "caller": "0x7ff79bc521fe", "parentcaller": "0x7ff79bc51a67", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 7875 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbd423", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000256c" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "12844" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" } ], "repeated": 0, "id": 7876 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7bdd2", "parentcaller": "0x7ff79bc7a52a", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x08e9a060", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32" }, { "name": "FirstCreateTimeLow", "value": "0x3a6eea36" }, { "name": "FirstCreateTimeHigh", "value": "0x01d5acdd" } ], "repeated": 0, "id": 7877 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "6148", "caller": "0x7ff79bc3c5c3", "parentcaller": "0x7ff79bc3c407", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002488" }, { "name": "HandleName", "value": "C:\\Windows\\apppatch\\sysmain.sdb" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x000>\\x00\\x00\\x00\\x00\\x00\\xec'>\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 7878 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "6148", "caller": "0x7ff79bc3c62d", "parentcaller": "0x7ff79bc3c407", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002504" }, { "name": "DesiredAccess", "value": "0x000f0005", "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x00002488" }, { "name": "FileName", "value": "C:\\Windows\\apppatch\\sysmain.sdb" } ], "repeated": 0, "id": 7879 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5000", "caller": "0x7fff57fc2eeb", "parentcaller": "0x7fff581ba00f", "category": "synchronization", "api": "NtFindAtom", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "AtomName", "value": "Windows.Internal.Shell.Holographic.Win32PortedView" }, { "name": "Atom", "value": "0x00000000" } ], "repeated": 0, "id": 7880 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "6148", "caller": "0x7ff79bc3c67f", "parentcaller": "0x7ff79bc3c407", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002504" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7df4add90000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x003e3000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7881 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "6148", "caller": "0x7ff79bc3a115", "parentcaller": "0x7ff79bc3a073", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "1", "pretty_value": "FILE_OPEN" } ], "repeated": 0, "id": 7882 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "4696", "caller": "0x7ff79bc76bd8", "parentcaller": "0x7ff79bc8a0c8", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00010110" }, { "name": "Message", "value": "0x0000c028" } ], "repeated": 0, "id": 7883 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5000", "caller": "0x7fff57fc2eeb", "parentcaller": "0x7fff581ba00f", "category": "synchronization", "api": "NtFindAtom", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "AtomName", "value": "Windows.Internal.Shell.Holographic.Win32PortedView" }, { "name": "Atom", "value": "0x00000000" } ], "repeated": 0, "id": 7884 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff455848a6", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002550" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "12844" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" } ], "repeated": 0, "id": 7885 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5000", "caller": "0x7fff5781026b", "parentcaller": "0x7fff45584920", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002550" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00001ae0" } ], "repeated": 0, "id": 7886 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5000", "caller": "0x7fff45584c45", "parentcaller": "0x7fff45584941", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 7887 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5000", "caller": "0x7fff45584ce5", "parentcaller": "0x7fff45584941", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00`\\xa0\\xc6\\x0b\\x00\\x00\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00\\x88\\xa0\\xc6\\x0b\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa8\\xa0\\xc6\\x0b\\x00\\x00\\x00\\x00T\\x00S\\x00A\\x00:\\x00/\\x00/\\x00P\\x00r\\x00o\\x00c\\x00U\\x00n\\x00i\\x00q\\x00u\\x00e\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00<\\x8b\\x0c\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 7888 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff45584956", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ae0" } ], "repeated": 0, "id": 7889 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff455a1181", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002550" } ], "repeated": 0, "id": 7890 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7bdd2", "parentcaller": "0x7ff79bc7a52a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ae0" } ], "repeated": 0, "id": 7891 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff557c3a98", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xfe\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00`\r\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "3424" } ], "repeated": 0, "id": 7892 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7bdd2", "parentcaller": "0x7ff79bc7a52a", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x08e9a4e0", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0" }, { "name": "FirstCreateTimeLow", "value": "0xc89b8c5c" }, { "name": "FirstCreateTimeHigh", "value": "0x01d5acde" } ], "repeated": 0, "id": 7893 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "6160", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 7894 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "6148", "caller": "0x7ff79bd391cb", "parentcaller": "0x7ff79bd39626", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x18\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x01\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6148" } ], "repeated": 0, "id": 7895 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7bdd2", "parentcaller": "0x7ff79bc7a52a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 7896 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "6148", "caller": "0x7ff79bc3a83e", "parentcaller": "0x7ff79bc3a7ba", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" } ], "repeated": 0, "id": 7897 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "6148", "caller": "0x7ff79bc3a859", "parentcaller": "0x7ff79bc3a7ba", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002504" } ], "repeated": 0, "id": 7898 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "9572", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00d%\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "9572" } ], "repeated": 0, "id": 7899 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "9572", "caller": "0x7ff79bd392d5", "parentcaller": "0x00000000", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000100c4" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 7900 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "6148", "caller": "0x7ff79bc3a878", "parentcaller": "0x7ff79bc3a7ba", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7df4add90000" }, { "name": "RegionSize", "value": "0x003e3000" } ], "repeated": 0, "id": 7901 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "6148", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x18\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6148" } ], "repeated": 0, "id": 7902 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "9572", "caller": "0x7ff79bc1afc1", "parentcaller": "0x7ff79bd39313", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000100c4" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 1, "id": 7903 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000254c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "12844" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" } ], "repeated": 0, "id": 7904 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "9572", "caller": "0x7ff79bc9d698", "parentcaller": "0x7ff79bc98780", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000100c4" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 7905 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "SHELL32.dll" }, { "name": "ModuleHandle", "value": "0x7fff58be0000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff58c378f0" } ], "repeated": 0, "id": 7906 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002524" } ], "repeated": 0, "id": 7907 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "{9F4C2855-9F79-4B39-A8D0-E1D42DE1D5F3} 5" }, { "name": "Atom", "value": "0x0000c067" } ], "repeated": 0, "id": 7908 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002524" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "12844" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" } ], "repeated": 0, "id": 7909 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbddbb", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001e68" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "6136" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" } ], "repeated": 0, "id": 7910 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbddbb", "category": "process", "api": "NtOpenProcess", "status": false, "return": "0xffffffffc0000022", "pretty_return": "ACCESS_DENIED", "arguments": [ { "name": "ProcessHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "1180" } ], "repeated": 0, "id": 7911 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001af0" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "12844" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" } ], "repeated": 0, "id": 7912 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002524" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002290" } ], "repeated": 0, "id": 7913 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbddbb", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001190" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "5624" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" } ], "repeated": 0, "id": 7914 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbddbb", "category": "process", "api": "NtOpenProcess", "status": false, "return": "0xffffffffc0000022", "pretty_return": "ACCESS_DENIED", "arguments": [ { "name": "ProcessHandle", "value": "0x00001190" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "1048" } ], "repeated": 0, "id": 7915 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbddbb", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002414" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 7916 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001af0" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002504" } ], "repeated": 0, "id": 7917 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbddbb", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000024b8" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "12844" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" } ], "repeated": 0, "id": 7918 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\x00\\x7e4\\x0c\\x00\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 7919 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbddbb", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000024c4" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "5128" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" } ], "repeated": 0, "id": 7920 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 7921 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 7922 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002290" } ], "repeated": 0, "id": 7923 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 1, "id": 7924 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002504" } ], "repeated": 0, "id": 7925 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 7926 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002524" } ], "repeated": 0, "id": 7927 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 4, "id": 7928 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002504" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "12844" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" } ], "repeated": 0, "id": 7929 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 4, "id": 7930 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xe0O\\xa5\\x0c\\x00\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 7931 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 1, "id": 7932 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002504" } ], "repeated": 0, "id": 7933 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 2, "id": 7934 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "4696", "caller": "0x7ff79bc76bd8", "parentcaller": "0x7ff79bc8a0c8", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00010110" }, { "name": "Message", "value": "0x0000c028" } ], "repeated": 0, "id": 7935 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 3, "id": 7936 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5000", "caller": "0x7fff41dbe842", "parentcaller": "0x7fff41dbd62c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002474" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "\\Device\\Bam" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 7937 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "6148", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x18\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6148" } ], "repeated": 0, "id": 7938 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5000", "caller": "0x7fff41dbe8a3", "parentcaller": "0x7fff41dbd62c", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002474" }, { "name": "HandleName", "value": "\\Device\\Bam" }, { "name": "IoControlCode", "value": "0x00220004" }, { "name": "InputBuffer", "value": "\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x1e\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9c\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14$\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb8$\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc4$\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00d$\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 7939 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff41dbe9a9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001e68" } ], "repeated": 0, "id": 7940 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff41dbe9a9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001190" } ], "repeated": 0, "id": 7941 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff41dbe9a9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b8" } ], "repeated": 0, "id": 7942 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff41dbe9a9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024c4" } ], "repeated": 0, "id": 7943 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "6148", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x18\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6148" } ], "repeated": 0, "id": 7944 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff41dbe9a9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" } ], "repeated": 0, "id": 7945 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5000", "caller": "0x7fff41dbe9d8", "parentcaller": "0x7fff41dbd62c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002474" } ], "repeated": 0, "id": 7946 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "6148", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x18\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6148" } ], "repeated": 0, "id": 7947 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5000", "caller": "0x7fff41dbd63b", "parentcaller": "0x7fff41dfc80c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002534" } ], "repeated": 0, "id": 7948 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff41dbd64f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002458" } ], "repeated": 0, "id": 7949 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5000", "caller": "0x7fff42568962", "parentcaller": "0x7fff42567e38", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001011a" }, { "name": "Message", "value": "0x00000401" } ], "repeated": 0, "id": 7950 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5000", "caller": "0x7fff57fc2eeb", "parentcaller": "0x7fff581ba00f", "category": "synchronization", "api": "NtFindAtom", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "AtomName", "value": "Windows.Internal.Shell.Holographic.Win32PortedView" }, { "name": "Atom", "value": "0x00000000" } ], "repeated": 1, "id": 7951 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "6148", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x18\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6148" } ], "repeated": 0, "id": 7952 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff455848a6", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002458" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "12844" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" } ], "repeated": 0, "id": 7953 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5000", "caller": "0x7fff5781026b", "parentcaller": "0x7fff45584920", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002458" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002534" } ], "repeated": 0, "id": 7954 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5000", "caller": "0x7fff45584c45", "parentcaller": "0x7fff45584941", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 7955 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5000", "caller": "0x7fff45584ce5", "parentcaller": "0x7fff45584941", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xe0k\\xc6\\x0b\\x00\\x00\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00\\x08l\\xc6\\x0b\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00(l\\xc6\\x0b\\x00\\x00\\x00\\x00T\\x00S\\x00A\\x00:\\x00/\\x00/\\x00P\\x00r\\x00o\\x00c\\x00U\\x00n\\x00i\\x00q\\x00u\\x00e\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00<\\x8b\\x0c\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 7956 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "6148", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x18\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6148" } ], "repeated": 0, "id": 7957 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5000", "caller": "0x7fff425a9007", "parentcaller": "0x7fff425a8c10", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7958 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "6148", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x18\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6148" } ], "repeated": 0, "id": 7959 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000256c" }, { "name": "DesiredAccess", "value": "0x00020000", "pretty_value": "READ_CONTROL" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 7960 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "12852", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00020072" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 1, "id": 7961 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 7962 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577aebe9", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000024c4" }, { "name": "SubKey", "value": "User\\Index\\UserSid\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "Handle", "value": "0x00002414" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\User\\Index\\UserSid\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 7963 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "12852", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00020072" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 7964 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "4620", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577aec6d", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002414" } ], "repeated": 0, "id": 7965 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577ae9b0", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000024c4" }, { "name": "SubKey", "value": "PackageExternalLocation\\Index\\UserAndPackage\\3^22" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\PackageExternalLocation\\Index\\UserAndPackage\\3^22" } ], "repeated": 0, "id": 7966 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577ae9b0", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000024c4" }, { "name": "SubKey", "value": "PackageExternalLocation\\Index\\UserAndPackage\\0^22" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\PackageExternalLocation\\Index\\UserAndPackage\\0^22" } ], "repeated": 0, "id": 7967 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "12852", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 7968 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577af308", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000024c4" }, { "name": "SubKey", "value": "Package\\Data\\22" }, { "name": "Handle", "value": "0x00002414" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\22" } ], "repeated": 0, "id": 7969 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "12852", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 7970 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "4620", "caller": "0x7fff577d3e41", "parentcaller": "0x7fff578543b9", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002414" }, { "name": "ValueName", "value": "InstalledLocation" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "C:\\Windows\\SystemApps\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\22\\InstalledLocation" } ], "repeated": 0, "id": 7971 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "12852", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002524" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 7972 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "4620", "caller": "0x7fff4cbd180b", "parentcaller": "0x7fff577ae12f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024c4" } ], "repeated": 0, "id": 7973 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "12852", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002524" } ], "repeated": 0, "id": 7974 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "12852", "caller": "0x7fff5587d014", "parentcaller": "0x7fff558252c1", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "CLSID\\{4234D49B-0245-4DF3-B780-3893943456E1}\\Instance" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\CLSID\\{4234D49B-0245-4DF3-B780-3893943456E1}\\Instance" } ], "repeated": 0, "id": 7975 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" } ], "repeated": 0, "id": 7976 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "12852", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 7977 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "12852", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff58be0000", "arguments": [ { "name": "lpLibFileName", "value": "shell32.dll" }, { "name": "dwFlags", "value": "0x00004000" } ], "repeated": 0, "id": 7978 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "12852", "caller": "0x7fff577dac31", "parentcaller": "0x7fff558258ff", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "SHELL32.dll" }, { "name": "ModuleHandle", "value": "0x7fff58be0000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff58c378f0" } ], "repeated": 0, "id": 7979 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 7980 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000256c" }, { "name": "DesiredAccess", "value": "0x00020000", "pretty_value": "READ_CONTROL" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 7981 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7fff57812a7e", "parentcaller": "0x7fff44c0f12b", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 7982 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000254c" } ], "repeated": 0, "id": 7983 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "MutexName", "value": "" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 7984 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002474" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7985 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7986 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7987 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7988 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" } ], "repeated": 0, "id": 7989 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "12852", "caller": "0x7fff55825882", "parentcaller": "0x7fff55828f55", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "4234D49B-0245-4DF3-B780-3893943456E1" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "000214E6-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 7990 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002290" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7991 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "12852", "caller": "0x7fff5781026b", "parentcaller": "0x7fff5585204d", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002530" } ], "repeated": 0, "id": 7992 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "12852", "caller": "0x7fff558520a2", "parentcaller": "0x7fff55851f69", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "18" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 7993 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7994 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "12852", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002530" } ], "repeated": 0, "id": 7995 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7996 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "12852", "caller": "0x7fff58081596", "parentcaller": "0x7fff58ac668d", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": ".exe" }, { "name": "Handle", "value": "0x00002532" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\.exe" } ], "repeated": 0, "id": 7997 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7998 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7999 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "12852", "caller": "0x7fff5808ab55", "parentcaller": "0x7fff5585290f", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002532" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "exefile" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.exe\\(Default)" } ], "repeated": 0, "id": 8000 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8001 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8002 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8003 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8004 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 8005 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" } ], "repeated": 0, "id": 8006 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "12852", "caller": "0x7fff55853405", "parentcaller": "0x7fff55852415", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "exefile" }, { "name": "Handle", "value": "0x00002262" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\exefile" } ], "repeated": 0, "id": 8007 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "12852", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002262" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\exefile" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 8008 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8009 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "12852", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002262" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 8010 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "12852", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd2\\xbc\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00b\"\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\xd3\\xbc\\x0f\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8011 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "12852", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\exefile\\CurVer" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\exefile\\CurVer" } ], "repeated": 0, "id": 8012 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "12852", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002262" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 8013 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8014 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8015 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "12852", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00002262" }, { "name": "ObjectAttributesName", "value": "CurVer" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\CurVer" } ], "repeated": 0, "id": 8016 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" } ], "repeated": 1, "id": 8017 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "12852", "caller": "0x7fff58081596", "parentcaller": "0x7fff58ac668d", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002262" }, { "name": "SubKey", "value": "" }, { "name": "Handle", "value": "0x00002526" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\" } ], "repeated": 0, "id": 8018 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "12852", "caller": "0x7fff55852456", "parentcaller": "0x7fff5585298d", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002262" } ], "repeated": 0, "id": 8019 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8020 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8021 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" } ], "repeated": 0, "id": 8022 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "12852", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002526" }, { "name": "ValueName", "value": "IsShortcut" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\IsShortcut" } ], "repeated": 0, "id": 8023 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8024 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 8025 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "12852", "caller": "0x7fff58081596", "parentcaller": "0x7fff580a2f64", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002526" }, { "name": "SubKey", "value": "shell\\runas" }, { "name": "Handle", "value": "0x00002262" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\shell\\runas" } ], "repeated": 0, "id": 8026 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "12852", "caller": "0x7fff58095eff", "parentcaller": "0x7fff580969fb", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002532" } ], "repeated": 0, "id": 8027 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "12852", "caller": "0x7fff58095eff", "parentcaller": "0x7fff580969fb", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002526" } ], "repeated": 0, "id": 8028 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "12852", "caller": "0x7fff58095eff", "parentcaller": "0x7fff580969fb", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002262" } ], "repeated": 0, "id": 8029 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 8030 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8031 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8032 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8033 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" } ], "repeated": 0, "id": 8034 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "12852", "caller": "0x7fff577f4f76", "parentcaller": "0x7fff56174710", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 8035 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "12852", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5617478c", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "NtQuerySystemInformation" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fed690" } ], "repeated": 0, "id": 8036 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8037 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8038 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8039 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8040 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" } ], "repeated": 0, "id": 8041 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 8042 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" } ], "repeated": 0, "id": 8043 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 8044 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "12852", "caller": "0x7fff561747c7", "parentcaller": "0x7fff44bead16", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "134" } ], "repeated": 0, "id": 8045 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8046 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8047 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 8048 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 8049 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 8050 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 8051 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000024c4" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 8052 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8053 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000024c4" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 8054 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024c4" } ], "repeated": 0, "id": 8055 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8056 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8057 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 8058 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 8059 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 8060 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 8061 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000024c4" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 8062 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "4560", "caller": "0x7fff577d5783", "parentcaller": "0x7fff41e06755", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001520" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\GameDVR\\KnownGameList.bin" }, { "name": "Buffer", "value": "\\xe8\\x00\\x00\\x00<\\x00p\\x00l\\x00a\\x00n\\x00e\\x00t\\x00a\\x00l\\x00p\\x00h\\x00a\\x00-\\x00w\\x00i\\x00n\\x006\\x004\\x00-\\x00s\\x00h\\x00i\\x00p\\x00p\\x00i\\x00n\\x00g\\x00.\\x00e\\x00x\\x00e\\x00]\n\\x02\\x00\\x02\\x00\\x02\\x00\\x00\\x00\\x18\\x00\\x00\\x00P\\x00L\\x00A\\x00N\\x00E\\x00T\\x00 \\x00A\\x00L\\x00P\\x00H\\x00A\\x00\\x01\\x00\\x00\\x00\n\\x00\\x00\\x00W\\x00i\\x00n\\x006\\x004\\x00Y\n\\x00\\x00\\x00 H\\x00\\x00\\x007\\x008\\x001\\x00f\\x00f\\x005\\x006\\x00c\\x00-\\x009\\x00b\\x002\\x00f\\x00-\\x004\\x008\\x004\\x003\\x00-\\x009\\x004\\x001\\x006\\x00-\\x00e\\x00e\\x002\\x00b\\x006\\x009\\x009\\x008\\x007\\x004\\x00c\\x008\\x00\\x02\\x00\\x00 \\x14\\x00\\x00\\x001\\x007\\x005\\x009\\x007\\x003\\x004\\x001\\x004\\x000\\x00x\\x00\\x00\\x00\\x1c\\x00p\\x00l\\x00a\\x00n\\x00e\\x00t\\x00b\\x00a\\x00s\\x00" }, { "name": "Length", "value": "8956" } ], "repeated": 0, "id": 8063 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 8064 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8065 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8066 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 8067 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "4560", "caller": "0x7fff41ddcd4f", "parentcaller": "0x7fff41ddc737", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8068 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "4560", "caller": "0x7fff577d5326", "parentcaller": "0x7fff41ddd4af", "category": "filesystem", "api": "NtWriteFile", "status": false, "return": "0xffffffffc0000008", "pretty_return": "INVALID_HANDLE", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "HandleName", "value": "" }, { "name": "Buffer", "value": "" }, { "name": "Length", "value": "0" } ], "repeated": 1, "id": 8069 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000024c4" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" } ], "repeated": 0, "id": 8070 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "4560", "caller": "0x7fff577d5326", "parentcaller": "0x7fff41ddd4af", "category": "filesystem", "api": "NtWriteFile", "status": false, "return": "0xffffffffc0000008", "pretty_return": "INVALID_HANDLE", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "HandleName", "value": "" }, { "name": "Buffer", "value": "" }, { "name": "Length", "value": "0" } ], "repeated": 0, "id": 8071 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8072 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8073 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000024c4" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 8074 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "4560", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\x11\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4560" } ], "repeated": 0, "id": 8075 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 8076 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024c4" } ], "repeated": 0, "id": 8077 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 8078 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 2, "id": 8079 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 8080 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 8081 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000024c4" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" } ], "repeated": 0, "id": 8082 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 8083 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000024c4" }, { "name": "ValueName", "value": "MonitorRegistry" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\MonitorRegistry" } ], "repeated": 0, "id": 8084 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001838" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 8085 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "6160", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x18\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6160" } ], "repeated": 0, "id": 8086 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8087 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001838" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 8088 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8089 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8090 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001838" } ], "repeated": 0, "id": 8091 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" } ], "repeated": 0, "id": 8092 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 8093 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 8094 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001838" }, { "name": "ValueName", "value": "MonitorRegistry" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\MonitorRegistry" } ], "repeated": 0, "id": 8095 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001838" } ], "repeated": 0, "id": 8096 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002474" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk" }, { "name": "FileInformationClass", "value": "4", "pretty_value": "FileBasicInformation" }, { "name": "FileInformation", "value": "\\\\xbd\\xd6\\x9c\\xb6\\xee\\xdc\\x01Q\\x1c\\xcb:\\x07\\xef\\xdc\\x01z\\xe4:{\\xde\\xac\\xd5\\x01\\xbe7\\xc0\\xa1\\xb7\\xee\\xdc\\x01 \\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8097 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 8098 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 8099 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001838" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" } ], "repeated": 0, "id": 8100 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001838" } ], "repeated": 0, "id": 8101 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 8102 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002474" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xeb\t\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8103 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 8104 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8105 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8106 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 8107 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" } ], "repeated": 0, "id": 8108 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001838" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" } ], "repeated": 0, "id": 8109 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8110 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001838" }, { "name": "ValueName", "value": "MonitorRegistry" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\MonitorRegistry" } ], "repeated": 0, "id": 8111 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8112 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8113 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" } ], "repeated": 0, "id": 8114 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001838" } ], "repeated": 0, "id": 8115 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8116 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8117 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" } ], "repeated": 0, "id": 8118 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8119 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" } ], "repeated": 0, "id": 8120 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8121 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8122 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8123 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8124 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8125 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 8126 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" } ], "repeated": 0, "id": 8127 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8128 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8129 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" } ], "repeated": 1, "id": 8130 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8131 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8132 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8133 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" } ], "repeated": 0, "id": 8134 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002290" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk" }, { "name": "FileInformationClass", "value": "4", "pretty_value": "FileBasicInformation" }, { "name": "FileInformation", "value": "\\\\xbd\\xd6\\x9c\\xb6\\xee\\xdc\\x01Q\\x1c\\xcb:\\x07\\xef\\xdc\\x01z\\xe4:{\\xde\\xac\\xd5\\x01\\xbe7\\xc0\\xa1\\xb7\\xee\\xdc\\x01 \\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8135 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8136 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8137 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" } ], "repeated": 1, "id": 8138 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8139 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8140 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8141 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" } ], "repeated": 0, "id": 8142 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002290" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xeb\t\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8143 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8144 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8145 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8146 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8147 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" } ], "repeated": 0, "id": 8148 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 8149 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" } ], "repeated": 0, "id": 8150 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 8151 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8152 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8153 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8154 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8155 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8156 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8157 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" } ], "repeated": 0, "id": 8158 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 8159 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8160 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8161 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8162 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8163 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" } ], "repeated": 0, "id": 8164 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 8165 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" } ], "repeated": 0, "id": 8166 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 8167 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8168 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8169 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8170 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8171 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8172 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8173 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" } ], "repeated": 0, "id": 8174 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 8175 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8176 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8177 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8178 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8179 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" } ], "repeated": 0, "id": 8180 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 8181 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" } ], "repeated": 0, "id": 8182 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 8183 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8184 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8185 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8186 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8187 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8188 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8189 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" } ], "repeated": 0, "id": 8190 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 8191 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8192 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8193 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 1, "id": 8194 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8195 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8196 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8197 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 8198 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" } ], "repeated": 0, "id": 8199 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8200 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" } ], "repeated": 0, "id": 8201 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8202 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8203 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8204 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 8205 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" } ], "repeated": 0, "id": 8206 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8207 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8208 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8209 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8210 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8211 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" } ], "repeated": 0, "id": 8212 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 8213 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" } ], "repeated": 0, "id": 8214 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8215 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8216 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8217 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 8218 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8219 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8220 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 8221 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" } ], "repeated": 0, "id": 8222 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8223 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8224 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8225 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8226 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8227 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" } ], "repeated": 0, "id": 8228 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 8229 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" } ], "repeated": 0, "id": 8230 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8231 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8232 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8233 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 8234 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8235 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8236 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 8237 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" } ], "repeated": 0, "id": 8238 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8239 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8240 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8241 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8242 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8243 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" } ], "repeated": 0, "id": 8244 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 8245 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" } ], "repeated": 0, "id": 8246 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8247 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8248 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8249 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 8250 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8251 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8252 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 8253 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" } ], "repeated": 0, "id": 8254 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8255 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8256 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8257 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8258 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8259 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" } ], "repeated": 0, "id": 8260 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 8261 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" } ], "repeated": 0, "id": 8262 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8263 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8264 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8265 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 8266 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8267 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8268 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 8269 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" } ], "repeated": 0, "id": 8270 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8271 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8272 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8273 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8274 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8275 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" } ], "repeated": 0, "id": 8276 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 8277 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" } ], "repeated": 0, "id": 8278 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8279 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8280 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8281 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8282 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 8283 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" } ], "repeated": 0, "id": 8284 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 8285 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8286 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8287 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8288 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" } ], "repeated": 0, "id": 8289 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8290 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8291 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" } ], "repeated": 0, "id": 8292 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8293 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8294 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8295 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" } ], "repeated": 0, "id": 8296 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 1, "id": 8297 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8298 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8299 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8300 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" } ], "repeated": 0, "id": 8301 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8302 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8303 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" } ], "repeated": 0, "id": 8304 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8305 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 8306 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8307 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8308 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8309 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8310 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" } ], "repeated": 0, "id": 8311 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 1, "id": 8312 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8313 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8314 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8315 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" } ], "repeated": 1, "id": 8316 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8317 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8318 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8319 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 8320 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8321 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8322 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8323 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8324 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" } ], "repeated": 0, "id": 8325 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 1, "id": 8326 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8327 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8328 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8329 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" } ], "repeated": 1, "id": 8330 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8331 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8332 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8333 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 8334 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8335 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8336 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8337 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8338 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" } ], "repeated": 0, "id": 8339 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 1, "id": 8340 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8341 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8342 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8343 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" } ], "repeated": 1, "id": 8344 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8345 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8346 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8347 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 8348 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8349 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8350 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8351 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8352 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" } ], "repeated": 0, "id": 8353 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 8354 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8355 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8356 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 8357 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" } ], "repeated": 0, "id": 8358 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8359 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" } ], "repeated": 0, "id": 8360 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8361 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8362 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8363 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 8364 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8365 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8366 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" } ], "repeated": 0, "id": 8367 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8368 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8369 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 8370 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8371 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8372 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 8373 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" } ], "repeated": 0, "id": 8374 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8375 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4c2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" } ], "repeated": 0, "id": 8376 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8377 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8378 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8379 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8380 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8381 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 8382 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" } ], "repeated": 0, "id": 8383 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8384 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8385 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8386 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8387 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 8388 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" } ], "repeated": 0, "id": 8389 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 8390 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" } ], "repeated": 0, "id": 8391 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8392 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8393 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8394 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8395 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8396 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8397 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 8398 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" } ], "repeated": 0, "id": 8399 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8400 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8401 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8402 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8403 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 8404 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" } ], "repeated": 0, "id": 8405 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 8406 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" } ], "repeated": 0, "id": 8407 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8408 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8409 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8410 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8411 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8412 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8413 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 8414 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" } ], "repeated": 0, "id": 8415 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8416 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8417 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8418 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8419 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 8420 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" } ], "repeated": 0, "id": 8421 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 8422 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" } ], "repeated": 0, "id": 8423 }, { "timestamp": "2026-05-29 01:05:24,446", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8424 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8425 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8426 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8427 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 8428 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8429 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8430 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 1, "id": 8431 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8432 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8433 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8434 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 8435 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8436 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8437 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 1, "id": 8438 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8439 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8440 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8441 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 8442 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8443 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8444 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 1, "id": 8445 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8446 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8447 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8448 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 8449 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8450 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8451 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 1, "id": 8452 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8453 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8454 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8455 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 8456 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8457 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8458 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 1, "id": 8459 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 8460 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8461 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" } ], "repeated": 0, "id": 8462 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8463 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8464 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002290" } ], "repeated": 0, "id": 8465 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" } ], "repeated": 0, "id": 8466 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 8467 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 8468 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8469 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 8470 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 8471 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000256c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 8472 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8473 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 8474 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" } ], "repeated": 0, "id": 8475 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 8476 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" } ], "repeated": 0, "id": 8477 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 2, "id": 8478 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 8479 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 8480 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000256c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 8481 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 8482 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "ValueName", "value": "MonitorRegistry" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\MonitorRegistry" } ], "repeated": 0, "id": 8483 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002464" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 8484 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 8485 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 8486 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 8487 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" } ], "repeated": 0, "id": 8488 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 8489 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 8490 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 8491 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000256c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" } ], "repeated": 0, "id": 8492 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 8493 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 8494 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 8495 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "ValueName", "value": "MonitorRegistry" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\MonitorRegistry" } ], "repeated": 0, "id": 8496 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 8497 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" } ], "repeated": 0, "id": 8498 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 8499 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 8500 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000256c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" } ], "repeated": 0, "id": 8501 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 8502 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000256c" }, { "name": "ValueName", "value": "MonitorRegistry" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\MonitorRegistry" } ], "repeated": 0, "id": 8503 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 8504 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 8505 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" } ], "repeated": 0, "id": 8506 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 8507 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" }, { "name": "Handle", "value": "0x0000256c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" } ], "repeated": 0, "id": 8508 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000256c" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 8509 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 8510 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000256c" } ], "repeated": 0, "id": 8511 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001838" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" } ], "repeated": 0, "id": 8512 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001838" }, { "name": "ValueName", "value": "MonitorRegistry" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\MonitorRegistry" } ], "repeated": 0, "id": 8513 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "3424", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000254c" } ], "repeated": 0, "id": 8514 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001838" } ], "repeated": 0, "id": 8515 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "3424", "caller": "0x7ff79bc79e89", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "CreateTimerQueueTimer", "status": true, "return": "0x00000001", "arguments": [ { "name": "phNewTimer", "value": "0x0caaf170" }, { "name": "TimerQueue", "value": "0x00000000" }, { "name": "Callback", "value": "0x9bc79ab0" }, { "name": "Parameter", "value": "0x07622ee0" }, { "name": "DueTime", "value": "3000" }, { "name": "Period", "value": "0" }, { "name": "Flags", "value": "8" } ], "repeated": 0, "id": 8516 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "3424", "caller": "0x7fff577d6785", "parentcaller": "0x7fff557c403a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024d8" } ], "repeated": 0, "id": 8517 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" }, { "name": "Handle", "value": "0x00001838" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" } ], "repeated": 0, "id": 8518 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001838" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 8519 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001838" } ], "repeated": 0, "id": 8520 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0xfffffffc" } ], "repeated": 0, "id": 8521 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "5220", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 8522 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "5220", "caller": "0x7ff79bdadb8b", "parentcaller": "0x7ff79bc79a4f", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001af0" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "12844" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" } ], "repeated": 0, "id": 8523 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "5220", "caller": "0x7ff79bdadb8b", "parentcaller": "0x7ff79bc79a4f", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001af0" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00001838" } ], "repeated": 0, "id": 8524 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "5220", "caller": "0x7ff79bdadb8b", "parentcaller": "0x7ff79bc79a4f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 8525 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "5220", "caller": "0x7ff79bdadb8b", "parentcaller": "0x7ff79bc79a4f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xe0k\\xc6\\x0b\\x00\\x00\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00\\x08l\\xc6\\x0b\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00(l\\xc6\\x0b\\x00\\x00\\x00\\x00T\\x00S\\x00A\\x00:\\x00/\\x00/\\x00P\\x00r\\x00o\\x00c\\x00U\\x00n\\x00i\\x00q\\x00u\\x00e\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00<\\x8b\\x0c\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8526 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "5220", "caller": "0x7ff79bdadb8b", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001838" } ], "repeated": 0, "id": 8527 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "5220", "caller": "0x7ff79bdadb8b", "parentcaller": "0x7ff79bc79a4f", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001838" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "12844" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" } ], "repeated": 0, "id": 8528 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "5220", "caller": "0x7ff79bdadb8b", "parentcaller": "0x7ff79bc79a4f", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001838" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002520" } ], "repeated": 0, "id": 8529 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "5220", "caller": "0x7ff79bdadb8b", "parentcaller": "0x7ff79bc79a4f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xa0/\\xa5\\x0c\\x00\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8530 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "5220", "caller": "0x7ff79bdadb8b", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002520" } ], "repeated": 0, "id": 8531 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "5220", "caller": "0x7ff79bdadb8b", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001838" } ], "repeated": 0, "id": 8532 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "5220", "caller": "0x7ff79bdadb8b", "parentcaller": "0x7ff79bc79a4f", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001838" }, { "name": "DesiredAccess", "value": "0x00020000", "pretty_value": "READ_CONTROL" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 8533 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "5220", "caller": "0x7ff79bdadb8b", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001838" } ], "repeated": 0, "id": 8534 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "5220", "caller": "0x7ff79bdadb8b", "parentcaller": "0x7ff79bc79a4f", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001838" }, { "name": "DesiredAccess", "value": "0x00020000", "pretty_value": "READ_CONTROL" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 8535 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "5220", "caller": "0x7ff79bdadb8b", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001838" } ], "repeated": 0, "id": 8536 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "5220", "caller": "0x7ff79bdadb8b", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 8537 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "5220", "caller": "0x7ff79bdadb8b", "parentcaller": "0x7ff79bc79a4f", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "Handle", "value": "0x00001af0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 8538 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "5220", "caller": "0x7ff79bdadb8b", "parentcaller": "0x7ff79bc79a4f", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00001af0" }, { "name": "SubKey", "value": "{528c102f-0000-0000-0000-300300000000}\\" }, { "name": "Handle", "value": "0x00001838" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\" } ], "repeated": 0, "id": 8539 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "5220", "caller": "0x7ff79bdadb8b", "parentcaller": "0x7ff79bc79a4f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 8540 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "5220", "caller": "0x7ff79bdadb8b", "parentcaller": "0x7ff79bc79a4f", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001838" }, { "name": "ValueName", "value": "Generation" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation" } ], "repeated": 0, "id": 8541 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "5220", "caller": "0x7ff79bdadb8b", "parentcaller": "0x7ff79bc79a4f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001838" } ], "repeated": 0, "id": 8542 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "5220", "caller": "0x7ff79bdadb8b", "parentcaller": "0x7ff79bc79a4f", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001838" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8543 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "5220", "caller": "0x7ff79bdadb8b", "parentcaller": "0x7ff79bc79a4f", "category": "filesystem", "api": "NtQueryInformationFile", "status": false, "return": "0xffffffffc000000d", "pretty_return": "INVALID_PARAMETER", "arguments": [ { "name": "FileHandle", "value": "0x00001838" }, { "name": "HandleName", "value": "C:\\" }, { "name": "FileInformationClass", "value": "55", "pretty_value": "FileReplaceCompletionInformation" }, { "name": "FileInformation", "value": "" } ], "repeated": 0, "id": 8544 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "5220", "caller": "0x7ff79bdadb8b", "parentcaller": "0x7ff79bc79a4f", "category": "filesystem", "api": "NtQueryDirectoryFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001838" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x006\\xean:\\xdd\\xac\\xd5\\x01B\\xd8<0\\x04\\xef\\xdc\\x01\\x9d\\xa9\\xd1\\xc9\\xb8\\xee\\xdc\\x01\\x9d\\xa9\\xd1\\xc9\\xb8\\xee\\xdc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x11\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xee\\x05\\x00\\x00\\x00\\x00\\x01\\x00U\\x00s\\x00e\\x00r\\x00s\\x00" }, { "name": "FileName", "value": "C:\\Users" }, { "name": "FileInformationClass", "value": "37", "pretty_value": "FileIdBothDirectoryInformation" } ], "repeated": 0, "id": 8545 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "5220", "caller": "0x7ff79bdadb8b", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001838" } ], "repeated": 0, "id": 8546 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "5220", "caller": "0x7ff79bdadb8b", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 8547 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "5220", "caller": "0x7ff79bdadb8b", "parentcaller": "0x7ff79bc79a4f", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001838" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8548 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "5220", "caller": "0x7ff79bdadb8b", "parentcaller": "0x7ff79bc79a4f", "category": "filesystem", "api": "NtQueryInformationFile", "status": false, "return": "0xffffffffc000000d", "pretty_return": "INVALID_PARAMETER", "arguments": [ { "name": "FileHandle", "value": "0x00001838" }, { "name": "HandleName", "value": "C:\\Users" }, { "name": "FileInformationClass", "value": "55", "pretty_value": "FileReplaceCompletionInformation" }, { "name": "FileInformation", "value": "" } ], "repeated": 0, "id": 8549 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "5220", "caller": "0x7ff79bdadb8b", "parentcaller": "0x7ff79bc79a4f", "category": "filesystem", "api": "NtQueryDirectoryFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001838" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf4a\\xd0\\x9c\\xb6\\xee\\xdc\\x01\\xfa\\xea\\x96k\\x05\\xef\\xdc\\x01\\xfa\\xea\\x96k\\x05\\xef\\xdc\\x01\\xfa\\xea\\x96k\\x05\\xef\\xdc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x004\\x9a\\x01\\x00\\x00\\x00\\x04\\x00a\\x00d\\x00m\\x00i\\x00n\\x00" }, { "name": "FileName", "value": "C:\\Users\\admin" }, { "name": "FileInformationClass", "value": "37", "pretty_value": "FileIdBothDirectoryInformation" } ], "repeated": 0, "id": 8550 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "5220", "caller": "0x7ff79bdadb8b", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001838" } ], "repeated": 0, "id": 8551 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "5220", "caller": "0x7ff79bdadb8b", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8552 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "5220", "caller": "0x7ff79bdadb8b", "parentcaller": "0x7ff79bc79a4f", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001838" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8553 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "5220", "caller": "0x7ff79bdadb8b", "parentcaller": "0x7ff79bc79a4f", "category": "filesystem", "api": "NtQueryInformationFile", "status": false, "return": "0xffffffffc000000d", "pretty_return": "INVALID_PARAMETER", "arguments": [ { "name": "FileHandle", "value": "0x00001838" }, { "name": "HandleName", "value": "C:\\Users\\admin" }, { "name": "FileInformationClass", "value": "55", "pretty_value": "FileReplaceCompletionInformation" }, { "name": "FileInformation", "value": "" } ], "repeated": 0, "id": 8554 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "5220", "caller": "0x7ff79bdadb8b", "parentcaller": "0x7ff79bc79a4f", "category": "filesystem", "api": "NtQueryDirectoryFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001838" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00R \\xd6\\x9c\\xb6\\xee\\xdc\\x01B\\xd8<0\\x04\\xef\\xdc\\x01n\\xbc\\xe2\\x9c\\xb6\\xee\\xdc\\x01n\\xbc\\xe2\\x9c\\xb6\\xee\\xdc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x12\\x00\\x00\\x00\\x0e\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1c\\xa5\\x01\\x00\\x00\\x00\\x03\\x00A\\x00p\\x00p\\x00D\\x00a\\x00t\\x00a\\x00" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData" }, { "name": "FileInformationClass", "value": "37", "pretty_value": "FileIdBothDirectoryInformation" } ], "repeated": 0, "id": 8555 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "5220", "caller": "0x7ff79bdadb8b", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001838" } ], "repeated": 0, "id": 8556 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "5220", "caller": "0x7ff79bdadb8b", "parentcaller": "0x7ff79bc79a4f", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001838" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8557 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "5220", "caller": "0x7ff79bdadb8b", "parentcaller": "0x7ff79bc79a4f", "category": "filesystem", "api": "NtQueryInformationFile", "status": false, "return": "0xffffffffc000000d", "pretty_return": "INVALID_PARAMETER", "arguments": [ { "name": "FileHandle", "value": "0x00001838" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData" }, { "name": "FileInformationClass", "value": "55", "pretty_value": "FileReplaceCompletionInformation" }, { "name": "FileInformation", "value": "" } ], "repeated": 0, "id": 8558 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "5220", "caller": "0x7ff79bdadb8b", "parentcaller": "0x7ff79bc79a4f", "category": "filesystem", "api": "NtQueryDirectoryFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001838" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00R \\xd6\\x9c\\xb6\\xee\\xdc\\x01/\\xf7\\xbd:\\x04\\xef\\xdc\\x01F\\xcb\\xa1/\\x00\\xef\\xdc\\x01F\\xcb\\xa1/\\x00\\xef\\xdc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x0e\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xed\\xa5\\x01\\x00\\x00\\x00\\x03\\x00R\\x00o\\x00a\\x00m\\x00i\\x00n\\x00g\\x00" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming" }, { "name": "FileInformationClass", "value": "37", "pretty_value": "FileIdBothDirectoryInformation" } ], "repeated": 0, "id": 8559 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "5220", "caller": "0x7ff79bdadb8b", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001838" } ], "repeated": 0, "id": 8560 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "5220", "caller": "0x7ff79bdadb8b", "parentcaller": "0x7ff79bc79a4f", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001838" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8561 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "5220", "caller": "0x7ff79bdadb8b", "parentcaller": "0x7ff79bc79a4f", "category": "filesystem", "api": "NtQueryInformationFile", "status": false, "return": "0xffffffffc000000d", "pretty_return": "INVALID_PARAMETER", "arguments": [ { "name": "FileHandle", "value": "0x00001838" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming" }, { "name": "FileInformationClass", "value": "55", "pretty_value": "FileReplaceCompletionInformation" }, { "name": "FileInformation", "value": "" } ], "repeated": 0, "id": 8562 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "5220", "caller": "0x7ff79bdadb8b", "parentcaller": "0x7ff79bc79a4f", "category": "filesystem", "api": "NtQueryDirectoryFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001838" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00R \\xd6\\x9c\\xb6\\xee\\xdc\\x01/\\xf7\\xbd:\\x04\\xef\\xdc\\x01\\xd0\\xe6\\x01\\x0c\\xb7\\xee\\xdc\\x01\\xd0\\xe6\\x01\\x0c\\xb7\\xee\\xdc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x12\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00M\\x00I\\x00C\\x00R\\x00O\\x00S\\x00~\\x001\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1a\\xa6\\x01\\x00\\x00\\x00\\x03\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft" }, { "name": "FileInformationClass", "value": "37", "pretty_value": "FileIdBothDirectoryInformation" } ], "repeated": 0, "id": 8563 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "5220", "caller": "0x7ff79bdadb8b", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001838" } ], "repeated": 0, "id": 8564 }, { "timestamp": "2026-05-29 01:05:24,462", "thread_id": "5220", "caller": "0x7ff79bdadb8b", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 8565 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "5220", "caller": "0x7ff79bdadb8b", "parentcaller": "0x7ff79bc79a4f", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001838" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8566 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "5220", "caller": "0x7ff79bdadb8b", "parentcaller": "0x7ff79bc79a4f", "category": "filesystem", "api": "NtQueryInformationFile", "status": false, "return": "0xffffffffc000000d", "pretty_return": "INVALID_PARAMETER", "arguments": [ { "name": "FileHandle", "value": "0x00001838" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft" }, { "name": "FileInformationClass", "value": "55", "pretty_value": "FileReplaceCompletionInformation" }, { "name": "FileInformation", "value": "" } ], "repeated": 0, "id": 8567 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "5220", "caller": "0x7ff79bdadb8b", "parentcaller": "0x7ff79bc79a4f", "category": "filesystem", "api": "NtQueryDirectoryFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001838" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00R \\xd6\\x9c\\xb6\\xee\\xdc\\x01\\x89\\xd4E<\\x04\\xef\\xdc\\x01M\\xd6\\x12\\xc3\\xb7\\xee\\xdc\\x01M\\xd6\\x12\\xc3\\xb7\\xee\\xdc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x0e\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1d\\xa6\\x01\\x00\\x00\\x00\\x03\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows" }, { "name": "FileInformationClass", "value": "37", "pretty_value": "FileIdBothDirectoryInformation" } ], "repeated": 0, "id": 8568 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "5220", "caller": "0x7ff79bdadb8b", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001838" } ], "repeated": 0, "id": 8569 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "5220", "caller": "0x7ff79bdadb8b", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8570 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "5220", "caller": "0x7ff79bdadb8b", "parentcaller": "0x7ff79bc79a4f", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001838" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8571 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "5220", "caller": "0x7ff79bdadb8b", "parentcaller": "0x7ff79bc79a4f", "category": "filesystem", "api": "NtQueryInformationFile", "status": false, "return": "0xffffffffc000000d", "pretty_return": "INVALID_PARAMETER", "arguments": [ { "name": "FileHandle", "value": "0x00001838" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows" }, { "name": "FileInformationClass", "value": "55", "pretty_value": "FileReplaceCompletionInformation" }, { "name": "FileInformation", "value": "" } ], "repeated": 0, "id": 8572 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "5220", "caller": "0x7ff79bdadb8b", "parentcaller": "0x7ff79bc79a4f", "category": "filesystem", "api": "NtQueryDirectoryFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001838" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00R \\xd6\\x9c\\xb6\\xee\\xdc\\x01X\\x14\\xc0Y\\x04\\xef\\xdc\\x01\\xefa\\xed\\xaf\\xb6\\xee\\xdc\\x01\\xefa\\xed\\xaf\\xb6\\xee\\xdc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x11\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00S\\x00T\\x00A\\x00R\\x00T\\x00M\\x00~\\x001\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00#\\xa6\\x01\\x00\\x00\\x00\\x02\\x00S\\x00t\\x00a\\x00r\\x00t\\x00 \\x00M\\x00e\\x00n\\x00u\\x00" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu" }, { "name": "FileInformationClass", "value": "37", "pretty_value": "FileIdBothDirectoryInformation" } ], "repeated": 0, "id": 8573 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "5220", "caller": "0x7ff79bdadb8b", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001838" } ], "repeated": 0, "id": 8574 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "5220", "caller": "0x7ff79bdadb8b", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 8575 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "5220", "caller": "0x7ff79bdadb8b", "parentcaller": "0x7ff79bc79a4f", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001838" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8576 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "5220", "caller": "0x7ff79bdadb8b", "parentcaller": "0x7ff79bc79a4f", "category": "filesystem", "api": "NtQueryInformationFile", "status": false, "return": "0xffffffffc000000d", "pretty_return": "INVALID_PARAMETER", "arguments": [ { "name": "FileHandle", "value": "0x00001838" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu" }, { "name": "FileInformationClass", "value": "55", "pretty_value": "FileReplaceCompletionInformation" }, { "name": "FileInformation", "value": "" } ], "repeated": 0, "id": 8577 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "5220", "caller": "0x7ff79bdadb8b", "parentcaller": "0x7ff79bc79a4f", "category": "filesystem", "api": "NtQueryDirectoryFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001838" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00R \\xd6\\x9c\\xb6\\xee\\xdc\\x01\\xe3\\xb3\\x8eZ\\x04\\xef\\xdc\\x01\\xfe\\x1a10\\x00\\xef\\xdc\\x01\\xfe\\x1a10\\x00\\xef\\xdc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x11\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00$\\xa6\\x01\\x00\\x00\\x00\\x02\\x00P\\x00r\\x00o\\x00g\\x00r\\x00a\\x00m\\x00s\\x00" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs" }, { "name": "FileInformationClass", "value": "37", "pretty_value": "FileIdBothDirectoryInformation" } ], "repeated": 0, "id": 8578 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "5220", "caller": "0x7ff79bdadb8b", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001838" } ], "repeated": 0, "id": 8579 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "5220", "caller": "0x7ff79bdadb8b", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 8580 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "5220", "caller": "0x7ff79bdadb8b", "parentcaller": "0x7ff79bc79a4f", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001838" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8581 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "5220", "caller": "0x7ff79bdadb8b", "parentcaller": "0x7ff79bc79a4f", "category": "filesystem", "api": "NtQueryInformationFile", "status": false, "return": "0xffffffffc000000d", "pretty_return": "INVALID_PARAMETER", "arguments": [ { "name": "FileHandle", "value": "0x00001838" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs" }, { "name": "FileInformationClass", "value": "55", "pretty_value": "FileReplaceCompletionInformation" }, { "name": "FileInformation", "value": "" } ], "repeated": 0, "id": 8582 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "5220", "caller": "0x7ff79bdadb8b", "parentcaller": "0x7ff79bc79a4f", "category": "filesystem", "api": "NtQueryDirectoryFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001838" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00R \\xd6\\x9c\\xb6\\xee\\xdc\\x01\\xcb\\xca\\xd5\\x8a\\x04\\xef\\xdc\\x01\\x9c\\x05\\x96\\x0b\\xe1\\xac\\xd5\\x01\\x0f\\x87\\xdb\\x9c\\xb6\\xee\\xdc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00$\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00W\\x00I\\x00N\\x00D\\x00O\\x00W\\x00~\\x001\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00%\\xa6\\x01\\x00\\x00\\x00\\x02\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00 \\x00P\\x00o\\x00w\\x00e\\x00r\\x00S\\x00h\\x00e\\x00l\\x00l\\x00" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell" }, { "name": "FileInformationClass", "value": "37", "pretty_value": "FileIdBothDirectoryInformation" } ], "repeated": 0, "id": 8583 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "5220", "caller": "0x7ff79bdadb8b", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001838" } ], "repeated": 0, "id": 8584 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "5220", "caller": "0x7ff79bdadb8b", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8585 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "5220", "caller": "0x7ff79bdadb8b", "parentcaller": "0x7ff79bc79a4f", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001838" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8586 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 8587 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "5220", "caller": "0x7ff79bdadb8b", "parentcaller": "0x7ff79bc79a4f", "category": "filesystem", "api": "NtQueryInformationFile", "status": false, "return": "0xffffffffc000000d", "pretty_return": "INVALID_PARAMETER", "arguments": [ { "name": "FileHandle", "value": "0x00001838" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell" }, { "name": "FileInformationClass", "value": "55", "pretty_value": "FileReplaceCompletionInformation" }, { "name": "FileInformation", "value": "" } ], "repeated": 0, "id": 8588 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 8589 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "5220", "caller": "0x7ff79bdadb8b", "parentcaller": "0x7ff79bc79a4f", "category": "filesystem", "api": "NtQueryDirectoryFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001838" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\\\xbd\\xd6\\x9c\\xb6\\xee\\xdc\\x01\\x1f1\\xd9Y\\x05\\xef\\xdc\\x01z\\xe4:{\\xde\\xac\\xd5\\x01\\xbe7\\xc0\\xa1\\xb7\\xee\\xdc\\x01\\xeb\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00 \\x00\\x00\\x00,\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00W\\x00I\\x00N\\x00D\\x00O\\x00W\\x00~\\x001\\x00.\\x00L\\x00N\\x00K\\x00\\x00\\x00E\\xa6\\x01\\x00\\x00\\x00\\x02\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00 \\x00P\\x00o\\x00w\\x00e\\x00r\\x00S\\x00h\\x00e\\x00l\\x00l\\x00.\\x00l\\x00n\\x00k\\x00" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk" }, { "name": "FileInformationClass", "value": "37", "pretty_value": "FileIdBothDirectoryInformation" } ], "repeated": 0, "id": 8590 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4620", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 8591 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4620", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateChange\\PackageList\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateChange\\PackageList\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" } ], "repeated": 0, "id": 8592 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4620", "caller": "0x7fff577b26e8", "parentcaller": "0x7fff577b279b", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xf7 \\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00c\\x00r\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00l\\x00i\\x00e\\x00n\\x00t\\x00.\\x00C\\x00B\\x00S\\x00_\\x001\\x000\\x000\\x000\\x00.\\x001\\x009\\x000\\x005\\x003\\x00" } ], "repeated": 0, "id": 8593 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4620", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 8594 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4620", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001258" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 8595 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4620", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002524" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00001258" }, { "name": "ObjectAttributesName", "value": "S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 8596 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4620", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002524" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 8597 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "5220", "caller": "0x7ff79bc79a83", "parentcaller": "0x7ff79bc7a869", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000100ec" }, { "name": "Message", "value": "0x0000044a" } ], "repeated": 0, "id": 8598 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4620", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002530" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00002524" }, { "name": "ObjectAttributesName", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" } ], "repeated": 0, "id": 8599 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4620", "caller": "0x7fff577b4086", "parentcaller": "0x7fff577b27b6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002524" } ], "repeated": 0, "id": 8600 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4620", "caller": "0x7fff577b40c3", "parentcaller": "0x7fff577b27b6", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002530" }, { "name": "ValueName", "value": "PackageStatus" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\PackageStatus" } ], "repeated": 0, "id": 8601 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4620", "caller": "0x7fff577b40d4", "parentcaller": "0x7fff577b27b6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002530" } ], "repeated": 0, "id": 8602 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4696", "caller": "0x7ff79bc5cb54", "parentcaller": "0x7ff79bc5d357", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "Applications\\powershell.exe" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\Applications\\powershell.exe" } ], "repeated": 0, "id": 8603 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 8604 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4696", "caller": "0x7ff79bc5cb54", "parentcaller": "0x7ff79bc5d357", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "Applications\\powershell.exe" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\Applications\\powershell.exe" } ], "repeated": 0, "id": 8605 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 8606 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4696", "caller": "0x7ff79bc5cb54", "parentcaller": "0x7ff79bc5d357", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" } ], "repeated": 0, "id": 8607 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 8608 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4696", "caller": "0x7ff79bc91360", "parentcaller": "0x7ff79bc5d2c3", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8609 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4696", "caller": "0x7ff79bc570bf", "parentcaller": "0x7ff79bc5736c", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\ContentDeliveryManager\\SuggestedAppEvents" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\ContentDeliveryManager\\SuggestedAppEvents" } ], "repeated": 0, "id": 8610 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 8611 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4696", "caller": "0x7ff79bc570bf", "parentcaller": "0x7ff79bc5736c", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\ContentDeliveryManager\\SuggestedAppEvents" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\ContentDeliveryManager\\SuggestedAppEvents" } ], "repeated": 0, "id": 8612 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4696", "caller": "0x7ff79bc91360", "parentcaller": "0x7ff79bc5d2c3", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8613 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 8614 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4696", "caller": "0x7ff79bc91360", "parentcaller": "0x7ff79bc5d2c3", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8615 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 8616 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4696", "caller": "0x7ff79bc7a06e", "parentcaller": "0x7ff79bc78f2b", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 8617 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc78f2b", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "CLSID\\{56AD4C5D-B908-4F85-8FF1-7940C29B3BCF}\\Instance" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\CLSID\\{56AD4C5D-B908-4F85-8FF1-7940C29B3BCF}\\Instance" } ], "repeated": 0, "id": 8618 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc78f2b", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 8619 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc78f2b", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff58be0000", "arguments": [ { "name": "lpLibFileName", "value": "shell32.dll" }, { "name": "dwFlags", "value": "0x00004000" } ], "repeated": 0, "id": 8620 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4636", "caller": "0x7fff58c2c304", "parentcaller": "0x7fff44c012c7", "category": "windows", "api": "SendNotifyMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000100ac" }, { "name": "Message", "value": "0x00000403" } ], "repeated": 0, "id": 8621 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4636", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xf9\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x1c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4636" } ], "repeated": 0, "id": 8622 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc78f2b", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "SHELL32.dll" }, { "name": "ModuleHandle", "value": "0x7fff58be0000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff58c378f0" } ], "repeated": 0, "id": 8623 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4720", "caller": "0x7fff58c2ce12", "parentcaller": "0x7fff581be858", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000100ac" }, { "name": "Message", "value": "0x00000404" } ], "repeated": 0, "id": 8624 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4576", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\x11\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4576" } ], "repeated": 0, "id": 8625 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc78f2b", "category": "synchronization", "api": "NtFindAtom", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "AtomName", "value": "{9F4C2855-9F79-4B39-A8D0-E1D42DE1D5F3} 3" }, { "name": "Atom", "value": "0x00000000" } ], "repeated": 0, "id": 8626 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4576", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000177c" }, { "name": "ValueName", "value": "ZvpebfbsgJvaqbjf.Pyvrag.POF_pj5a1u2gklrjl!Tybony.VevfFreivpr" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\ZvpebfbsgJvaqbjf.Pyvrag.POF_pj5a1u2gklrjl!Tybony.VevfFreivpr" } ], "repeated": 1, "id": 8627 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4576", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\x11\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4576" } ], "repeated": 0, "id": 8628 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8629 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000404" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8630 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8631 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000404" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8632 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8633 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000404" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8634 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8635 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000404" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8636 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8637 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000404" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8638 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8639 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000404" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8640 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8641 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000404" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8642 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8643 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000404" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8644 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8645 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000404" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8646 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4636", "caller": "0x7fff557b4361", "parentcaller": "0x7fff557b3e47", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8647 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4636", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5287472a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0xfffffffc" } ], "repeated": 0, "id": 8648 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4636", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xf9\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x1c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4636" } ], "repeated": 0, "id": 8649 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58085ee4", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002048" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8650 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4620", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 8651 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "5000", "caller": "0x7fff5489080f", "parentcaller": "0x7fff5486709a", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00010128" }, { "name": "Message", "value": "0x00000060" } ], "repeated": 0, "id": 8652 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "9572", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 1, "id": 8653 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "5000", "caller": "0x7fff5489080f", "parentcaller": "0x7fff5486709a", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00010128" }, { "name": "Message", "value": "0x00000060" } ], "repeated": 0, "id": 8654 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "9572", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 2, "id": 8655 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "6160", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x18\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6160" } ], "repeated": 0, "id": 8656 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 8657 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "9572", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 3, "id": 8658 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "9572", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00d%\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "9572" } ], "repeated": 0, "id": 8659 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "12852", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x0042\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "12852" } ], "repeated": 0, "id": 8660 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4696", "caller": "0x7ff79bcbc401", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "Handle", "value": "0x00002464" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 8661 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4696", "caller": "0x7ff79bcbc434", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "ValueName", "value": "IsFeedsAvailable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\IsFeedsAvailable" } ], "repeated": 0, "id": 8662 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4696", "caller": "0x7ff79bcbc458", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" } ], "repeated": 0, "id": 8663 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 8664 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 8665 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002464" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 8666 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "ValueName", "value": "HeadlinesOnboardingComplete" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\HeadlinesOnboardingComplete" } ], "repeated": 0, "id": 8667 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" } ], "repeated": 0, "id": 8668 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 8669 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 8670 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002464" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 8671 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 8672 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" } ], "repeated": 0, "id": 8673 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4696", "caller": "0x7ff79bcbc401", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "Handle", "value": "0x00002464" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 8674 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4696", "caller": "0x7ff79bcbc434", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "ValueName", "value": "IsFeedsAvailable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\IsFeedsAvailable" } ], "repeated": 0, "id": 8675 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4696", "caller": "0x7ff79bcbc458", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" } ], "repeated": 0, "id": 8676 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 8677 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 8678 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002464" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 8679 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "ValueName", "value": "HeadlinesOnboardingComplete" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\HeadlinesOnboardingComplete" } ], "repeated": 0, "id": 8680 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" } ], "repeated": 0, "id": 8681 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 8682 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 8683 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002464" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 8684 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 8685 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" } ], "repeated": 0, "id": 8686 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4696", "caller": "0x7ff79bcbc401", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "Handle", "value": "0x00002464" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 8687 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4696", "caller": "0x7ff79bcbc434", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "ValueName", "value": "IsFeedsAvailable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\IsFeedsAvailable" } ], "repeated": 0, "id": 8688 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4696", "caller": "0x7ff79bcbc458", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" } ], "repeated": 0, "id": 8689 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 8690 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 8691 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002464" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 8692 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "ValueName", "value": "HeadlinesOnboardingComplete" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\HeadlinesOnboardingComplete" } ], "repeated": 0, "id": 8693 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" } ], "repeated": 0, "id": 8694 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 8695 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 8696 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002464" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 8697 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 8698 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" } ], "repeated": 0, "id": 8699 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4696", "caller": "0x7ff79bcbc401", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "Handle", "value": "0x00002464" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 8700 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4696", "caller": "0x7ff79bcbc434", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "ValueName", "value": "IsFeedsAvailable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\IsFeedsAvailable" } ], "repeated": 0, "id": 8701 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4696", "caller": "0x7ff79bcbc458", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" } ], "repeated": 0, "id": 8702 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 8703 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 8704 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002464" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 8705 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "ValueName", "value": "HeadlinesOnboardingComplete" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\HeadlinesOnboardingComplete" } ], "repeated": 0, "id": 8706 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" } ], "repeated": 0, "id": 8707 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 8708 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 8709 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002504" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 8710 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002504" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 8711 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002504" } ], "repeated": 0, "id": 8712 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 8713 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 8714 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002504" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 8715 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002504" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 8716 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002504" } ], "repeated": 0, "id": 8717 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4696", "caller": "0x7ff79bc557d2", "parentcaller": "0x7ff79bd1630d", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "TaskbarMonitor" }, { "name": "Atom", "value": "0x0000c045" } ], "repeated": 0, "id": 8718 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 8719 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 8720 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002464" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 8721 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002464" }, { "name": "ValueName", "value": "ShellFeedsTaskbarContentUpdateMode" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarContentUpdateMode" } ], "repeated": 0, "id": 8722 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" } ], "repeated": 0, "id": 8723 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4620", "caller": "0x7fff4cbd12d2", "parentcaller": "0x7fff577adf5c", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache" }, { "name": "Handle", "value": "0x00002504" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache" } ], "repeated": 0, "id": 8724 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4620", "caller": "0x7fff4cbd1a81", "parentcaller": "0x7fff4cbd138a", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002504" }, { "name": "SubKey", "value": "Metadata" }, { "name": "Handle", "value": "0x00002488" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Metadata" } ], "repeated": 0, "id": 8725 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577af579", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002504" }, { "name": "SubKey", "value": "Package\\Index\\PackageFullName\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" }, { "name": "Handle", "value": "0x00002530" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Index\\PackageFullName\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" } ], "repeated": 0, "id": 8726 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4620", "caller": "0x7fff4cbd1732", "parentcaller": "0x7fff577af7dc", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002530" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "22" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Index\\PackageFullName\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\22" } ], "repeated": 0, "id": 8727 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4620", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577af5fd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002530" } ], "repeated": 0, "id": 8728 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4620", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff57815e2d", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 8729 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4620", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff57815e8b", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xc0\\x8d\\xb3\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00" } ], "repeated": 0, "id": 8730 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577aebe9", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002504" }, { "name": "SubKey", "value": "User\\Index\\UserSid\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "Handle", "value": "0x00002530" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\User\\Index\\UserSid\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 8731 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4620", "caller": "0x7fff4cbd1732", "parentcaller": "0x7fff577af7dc", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002530" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "3" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\User\\Index\\UserSid\\S-1-5-21-3968686040-3210279463-847977608-1001\\3" } ], "repeated": 0, "id": 8732 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4620", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577aec6d", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002530" } ], "repeated": 0, "id": 8733 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577ae9b0", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00002504" }, { "name": "SubKey", "value": "PackageExternalLocation\\Index\\UserAndPackage\\3^22" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\PackageExternalLocation\\Index\\UserAndPackage\\3^22" } ], "repeated": 0, "id": 8734 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577ae9b0", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00002504" }, { "name": "SubKey", "value": "PackageExternalLocation\\Index\\UserAndPackage\\0^22" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\PackageExternalLocation\\Index\\UserAndPackage\\0^22" } ], "repeated": 0, "id": 8735 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577af308", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002504" }, { "name": "SubKey", "value": "Package\\Data\\22" }, { "name": "Handle", "value": "0x00002530" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\22" } ], "repeated": 0, "id": 8736 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4620", "caller": "0x7fff4cbd15ac", "parentcaller": "0x7fff4cbd14ff", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002530" }, { "name": "ValueName", "value": "InstalledLocation" }, { "name": "Data", "value": "C:\\Windows\\SystemApps\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\22\\InstalledLocation" } ], "repeated": 0, "id": 8737 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4620", "caller": "0x7fff4cbd15ac", "parentcaller": "0x7fff4cbd14ff", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002530" }, { "name": "ValueName", "value": "MutableLink" }, { "name": "Data", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\22\\MutableLink" } ], "repeated": 0, "id": 8738 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4620", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577aed38", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002530" } ], "repeated": 0, "id": 8739 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4620", "caller": "0x7fff4cbd17f2", "parentcaller": "0x7fff577ae12f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" } ], "repeated": 0, "id": 8740 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4620", "caller": "0x7fff4cbd180b", "parentcaller": "0x7fff577ae12f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002504" } ], "repeated": 0, "id": 8741 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4620", "caller": "0x7fff4cbd12d2", "parentcaller": "0x7fff577adf5c", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache" }, { "name": "Handle", "value": "0x00002504" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache" } ], "repeated": 0, "id": 8742 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4620", "caller": "0x7fff4cbd1a81", "parentcaller": "0x7fff4cbd138a", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002504" }, { "name": "SubKey", "value": "Metadata" }, { "name": "Handle", "value": "0x00002488" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Metadata" } ], "repeated": 0, "id": 8743 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577af579", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002504" }, { "name": "SubKey", "value": "Package\\Index\\PackageFullName\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" }, { "name": "Handle", "value": "0x00002530" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Index\\PackageFullName\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" } ], "repeated": 0, "id": 8744 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4620", "caller": "0x7fff4cbd1732", "parentcaller": "0x7fff577af7dc", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002530" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "22" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Index\\PackageFullName\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\22" } ], "repeated": 0, "id": 8745 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4620", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577af5fd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002530" } ], "repeated": 0, "id": 8746 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4620", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff57815e2d", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 8747 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4620", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff57815e8b", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xc0\\x8b\\xb3\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\\\x00S\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00" } ], "repeated": 0, "id": 8748 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577aebe9", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002504" }, { "name": "SubKey", "value": "User\\Index\\UserSid\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "Handle", "value": "0x00002530" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\User\\Index\\UserSid\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 8749 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4620", "caller": "0x7fff4cbd1732", "parentcaller": "0x7fff577af7dc", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002530" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "3" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\User\\Index\\UserSid\\S-1-5-21-3968686040-3210279463-847977608-1001\\3" } ], "repeated": 0, "id": 8750 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4620", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577aec6d", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002530" } ], "repeated": 0, "id": 8751 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577ae9b0", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00002504" }, { "name": "SubKey", "value": "PackageExternalLocation\\Index\\UserAndPackage\\3^22" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\PackageExternalLocation\\Index\\UserAndPackage\\3^22" } ], "repeated": 0, "id": 8752 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577ae9b0", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00002504" }, { "name": "SubKey", "value": "PackageExternalLocation\\Index\\UserAndPackage\\0^22" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\PackageExternalLocation\\Index\\UserAndPackage\\0^22" } ], "repeated": 0, "id": 8753 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577af308", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002504" }, { "name": "SubKey", "value": "Package\\Data\\22" }, { "name": "Handle", "value": "0x00002530" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\22" } ], "repeated": 0, "id": 8754 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4620", "caller": "0x7fff4cbd15ac", "parentcaller": "0x7fff4cbd14ff", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002530" }, { "name": "ValueName", "value": "MutableLink" }, { "name": "Data", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\22\\MutableLink" } ], "repeated": 0, "id": 8755 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4620", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577aed38", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002530" } ], "repeated": 0, "id": 8756 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4620", "caller": "0x7fff4cbd17f2", "parentcaller": "0x7fff577ae12f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" } ], "repeated": 0, "id": 8757 }, { "timestamp": "2026-05-29 01:05:24,477", "thread_id": "4620", "caller": "0x7fff4cbd180b", "parentcaller": "0x7fff577ae12f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002504" } ], "repeated": 0, "id": 8758 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 8759 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4620", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 8760 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4620", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 8761 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4620", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateChange\\PackageList\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateChange\\PackageList\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" } ], "repeated": 0, "id": 8762 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4620", "caller": "0x7fff577b26e8", "parentcaller": "0x7fff577b279b", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xf7 \\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00c\\x00r\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00l\\x00i\\x00e\\x00n\\x00t\\x00.\\x00C\\x00B\\x00S\\x00_\\x001\\x000\\x000\\x000\\x00.\\x001\\x009\\x000\\x005\\x003\\x00" } ], "repeated": 0, "id": 8763 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4620", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 8764 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4620", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001258" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 8765 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4620", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001af0" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00001258" }, { "name": "ObjectAttributesName", "value": "S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 8766 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4620", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001af0" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 8767 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4620", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002520" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00001af0" }, { "name": "ObjectAttributesName", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" } ], "repeated": 0, "id": 8768 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4620", "caller": "0x7fff577b4086", "parentcaller": "0x7fff577b27b6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 8769 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4620", "caller": "0x7fff577b40c3", "parentcaller": "0x7fff577b27b6", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002520" }, { "name": "ValueName", "value": "PackageStatus" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\PackageStatus" } ], "repeated": 0, "id": 8770 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4620", "caller": "0x7fff577b40d4", "parentcaller": "0x7fff577b27b6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002520" } ], "repeated": 0, "id": 8771 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 8772 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4620", "caller": "0x7fff54fcd469", "parentcaller": "0x7fff54fcd2ee", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 8773 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 8774 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 8775 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4636", "caller": "0x7fff58c2c304", "parentcaller": "0x7fff44c012c7", "category": "windows", "api": "SendNotifyMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000100ac" }, { "name": "Message", "value": "0x00000403" } ], "repeated": 0, "id": 8776 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4636", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xf9\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x1c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4636" } ], "repeated": 0, "id": 8777 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4720", "caller": "0x7fff58c2ce12", "parentcaller": "0x7fff581be858", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000100ac" }, { "name": "Message", "value": "0x00000404" } ], "repeated": 0, "id": 8778 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4576", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\x11\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4576" } ], "repeated": 0, "id": 8779 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8780 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000404" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8781 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4576", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000177c" }, { "name": "ValueName", "value": "ZvpebfbsgJvaqbjf.Pyvrag.POF_pj5a1u2gklrjl!Tybony.EhyrfRatvar" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\ZvpebfbsgJvaqbjf.Pyvrag.POF_pj5a1u2gklrjl!Tybony.EhyrfRatvar" } ], "repeated": 1, "id": 8782 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4696", "caller": "0x7ff79bcbc434", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002520" }, { "name": "ValueName", "value": "IsFeedsAvailable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\IsFeedsAvailable" } ], "repeated": 0, "id": 8783 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4576", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\x11\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4576" } ], "repeated": 0, "id": 8784 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4696", "caller": "0x7ff79bcbc458", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002520" } ], "repeated": 0, "id": 8785 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 8786 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8787 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000404" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8788 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 8789 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 8790 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002520" }, { "name": "ValueName", "value": "HeadlinesOnboardingComplete" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\HeadlinesOnboardingComplete" } ], "repeated": 0, "id": 8791 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002520" } ], "repeated": 0, "id": 8792 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 8793 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8794 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000404" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8795 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 8796 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 8797 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8798 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000404" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8799 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002520" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 8800 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002520" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 8801 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002520" } ], "repeated": 0, "id": 8802 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8803 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000404" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8804 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4696", "caller": "0x7ff79bcbc401", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "Handle", "value": "0x00002520" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 8805 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8806 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000404" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8807 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 8808 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8809 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000404" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8810 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 8811 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002520" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 8812 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8813 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000404" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 8814 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002520" }, { "name": "ValueName", "value": "HeadlinesOnboardingComplete" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\HeadlinesOnboardingComplete" } ], "repeated": 0, "id": 8815 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4636", "caller": "0x7fff557b4361", "parentcaller": "0x7fff557b3e47", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8816 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4636", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5287472a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0xfffffffc" } ], "repeated": 0, "id": 8817 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002520" } ], "repeated": 0, "id": 8818 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4636", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xf9\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x1c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4636" } ], "repeated": 0, "id": 8819 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 8820 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58085ee4", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002048" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8821 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 8822 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 8823 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 8824 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002520" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 8825 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002520" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 8826 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002520" } ], "repeated": 0, "id": 8827 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4696", "caller": "0x7ff79bcbc401", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "Handle", "value": "0x00002520" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 8828 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4696", "caller": "0x7ff79bcbc434", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002520" }, { "name": "ValueName", "value": "IsFeedsAvailable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\IsFeedsAvailable" } ], "repeated": 0, "id": 8829 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4696", "caller": "0x7ff79bcbc458", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002520" } ], "repeated": 0, "id": 8830 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 8831 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 8832 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002520" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 8833 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002520" }, { "name": "ValueName", "value": "HeadlinesOnboardingComplete" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\HeadlinesOnboardingComplete" } ], "repeated": 0, "id": 8834 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002520" } ], "repeated": 0, "id": 8835 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 8836 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 8837 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 8838 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002520" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 8839 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002520" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 8840 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002520" } ], "repeated": 0, "id": 8841 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4696", "caller": "0x7ff79bcbc401", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "Handle", "value": "0x00002520" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 8842 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4696", "caller": "0x7ff79bcbc434", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002520" }, { "name": "ValueName", "value": "IsFeedsAvailable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\IsFeedsAvailable" } ], "repeated": 0, "id": 8843 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4696", "caller": "0x7ff79bcbc458", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002520" } ], "repeated": 0, "id": 8844 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 8845 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 8846 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002520" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 8847 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002520" }, { "name": "ValueName", "value": "HeadlinesOnboardingComplete" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\HeadlinesOnboardingComplete" } ], "repeated": 0, "id": 8848 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002520" } ], "repeated": 0, "id": 8849 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 8850 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 8851 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002520" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 8852 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002520" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 8853 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002520" } ], "repeated": 0, "id": 8854 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 8855 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 8856 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002520" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 8857 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002520" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 8858 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002520" } ], "repeated": 0, "id": 8859 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4696", "caller": "0x7ff79bc557d2", "parentcaller": "0x7ff79bd1630d", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "TaskbarMonitor" }, { "name": "Atom", "value": "0x0000c045" } ], "repeated": 0, "id": 8860 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 8861 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 8862 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002520" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 8863 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002520" }, { "name": "ValueName", "value": "ShellFeedsTaskbarContentUpdateMode" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarContentUpdateMode" } ], "repeated": 0, "id": 8864 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002520" } ], "repeated": 0, "id": 8865 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4696", "caller": "0x7ff79bc9cc23", "parentcaller": "0x7ff79bc70f02", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8866 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4696", "caller": "0x7ff79bc784ba", "parentcaller": "0x7ff79bc7b063", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0003044e" }, { "name": "Message", "value": "0x0000c09a" } ], "repeated": 0, "id": 8867 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4696", "caller": "0x7ff79bc7b0ab", "parentcaller": "0x7ff79bc766f7", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00010110" }, { "name": "Message", "value": "0x0000c0c3" } ], "repeated": 0, "id": 8868 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 8869 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "6160", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x18\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6160" } ], "repeated": 0, "id": 8870 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "6160", "caller": "0x7fff42568962", "parentcaller": "0x7fff42567e38", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001011a" }, { "name": "Message", "value": "0x00000401" } ], "repeated": 0, "id": 8871 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "6160", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x18\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6160" } ], "repeated": 0, "id": 8872 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4620", "caller": "0x7fff4cbd12d2", "parentcaller": "0x7fff577adf5c", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache" }, { "name": "Handle", "value": "0x00002464" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache" } ], "repeated": 0, "id": 8873 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4620", "caller": "0x7fff4cbd1a81", "parentcaller": "0x7fff4cbd138a", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002464" }, { "name": "SubKey", "value": "Metadata" }, { "name": "Handle", "value": "0x00002474" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Metadata" } ], "repeated": 0, "id": 8874 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577af579", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002464" }, { "name": "SubKey", "value": "Package\\Index\\PackageFullName\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" }, { "name": "Handle", "value": "0x000024c4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Index\\PackageFullName\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" } ], "repeated": 0, "id": 8875 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4620", "caller": "0x7fff4cbd1732", "parentcaller": "0x7fff577af7dc", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024c4" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "22" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Index\\PackageFullName\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\22" } ], "repeated": 0, "id": 8876 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4620", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577af5fd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024c4" } ], "repeated": 0, "id": 8877 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4620", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff57815e2d", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 8878 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4620", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff57815e8b", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\x8a\\xb3\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00" } ], "repeated": 0, "id": 8879 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577aebe9", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002464" }, { "name": "SubKey", "value": "User\\Index\\UserSid\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "Handle", "value": "0x000024c4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\User\\Index\\UserSid\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 8880 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4620", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024c4" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "3" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\User\\Index\\UserSid\\S-1-5-21-3968686040-3210279463-847977608-1001\\3" } ], "repeated": 0, "id": 8881 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xe2\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x005\\x18\\xff\\x7f\\x00\\x00(\\xe3\\\\x03\\x00\\x00\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8882 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4620", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577aec6d", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024c4" } ], "repeated": 0, "id": 8883 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577ae9b0", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00002464" }, { "name": "SubKey", "value": "PackageExternalLocation\\Index\\UserAndPackage\\3^22" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\PackageExternalLocation\\Index\\UserAndPackage\\3^22" } ], "repeated": 0, "id": 8884 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000024b8" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 8885 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577ae9b0", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00002464" }, { "name": "SubKey", "value": "PackageExternalLocation\\Index\\UserAndPackage\\0^22" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\PackageExternalLocation\\Index\\UserAndPackage\\0^22" } ], "repeated": 0, "id": 8886 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4696", "caller": "0x7ff79bc8a418", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b8" } ], "repeated": 0, "id": 8887 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577af308", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002464" }, { "name": "SubKey", "value": "Package\\Data\\22" }, { "name": "Handle", "value": "0x000024c4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\22" } ], "repeated": 0, "id": 8888 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc686b4", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 8889 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4620", "caller": "0x7fff4cbd15ac", "parentcaller": "0x7fff4cbd14ff", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024c4" }, { "name": "ValueName", "value": "InstalledLocation" }, { "name": "Data", "value": "C:\\Windows\\SystemApps\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\22\\InstalledLocation" } ], "repeated": 0, "id": 8890 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xe2\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x005\\x18\\xff\\x7f\\x00\\x00(\\xe3\\\\x03\\x00\\x00\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8891 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4620", "caller": "0x7fff4cbd15ac", "parentcaller": "0x7fff4cbd14ff", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024c4" }, { "name": "ValueName", "value": "MutableLink" }, { "name": "Data", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\22\\MutableLink" } ], "repeated": 0, "id": 8892 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4620", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577aed38", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024c4" } ], "repeated": 0, "id": 8893 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000024b8" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 8894 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4620", "caller": "0x7fff4cbd17f2", "parentcaller": "0x7fff577ae12f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002474" } ], "repeated": 0, "id": 8895 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4620", "caller": "0x7fff4cbd180b", "parentcaller": "0x7fff577ae12f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" } ], "repeated": 0, "id": 8896 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4696", "caller": "0x7ff79bc8a418", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b8" } ], "repeated": 0, "id": 8897 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4620", "caller": "0x7fff4cbd12d2", "parentcaller": "0x7fff577adf5c", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache" }, { "name": "Handle", "value": "0x00002464" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache" } ], "repeated": 0, "id": 8898 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4620", "caller": "0x7fff4cbd1a81", "parentcaller": "0x7fff4cbd138a", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002464" }, { "name": "SubKey", "value": "Metadata" }, { "name": "Handle", "value": "0x00002474" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Metadata" } ], "repeated": 0, "id": 8899 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577af579", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002464" }, { "name": "SubKey", "value": "Package\\Index\\PackageFullName\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" }, { "name": "Handle", "value": "0x000024c4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Index\\PackageFullName\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" } ], "repeated": 0, "id": 8900 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4620", "caller": "0x7fff4cbd1732", "parentcaller": "0x7fff577af7dc", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024c4" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "22" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Index\\PackageFullName\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\22" } ], "repeated": 0, "id": 8901 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4620", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577af5fd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024c4" } ], "repeated": 0, "id": 8902 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4620", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff57815e2d", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 8903 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4620", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff57815e8b", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\x8e\\xb3\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00" } ], "repeated": 0, "id": 8904 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc686b4", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 8905 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577aebe9", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002464" }, { "name": "SubKey", "value": "User\\Index\\UserSid\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "Handle", "value": "0x000024c4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\User\\Index\\UserSid\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 8906 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xe2\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x005\\x18\\xff\\x7f\\x00\\x00(\\xe3\\\\x03\\x00\\x00\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8907 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4696", "caller": "0x7ff79bc8a418", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b8" } ], "repeated": 0, "id": 8908 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4620", "caller": "0x7fff4cbd1732", "parentcaller": "0x7fff577af7dc", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024c4" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "3" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\User\\Index\\UserSid\\S-1-5-21-3968686040-3210279463-847977608-1001\\3" } ], "repeated": 0, "id": 8909 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4620", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577aec6d", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024c4" } ], "repeated": 0, "id": 8910 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577ae9b0", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00002464" }, { "name": "SubKey", "value": "PackageExternalLocation\\Index\\UserAndPackage\\3^22" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\PackageExternalLocation\\Index\\UserAndPackage\\3^22" } ], "repeated": 0, "id": 8911 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577ae9b0", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00002464" }, { "name": "SubKey", "value": "PackageExternalLocation\\Index\\UserAndPackage\\0^22" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\PackageExternalLocation\\Index\\UserAndPackage\\0^22" } ], "repeated": 0, "id": 8912 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577af308", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002464" }, { "name": "SubKey", "value": "Package\\Data\\22" }, { "name": "Handle", "value": "0x000024c4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\22" } ], "repeated": 0, "id": 8913 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4620", "caller": "0x7fff4cbd15ac", "parentcaller": "0x7fff4cbd14ff", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024c4" }, { "name": "ValueName", "value": "InstalledLocation" }, { "name": "Data", "value": "C:\\Windows\\SystemApps\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\22\\InstalledLocation" } ], "repeated": 0, "id": 8914 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4620", "caller": "0x7fff4cbd15ac", "parentcaller": "0x7fff4cbd14ff", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024c4" }, { "name": "ValueName", "value": "MutableLink" }, { "name": "Data", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\22\\MutableLink" } ], "repeated": 0, "id": 8915 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4620", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577aed38", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024c4" } ], "repeated": 0, "id": 8916 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4620", "caller": "0x7fff4cbd17f2", "parentcaller": "0x7fff577ae12f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002474" } ], "repeated": 0, "id": 8917 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4620", "caller": "0x7fff4cbd180b", "parentcaller": "0x7fff577ae12f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" } ], "repeated": 0, "id": 8918 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4696", "caller": "0x7ff79bc7a06e", "parentcaller": "0x7ff79bc66f8c", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 8919 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "CLSID\\{56AD4C5D-B908-4F85-8FF1-7940C29B3BCF}\\Instance" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\CLSID\\{56AD4C5D-B908-4F85-8FF1-7940C29B3BCF}\\Instance" } ], "repeated": 0, "id": 8920 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 8921 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff58be0000", "arguments": [ { "name": "lpLibFileName", "value": "shell32.dll" }, { "name": "dwFlags", "value": "0x00004000" } ], "repeated": 0, "id": 8922 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "SHELL32.dll" }, { "name": "ModuleHandle", "value": "0x7fff58be0000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff58c378f0" } ], "repeated": 0, "id": 8923 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "synchronization", "api": "NtFindAtom", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "AtomName", "value": "{9F4C2855-9F79-4B39-A8D0-E1D42DE1D5F3} 3" }, { "name": "Atom", "value": "0x00000000" } ], "repeated": 0, "id": 8924 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc686b4", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 8925 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xe2\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x005\\x18\\xff\\x7f\\x00\\x00(\\xe3\\\\x03\\x00\\x00\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8926 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 8927 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000024b8" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 8928 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4696", "caller": "0x7ff79bc8a418", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b8" } ], "repeated": 0, "id": 8929 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4696", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8930 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4696", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 8931 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4696", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 8932 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 8933 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4696", "caller": "0x7ff79bc7c9d8", "parentcaller": "0x7ff79bc7c92d", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\xf9\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00X\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x01\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4696" } ], "repeated": 0, "id": 8934 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4576", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\x11\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4576" } ], "repeated": 0, "id": 8935 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 8936 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4620", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 8937 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4620", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 8938 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4620", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateChange\\PackageList\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateChange\\PackageList\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" } ], "repeated": 0, "id": 8939 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4620", "caller": "0x7fff577b26e8", "parentcaller": "0x7fff577b279b", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xf7 \\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00c\\x00r\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00l\\x00i\\x00e\\x00n\\x00t\\x00.\\x00C\\x00B\\x00S\\x00_\\x001\\x000\\x000\\x000\\x00.\\x001\\x009\\x000\\x005\\x003\\x00" } ], "repeated": 0, "id": 8940 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4620", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 8941 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4620", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001258" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 8942 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4576", "caller": "0x7ff79bc51f68", "parentcaller": "0x7ff79bc90020", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000100c4" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 8943 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4620", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002520" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00001258" }, { "name": "ObjectAttributesName", "value": "S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 8944 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4620", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002520" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 8945 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4620", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000024b8" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00002520" }, { "name": "ObjectAttributesName", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" } ], "repeated": 0, "id": 8946 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4620", "caller": "0x7fff577b4086", "parentcaller": "0x7fff577b27b6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002520" } ], "repeated": 0, "id": 8947 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4620", "caller": "0x7fff577b40c3", "parentcaller": "0x7fff577b27b6", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000024b8" }, { "name": "ValueName", "value": "PackageStatus" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\PackageStatus" } ], "repeated": 0, "id": 8948 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4576", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\x11\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4576" } ], "repeated": 0, "id": 8949 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4620", "caller": "0x7fff577b40d4", "parentcaller": "0x7fff577b27b6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b8" } ], "repeated": 0, "id": 8950 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 8951 }, { "timestamp": "2026-05-29 01:05:24,493", "thread_id": "4620", "caller": "0x7fff44bc5d4a", "parentcaller": "0x7fff44bc618f", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "DBCE7E40-7345-439D-B12C-114A11819A09" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "130A2F65-2BE7-4309-9A58-A9052FF2B61C" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 8952 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff4cbd12d2", "parentcaller": "0x7fff577adc16", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache" }, { "name": "Handle", "value": "0x00002464" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache" } ], "repeated": 0, "id": 8953 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff4cbd1a81", "parentcaller": "0x7fff4cbd138a", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002464" }, { "name": "SubKey", "value": "Metadata" }, { "name": "Handle", "value": "0x00002474" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Metadata" } ], "repeated": 0, "id": 8954 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577af579", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002464" }, { "name": "SubKey", "value": "Package\\Index\\PackageFullName\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" }, { "name": "Handle", "value": "0x000024c4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Index\\PackageFullName\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" } ], "repeated": 0, "id": 8955 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff4cbd1732", "parentcaller": "0x7fff577af7dc", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024c4" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "22" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Index\\PackageFullName\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\22" } ], "repeated": 0, "id": 8956 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577af5fd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024c4" } ], "repeated": 0, "id": 8957 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577af308", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002464" }, { "name": "SubKey", "value": "Package\\Data\\22" }, { "name": "Handle", "value": "0x000024c4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\22" } ], "repeated": 0, "id": 8958 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff4cbd16ad", "parentcaller": "0x7fff5781d320", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024c4" }, { "name": "ValueName", "value": "PackageOrigin" }, { "name": "Data", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\22\\PackageOrigin" } ], "repeated": 0, "id": 8959 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577aed38", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024c4" } ], "repeated": 0, "id": 8960 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff4cbd17f2", "parentcaller": "0x7fff577adcce", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002474" } ], "repeated": 0, "id": 8961 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff4cbd180b", "parentcaller": "0x7fff577adcce", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002464" } ], "repeated": 1, "id": 8962 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff59f867b9", "parentcaller": "0x7fff5781ad43", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002474" } ], "repeated": 0, "id": 8963 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff4cbd12d2", "parentcaller": "0x7fff577adf5c", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache" }, { "name": "Handle", "value": "0x00001190" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache" } ], "repeated": 0, "id": 8964 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff4cbd1a81", "parentcaller": "0x7fff4cbd138a", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00001190" }, { "name": "SubKey", "value": "Metadata" }, { "name": "Handle", "value": "0x00001e68" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Metadata" } ], "repeated": 0, "id": 8965 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577af579", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00001190" }, { "name": "SubKey", "value": "Package\\Index\\PackageFullName\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" }, { "name": "Handle", "value": "0x00002474" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Index\\PackageFullName\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" } ], "repeated": 0, "id": 8966 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff4cbd1732", "parentcaller": "0x7fff577af7dc", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002474" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "22" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Index\\PackageFullName\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\22" } ], "repeated": 0, "id": 8967 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577af5fd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002474" } ], "repeated": 0, "id": 8968 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff57815e2d", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 8969 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff57815e8b", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "@\\x84\\xb3\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00" } ], "repeated": 0, "id": 8970 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577aebe9", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00001190" }, { "name": "SubKey", "value": "User\\Index\\UserSid\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "Handle", "value": "0x00002474" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\User\\Index\\UserSid\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 8971 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff4cbd1732", "parentcaller": "0x7fff577af7dc", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002474" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "3" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\User\\Index\\UserSid\\S-1-5-21-3968686040-3210279463-847977608-1001\\3" } ], "repeated": 0, "id": 8972 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577aec6d", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002474" } ], "repeated": 0, "id": 8973 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577ae9b0", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00001190" }, { "name": "SubKey", "value": "PackageExternalLocation\\Index\\UserAndPackage\\3^22" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\PackageExternalLocation\\Index\\UserAndPackage\\3^22" } ], "repeated": 0, "id": 8974 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577ae9b0", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00001190" }, { "name": "SubKey", "value": "PackageExternalLocation\\Index\\UserAndPackage\\0^22" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\PackageExternalLocation\\Index\\UserAndPackage\\0^22" } ], "repeated": 0, "id": 8975 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577af308", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00001190" }, { "name": "SubKey", "value": "Package\\Data\\22" }, { "name": "Handle", "value": "0x00002474" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\22" } ], "repeated": 0, "id": 8976 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff4cbd15ac", "parentcaller": "0x7fff4cbd14ff", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002474" }, { "name": "ValueName", "value": "InstalledLocation" }, { "name": "Data", "value": "C:\\Windows\\SystemApps\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\22\\InstalledLocation" } ], "repeated": 0, "id": 8977 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff4cbd15ac", "parentcaller": "0x7fff4cbd14ff", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002474" }, { "name": "ValueName", "value": "MutableLink" }, { "name": "Data", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\22\\MutableLink" } ], "repeated": 0, "id": 8978 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577aed38", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002474" } ], "repeated": 0, "id": 8979 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff4cbd17f2", "parentcaller": "0x7fff577ae12f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001e68" } ], "repeated": 0, "id": 8980 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff4cbd180b", "parentcaller": "0x7fff577ae12f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001190" } ], "repeated": 0, "id": 8981 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff4cbd12d2", "parentcaller": "0x7fff4ce4f3d5", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache" }, { "name": "Handle", "value": "0x0000248c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache" } ], "repeated": 0, "id": 8982 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff4cbd1a81", "parentcaller": "0x7fff4cbd138a", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000248c" }, { "name": "SubKey", "value": "Metadata" }, { "name": "Handle", "value": "0x00001190" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Metadata" } ], "repeated": 0, "id": 8983 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff4ce6726d", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000248c" }, { "name": "SubKey", "value": "Package\\Index\\PackageFullName\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" }, { "name": "Handle", "value": "0x00001e68" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Index\\PackageFullName\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" } ], "repeated": 0, "id": 8984 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff4cbd1732", "parentcaller": "0x7fff4ce672d1", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001e68" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "22" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Index\\PackageFullName\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\22" } ], "repeated": 0, "id": 8985 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff4ce67302", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001e68" } ], "repeated": 0, "id": 8986 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff4ce66f0d", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000248c" }, { "name": "SubKey", "value": "Package\\Data\\22" }, { "name": "Handle", "value": "0x00001e68" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\22" } ], "repeated": 0, "id": 8987 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff4cbd16ad", "parentcaller": "0x7fff4ce7d91c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001e68" }, { "name": "ValueName", "value": "Flags" }, { "name": "Data", "value": "8913992" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\22\\Flags" } ], "repeated": 0, "id": 8988 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff4cbd15ac", "parentcaller": "0x7fff4cbd14ff", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001e68" }, { "name": "ValueName", "value": "InstalledLocation" }, { "name": "Data", "value": "C:\\Windows\\SystemApps\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\22\\InstalledLocation" } ], "repeated": 0, "id": 8989 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff4ce66913", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001e68" } ], "repeated": 0, "id": 8990 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff4cbd17f2", "parentcaller": "0x7fff4ce4f481", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001190" } ], "repeated": 0, "id": 8991 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff4cbd180b", "parentcaller": "0x7fff4ce4f481", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000248c" } ], "repeated": 0, "id": 8992 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff59f667b5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xee \\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\xf05\\xf0L\\xff\\x7f\\x00\\x00\\x86\\xde\\x80W\\xff\\x7f\\x00\\x00\t\\x00\\x00\\x00^t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xee \\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8993 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff59f667ec", "parentcaller": "0x7fff577b5140", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000248c" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 8994 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff57562450", "parentcaller": "0x7fff4ce5d33f", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x0000248c" }, { "name": "SubKey", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppContainer\\Storage\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\\ResourcesConfig" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppContainer\\Storage\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\\ResourcesConfig" } ], "repeated": 0, "id": 8995 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff57562486", "parentcaller": "0x7fff4ce5d33f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000248c" } ], "repeated": 0, "id": 8996 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff5781026b", "parentcaller": "0x7fff4ce46110", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000248c" } ], "repeated": 0, "id": 8997 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff4ce461a3", "parentcaller": "0x7fff4ce46123", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 8998 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff4ce461ff", "parentcaller": "0x7fff4ce46123", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x10U\\xb3\\x0c\\x00\\x00\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x008U\\xb3\\x0c\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00XU\\xb3\\x0c\\x00\\x00\\x00\\x00T\\x00S\\x00A\\x00:\\x00/\\x00/\\x00P\\x00r\\x00o\\x00c\\x00U\\x00n\\x00i\\x00q\\x00u\\x00e\\x00W\\x00\\x00\\x00\\x00\\x00\\x00\\x00%\\xf1\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8999 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff577d6785", "parentcaller": "0x7fff4ce46131", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000248c" } ], "repeated": 0, "id": 9000 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff5855dd9d", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000248c" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000430" }, { "name": "ObjectAttributesName", "value": "Windows.UI.Core.CoreWindow" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Core.CoreWindow" } ], "repeated": 0, "id": 9001 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff5855ddf7", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000248c" }, { "name": "KeyInformation", "value": "N\\xffc1\\xffec\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x004\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00U\\x00I\\x00.\\x00C\\x00o\\x00r\\x00e\\x00.\\x00C\\x00o\\x00r\\x00e\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00\\x02\\x00\\x00\\x00\\xfff0\\x0c%\\x01\\x00\\x00\\x00\\x00\\x02\\x00\\x19\\x00\\x00\\x00\\x00\\x00k\\xffb8\\xfff7Y\\xffff\\x7f\\x00\\x00\\x01\\x00\\x19\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xffa3\\xff89\\x0b\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x15\\x01\\x00\\x00\\x00\\x00\\xff99\\xffe6 \\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff8a%\\x01\\x00\\x00\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\xffc4\\x02%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff0\\x0c%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0EzX\\xffff\\x7f\\x00\\x00(\"y\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xffe7 \\x03\\x00\\x00\\x00\\x00\\xff87\\xff9dNX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xffa0\\xffe9\\x08\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"y\\x0c\\x00\\x00\\x00\\x00`\\xffa0\\xffe9\\x08\\x00\\x00\\x00\\x00\\xffb0\\xff8b\\xffb3\\x0c\\x00\\x00\\x00\\x00\\xffc7\\xffb3\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\xfff6sNX\\xffff\\x7f\\x00\\x00\\xff90\\xffc9\\xffb3\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffb0\\xff8b\\xffb3\\x0c\\x00\\x00\\x00\\x00\\xffd0`\\xffb3\\x0c\\x00\\x00\\x00\\x00\\xffd0`\\xffb3\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xffa0\\xffe9\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x006\\xff8cYX\\xffff\\x7f\\x00\\x00\\x00\\xffd9y\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xffe8 \\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xffe8 \\x03\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 9002 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000248c" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Core.CoreWindow\\ActivationType" } ], "repeated": 0, "id": 9003 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000248c" }, { "name": "ValueName", "value": "Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Core.CoreWindow\\Server" } ], "repeated": 0, "id": 9004 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff585700bb", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000248c" }, { "name": "ValueName", "value": "DllPath" }, { "name": "Data", "value": "C:\\Windows\\System32\\Windows.UI.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Core.CoreWindow\\DllPath" } ], "repeated": 0, "id": 9005 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000248c" }, { "name": "ValueName", "value": "Threading" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Core.CoreWindow\\Threading" } ], "repeated": 0, "id": 9006 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000248c" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Core.CoreWindow\\TrustLevel" } ], "repeated": 0, "id": 9007 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff584bc0fc", "parentcaller": "0x7fff58554170", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x0000248c" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Core.CoreWindow\\CustomAttributes" } ], "repeated": 0, "id": 9008 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000248c" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Core.CoreWindow\\RemoteServer" } ], "repeated": 0, "id": 9009 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000248c" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Core.CoreWindow\\ActivateAsUser" } ], "repeated": 0, "id": 9010 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000248c" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Core.CoreWindow\\ActivateInSharedBroker" } ], "repeated": 0, "id": 9011 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000248c" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Core.CoreWindow\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 9012 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58562222", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000248c" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Core.CoreWindow\\Permissions" } ], "repeated": 0, "id": 9013 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000248c" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Core.CoreWindow\\ActivateOnHostFlags" } ], "repeated": 0, "id": 9014 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff58557226", "parentcaller": "0x7fff5855ca23", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000248c" } ], "repeated": 0, "id": 9015 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 9016 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 9017 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Mrt\\_Merged" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Mrt\\_Merged" } ], "repeated": 0, "id": 9018 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff577d1e5c", "parentcaller": "0x7fff4ce52bda", "category": "filesystem", "api": "NtQueryFullAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\SystemApps\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\\resources.pri" } ], "repeated": 0, "id": 9019 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000248c" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\SystemApps\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\\resources.pri" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9020 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff57814097", "parentcaller": "0x7fff4ce4ec60", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000248c" }, { "name": "HandleName", "value": "C:\\Windows\\SystemApps\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\\resources.pri" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00 *\\x00\\x00\\x00\\x00\\x00\\xb0\\x1f*\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 9021 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff577cf0e1", "parentcaller": "0x7fff577cef40", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001190" }, { "name": "DesiredAccess", "value": "0x000f0005", "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x0000248c" }, { "name": "FileName", "value": "C:\\Windows\\SystemApps\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\\resources.pri" } ], "repeated": 0, "id": 9022 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001190" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x13260000" }, { "name": "SectionOffset", "value": "0x0320ebf0" }, { "name": "ViewSize", "value": "0x002a2000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9023 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff577d6785", "parentcaller": "0x7fff4ce4ed05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001190" } ], "repeated": 0, "id": 9024 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff577d6785", "parentcaller": "0x7fff4ce4ed17", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000248c" } ], "repeated": 0, "id": 9025 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff59f667b5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "p\\xe7 \\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x80U\\xc3\\x08\\x00\\x00\\x00\\x00\\x86\\xde\\x80W\\xff\\x7f\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\xe7 \\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 9026 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff59f667ec", "parentcaller": "0x7fff577b5140", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000248c" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 9027 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff57562450", "parentcaller": "0x7fff4ce5d33f", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x0000248c" }, { "name": "SubKey", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppContainer\\Storage\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\\ResourcesConfig" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppContainer\\Storage\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\\ResourcesConfig" } ], "repeated": 0, "id": 9028 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff57562486", "parentcaller": "0x7fff4ce5d33f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000248c" } ], "repeated": 0, "id": 9029 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 9030 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff54fcd469", "parentcaller": "0x7fff54fcd2ee", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 9031 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 3, "id": 9032 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff4ce4e4df", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x13260000" }, { "name": "RegionSize", "value": "0x002a2000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 9033 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 9034 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4636", "caller": "0x7fff58c2c304", "parentcaller": "0x7fff44c012c7", "category": "windows", "api": "SendNotifyMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000100ac" }, { "name": "Message", "value": "0x00000403" } ], "repeated": 0, "id": 9035 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4720", "caller": "0x7fff58c2ce12", "parentcaller": "0x7fff581be858", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000100ac" }, { "name": "Message", "value": "0x00000404" } ], "repeated": 0, "id": 9036 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4576", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\x11\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4576" } ], "repeated": 0, "id": 9037 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4576", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000177c" }, { "name": "ValueName", "value": "ZvpebfbsgJvaqbjf.Pyvrag.POF_pj5a1u2gklrjl!FperraPyvccvat" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\ZvpebfbsgJvaqbjf.Pyvrag.POF_pj5a1u2gklrjl!FperraPyvccvat" } ], "repeated": 1, "id": 9038 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4576", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\x11\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4576" } ], "repeated": 0, "id": 9039 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc68e6a", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 2, "id": 9040 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9041 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000404" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 9042 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xdf\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x005\\x18\\xff\\x7f\\x00\\x00X\\xe0\\\\x03\\x00\\x00\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 9043 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000248c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 9044 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4696", "caller": "0x7ff79bc8a418", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000248c" } ], "repeated": 0, "id": 9045 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9046 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000404" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 9047 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9048 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000404" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 9049 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9050 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000404" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 9051 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9052 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000404" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 9053 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9054 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000404" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 9055 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9056 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000404" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 9057 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4504", "caller": "0x7ff79bcd3bb4", "parentcaller": "0x00000000", "category": "registry", "api": "RegNotifyChangeKeyValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\" }, { "name": "NotifyFilter", "value": "0x10000005" }, { "name": "WatchSubtree", "value": "1" }, { "name": "Asynchronous", "value": "1" } ], "repeated": 0, "id": 9058 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4504", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd15e8a", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 2, "id": 9059 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9060 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000404" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 9061 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4504", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd15e8a", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 1, "id": 9062 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9063 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000404" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 9064 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4504", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd15e8a", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000248c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search" } ], "repeated": 0, "id": 9065 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4636", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5287472a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0xfffffffc" } ], "repeated": 0, "id": 9066 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4636", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xf9\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x1c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4636" } ], "repeated": 0, "id": 9067 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58085ee4", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002048" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9068 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4504", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd15e8a", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000248c" }, { "name": "ValueName", "value": "BackgroundAppGlobalToggle" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\BackgroundAppGlobalToggle" } ], "repeated": 0, "id": 9069 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4504", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd15e8a", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000248c" } ], "repeated": 0, "id": 9070 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4344", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd15e8a", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002520" } ], "repeated": 0, "id": 9071 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 9072 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff4cbd12d2", "parentcaller": "0x7fff577adf5c", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache" }, { "name": "Handle", "value": "0x00002490" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache" } ], "repeated": 0, "id": 9073 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff4cbd1a81", "parentcaller": "0x7fff4cbd138a", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002490" }, { "name": "SubKey", "value": "Metadata" }, { "name": "Handle", "value": "0x0000249c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Metadata" } ], "repeated": 0, "id": 9074 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577af579", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002490" }, { "name": "SubKey", "value": "Package\\Index\\PackageFullName\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" }, { "name": "Handle", "value": "0x000024a4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Index\\PackageFullName\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" } ], "repeated": 0, "id": 9075 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff4cbd1732", "parentcaller": "0x7fff577af7dc", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024a4" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "22" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Index\\PackageFullName\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\22" } ], "repeated": 0, "id": 9076 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577af5fd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024a4" } ], "repeated": 0, "id": 9077 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff57815e2d", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 9078 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff57815e8b", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\x88\\xb3\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00" } ], "repeated": 0, "id": 9079 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577aebe9", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002490" }, { "name": "SubKey", "value": "User\\Index\\UserSid\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "Handle", "value": "0x000024a4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\User\\Index\\UserSid\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 9080 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff4cbd1732", "parentcaller": "0x7fff577af7dc", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024a4" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "3" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\User\\Index\\UserSid\\S-1-5-21-3968686040-3210279463-847977608-1001\\3" } ], "repeated": 0, "id": 9081 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577aec6d", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024a4" } ], "repeated": 0, "id": 9082 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577ae9b0", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00002490" }, { "name": "SubKey", "value": "PackageExternalLocation\\Index\\UserAndPackage\\3^22" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\PackageExternalLocation\\Index\\UserAndPackage\\3^22" } ], "repeated": 0, "id": 9083 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577ae9b0", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00002490" }, { "name": "SubKey", "value": "PackageExternalLocation\\Index\\UserAndPackage\\0^22" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\PackageExternalLocation\\Index\\UserAndPackage\\0^22" } ], "repeated": 0, "id": 9084 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577af308", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002490" }, { "name": "SubKey", "value": "Package\\Data\\22" }, { "name": "Handle", "value": "0x00002520" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\22" } ], "repeated": 0, "id": 9085 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff4cbd15ac", "parentcaller": "0x7fff4cbd14ff", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002520" }, { "name": "ValueName", "value": "InstalledLocation" }, { "name": "Data", "value": "C:\\Windows\\SystemApps\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\22\\InstalledLocation" } ], "repeated": 0, "id": 9086 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff4cbd15ac", "parentcaller": "0x7fff4cbd14ff", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002520" }, { "name": "ValueName", "value": "MutableLink" }, { "name": "Data", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\22\\MutableLink" } ], "repeated": 0, "id": 9087 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577aed38", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002520" } ], "repeated": 0, "id": 9088 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff4cbd17f2", "parentcaller": "0x7fff577ae12f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000249c" } ], "repeated": 0, "id": 9089 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff4cbd180b", "parentcaller": "0x7fff577ae12f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002490" } ], "repeated": 0, "id": 9090 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff4cbd12d2", "parentcaller": "0x7fff577adf5c", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache" }, { "name": "Handle", "value": "0x00002490" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache" } ], "repeated": 0, "id": 9091 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff4cbd1a81", "parentcaller": "0x7fff4cbd138a", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002490" }, { "name": "SubKey", "value": "Metadata" }, { "name": "Handle", "value": "0x0000249c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Metadata" } ], "repeated": 0, "id": 9092 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577af579", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002490" }, { "name": "SubKey", "value": "Package\\Index\\PackageFullName\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" }, { "name": "Handle", "value": "0x00002520" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Index\\PackageFullName\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" } ], "repeated": 0, "id": 9093 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff4cbd1732", "parentcaller": "0x7fff577af7dc", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002520" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "22" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Index\\PackageFullName\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\22" } ], "repeated": 0, "id": 9094 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577af5fd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002520" } ], "repeated": 0, "id": 9095 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff57815e2d", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 9096 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff57815e8b", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\x87\\xb3\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00" } ], "repeated": 0, "id": 9097 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577aebe9", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002490" }, { "name": "SubKey", "value": "User\\Index\\UserSid\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "Handle", "value": "0x00002520" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\User\\Index\\UserSid\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 9098 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff4cbd1732", "parentcaller": "0x7fff577af7dc", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002520" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "3" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\User\\Index\\UserSid\\S-1-5-21-3968686040-3210279463-847977608-1001\\3" } ], "repeated": 0, "id": 9099 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577aec6d", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002520" } ], "repeated": 0, "id": 9100 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577ae9b0", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00002490" }, { "name": "SubKey", "value": "PackageExternalLocation\\Index\\UserAndPackage\\3^22" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\PackageExternalLocation\\Index\\UserAndPackage\\3^22" } ], "repeated": 0, "id": 9101 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577ae9b0", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00002490" }, { "name": "SubKey", "value": "PackageExternalLocation\\Index\\UserAndPackage\\0^22" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\PackageExternalLocation\\Index\\UserAndPackage\\0^22" } ], "repeated": 0, "id": 9102 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577af308", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002490" }, { "name": "SubKey", "value": "Package\\Data\\22" }, { "name": "Handle", "value": "0x00002520" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\22" } ], "repeated": 0, "id": 9103 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff4cbd15ac", "parentcaller": "0x7fff4cbd14ff", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002520" }, { "name": "ValueName", "value": "InstalledLocation" }, { "name": "Data", "value": "C:\\Windows\\SystemApps\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\22\\InstalledLocation" } ], "repeated": 0, "id": 9104 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff4cbd15ac", "parentcaller": "0x7fff4cbd14ff", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002520" }, { "name": "ValueName", "value": "MutableLink" }, { "name": "Data", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\22\\MutableLink" } ], "repeated": 0, "id": 9105 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577aed38", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002520" } ], "repeated": 0, "id": 9106 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff4cbd17f2", "parentcaller": "0x7fff577ae12f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000249c" } ], "repeated": 0, "id": 9107 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff4cbd180b", "parentcaller": "0x7fff577ae12f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002490" } ], "repeated": 0, "id": 9108 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 9109 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 9110 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 9111 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateChange\\PackageList\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateChange\\PackageList\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" } ], "repeated": 0, "id": 9112 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff577b26e8", "parentcaller": "0x7fff577b279b", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xf7 \\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00c\\x00r\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00l\\x00i\\x00e\\x00n\\x00t\\x00.\\x00C\\x00B\\x00S\\x00_\\x001\\x000\\x000\\x000\\x00.\\x001\\x009\\x000\\x005\\x003\\x00" } ], "repeated": 0, "id": 9113 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 9114 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001258" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 9115 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002524" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00001258" }, { "name": "ObjectAttributesName", "value": "S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 9116 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002524" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 9117 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002414" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00002524" }, { "name": "ObjectAttributesName", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" } ], "repeated": 0, "id": 9118 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff577b4086", "parentcaller": "0x7fff577b27b6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002524" } ], "repeated": 0, "id": 9119 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff577b40c3", "parentcaller": "0x7fff577b27b6", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002414" }, { "name": "ValueName", "value": "PackageStatus" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\PackageStatus" } ], "repeated": 0, "id": 9120 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff577b40d4", "parentcaller": "0x7fff577b27b6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002414" } ], "repeated": 0, "id": 9121 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 9122 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff54fcd469", "parentcaller": "0x7fff54fcd2ee", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 9123 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 9124 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 9125 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4636", "caller": "0x7fff58c2c304", "parentcaller": "0x7fff44c012c7", "category": "windows", "api": "SendNotifyMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000100ac" }, { "name": "Message", "value": "0x00000403" } ], "repeated": 0, "id": 9126 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4636", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xf9\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x1c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4636" } ], "repeated": 0, "id": 9127 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4720", "caller": "0x7fff58c2ce12", "parentcaller": "0x7fff581be858", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000100ac" }, { "name": "Message", "value": "0x00000404" } ], "repeated": 0, "id": 9128 }, { "timestamp": "2026-05-29 01:05:24,508", "thread_id": "4576", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\x11\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4576" } ], "repeated": 0, "id": 9129 }, { "timestamp": "2026-05-29 01:05:24,524", "thread_id": "4576", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000177c" }, { "name": "ValueName", "value": "ZvpebfbsgJvaqbjf.Pyvrag.POF_pj5a1u2gklrjl!JroRkcrevraprUbfg" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\ZvpebfbsgJvaqbjf.Pyvrag.POF_pj5a1u2gklrjl!JroRkcrevraprUbfg" } ], "repeated": 1, "id": 9130 }, { "timestamp": "2026-05-29 01:05:24,524", "thread_id": "4576", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\x11\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4576" } ], "repeated": 0, "id": 9131 }, { "timestamp": "2026-05-29 01:05:24,524", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9132 }, { "timestamp": "2026-05-29 01:05:24,524", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000404" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 9133 }, { "timestamp": "2026-05-29 01:05:24,524", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9134 }, { "timestamp": "2026-05-29 01:05:24,524", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000404" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 9135 }, { "timestamp": "2026-05-29 01:05:24,524", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9136 }, { "timestamp": "2026-05-29 01:05:24,524", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000404" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 9137 }, { "timestamp": "2026-05-29 01:05:24,524", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9138 }, { "timestamp": "2026-05-29 01:05:24,524", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000404" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 9139 }, { "timestamp": "2026-05-29 01:05:24,524", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9140 }, { "timestamp": "2026-05-29 01:05:24,524", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000404" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 9141 }, { "timestamp": "2026-05-29 01:05:24,524", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9142 }, { "timestamp": "2026-05-29 01:05:24,524", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000404" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 9143 }, { "timestamp": "2026-05-29 01:05:24,524", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9144 }, { "timestamp": "2026-05-29 01:05:24,524", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000404" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 9145 }, { "timestamp": "2026-05-29 01:05:24,524", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9146 }, { "timestamp": "2026-05-29 01:05:24,524", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000404" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 9147 }, { "timestamp": "2026-05-29 01:05:24,524", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9148 }, { "timestamp": "2026-05-29 01:05:24,524", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000404" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 9149 }, { "timestamp": "2026-05-29 01:05:24,524", "thread_id": "4636", "caller": "0x7fff557b4361", "parentcaller": "0x7fff557b3e47", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9150 }, { "timestamp": "2026-05-29 01:05:24,524", "thread_id": "4636", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5287472a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0xfffffffc" } ], "repeated": 0, "id": 9151 }, { "timestamp": "2026-05-29 01:05:24,524", "thread_id": "4636", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xf9\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x1c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4636" } ], "repeated": 0, "id": 9152 }, { "timestamp": "2026-05-29 01:05:24,524", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58085ee4", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002048" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9153 }, { "timestamp": "2026-05-29 01:05:24,524", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 9154 }, { "timestamp": "2026-05-29 01:05:24,524", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 9155 }, { "timestamp": "2026-05-29 01:05:24,524", "thread_id": "4344", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff584fb0ca", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 9156 }, { "timestamp": "2026-05-29 01:05:24,524", "thread_id": "4344", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 9157 }, { "timestamp": "2026-05-29 01:05:24,524", "thread_id": "4344", "caller": "0x7fff584d7b74", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000034a" }, { "name": "SubKey", "value": "CLSID\\{C2F03A33-21F5-47FA-B4BB-156362A2F239}" }, { "name": "Handle", "value": "0x00002492" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{C2F03A33-21F5-47FA-B4BB-156362A2F239}" } ], "repeated": 0, "id": 9158 }, { "timestamp": "2026-05-29 01:05:24,524", "thread_id": "4344", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002492" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{c2f03a33-21f5-47fa-b4bb-156362a2f239}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 9159 }, { "timestamp": "2026-05-29 01:05:24,524", "thread_id": "4344", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002492" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 9160 }, { "timestamp": "2026-05-29 01:05:24,524", "thread_id": "4344", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "0\\xc5\\xee\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\x92$\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xc6\\xee\t\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 9161 }, { "timestamp": "2026-05-29 01:05:24,524", "thread_id": "4344", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{c2f03a33-21f5-47fa-b4bb-156362a2f239}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{c2f03a33-21f5-47fa-b4bb-156362a2f239}\\TreatAs" } ], "repeated": 0, "id": 9162 }, { "timestamp": "2026-05-29 01:05:24,524", "thread_id": "4344", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002492" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 9163 }, { "timestamp": "2026-05-29 01:05:24,524", "thread_id": "4344", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00002492" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c2f03a33-21f5-47fa-b4bb-156362a2f239}\\TreatAs" } ], "repeated": 0, "id": 9164 }, { "timestamp": "2026-05-29 01:05:24,524", "thread_id": "4344", "caller": "0x7fff585622e1", "parentcaller": "0x7fff584d7c1d", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002492" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{c2f03a33-21f5-47fa-b4bb-156362a2f239}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 9165 }, { "timestamp": "2026-05-29 01:05:24,524", "thread_id": "4344", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d81f5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002492" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c2f03a33-21f5-47fa-b4bb-156362a2f239}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 9166 }, { "timestamp": "2026-05-29 01:05:24,524", "thread_id": "4344", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002492" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c2f03a33-21f5-47fa-b4bb-156362a2f239}\\(Default)" } ], "repeated": 0, "id": 9167 }, { "timestamp": "2026-05-29 01:05:24,524", "thread_id": "4344", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002492" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "Immersive Shell" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c2f03a33-21f5-47fa-b4bb-156362a2f239}\\(Default)" } ], "repeated": 0, "id": 9168 }, { "timestamp": "2026-05-29 01:05:24,524", "thread_id": "4344", "caller": "0x7fff584d8485", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00002492" }, { "name": "SubKey", "value": "InprocServer32" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c2f03a33-21f5-47fa-b4bb-156362a2f239}\\InprocServer32" } ], "repeated": 0, "id": 9169 }, { "timestamp": "2026-05-29 01:05:24,524", "thread_id": "4344", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002492" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{c2f03a33-21f5-47fa-b4bb-156362a2f239}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 9170 }, { "timestamp": "2026-05-29 01:05:24,524", "thread_id": "4344", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002492" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 9171 }, { "timestamp": "2026-05-29 01:05:24,524", "thread_id": "4344", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xc0\\xc3\\xee\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\x92$\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\xc4\\xee\t\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 9172 }, { "timestamp": "2026-05-29 01:05:24,524", "thread_id": "4344", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{c2f03a33-21f5-47fa-b4bb-156362a2f239}\\InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{c2f03a33-21f5-47fa-b4bb-156362a2f239}\\InprocHandler32" } ], "repeated": 0, "id": 9173 }, { "timestamp": "2026-05-29 01:05:24,524", "thread_id": "4344", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002492" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 9174 }, { "timestamp": "2026-05-29 01:05:24,524", "thread_id": "4344", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00002492" }, { "name": "ObjectAttributesName", "value": "InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c2f03a33-21f5-47fa-b4bb-156362a2f239}\\InprocHandler32" } ], "repeated": 0, "id": 9175 }, { "timestamp": "2026-05-29 01:05:24,524", "thread_id": "4344", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002492" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{c2f03a33-21f5-47fa-b4bb-156362a2f239}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 9176 }, { "timestamp": "2026-05-29 01:05:24,524", "thread_id": "4344", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002492" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 9177 }, { "timestamp": "2026-05-29 01:05:24,524", "thread_id": "4344", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xc0\\xc3\\xee\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\x92$\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\xc4\\xee\t\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 9178 }, { "timestamp": "2026-05-29 01:05:24,524", "thread_id": "4344", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{c2f03a33-21f5-47fa-b4bb-156362a2f239}\\InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{c2f03a33-21f5-47fa-b4bb-156362a2f239}\\InprocHandler" } ], "repeated": 0, "id": 9179 }, { "timestamp": "2026-05-29 01:05:24,524", "thread_id": "4344", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002492" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 9180 }, { "timestamp": "2026-05-29 01:05:24,524", "thread_id": "4344", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00002492" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c2f03a33-21f5-47fa-b4bb-156362a2f239}\\InprocHandler" } ], "repeated": 0, "id": 9181 }, { "timestamp": "2026-05-29 01:05:24,524", "thread_id": "4344", "caller": "0x7fff584d8010", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002492" } ], "repeated": 0, "id": 9182 }, { "timestamp": "2026-05-29 01:05:24,524", "thread_id": "4344", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xfc\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\\x10\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4344" } ], "repeated": 0, "id": 9183 }, { "timestamp": "2026-05-29 01:05:24,524", "thread_id": "6160", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x18\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6160" } ], "repeated": 0, "id": 9184 }, { "timestamp": "2026-05-29 01:05:24,524", "thread_id": "4720", "caller": "0x7fff57fc2755", "parentcaller": "0x7fff57fc2699", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "-\\x00%\\x00D\\x004\\x00#\\x00!\\x00`\\x00`\\x00`\\x00`\\x00`\\x00!\\x00E\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x000\\x008\\x00$\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00" }, { "name": "Size", "value": "64" }, { "name": "Atom", "value": "0x0000c068" } ], "repeated": 0, "id": 9185 }, { "timestamp": "2026-05-29 01:05:24,524", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002504" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000024b8" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 9186 }, { "timestamp": "2026-05-29 01:05:24,524", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000024b8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9187 }, { "timestamp": "2026-05-29 01:05:24,524", "thread_id": "4720", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff5807d567", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 9188 }, { "timestamp": "2026-05-29 01:05:24,524", "thread_id": "4720", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5807d5a3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b8" } ], "repeated": 0, "id": 9189 }, { "timestamp": "2026-05-29 01:05:24,524", "thread_id": "4720", "caller": "0x7fff58c2ce12", "parentcaller": "0x7fff581be858", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000100ac" }, { "name": "Message", "value": "0x00000404" } ], "repeated": 0, "id": 9190 }, { "timestamp": "2026-05-29 01:05:24,524", "thread_id": "4720", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff58c2c942", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 9191 }, { "timestamp": "2026-05-29 01:05:24,524", "thread_id": "4720", "caller": "0x7fff57fc2755", "parentcaller": "0x7fff57fc2699", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "-\\x00%\\x00D\\x004\\x00#\\x00!\\x00`\\x00`\\x00`\\x00`\\x00`\\x00!\\x00E\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x000\\x008\\x00$\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00" }, { "name": "Size", "value": "64" }, { "name": "Atom", "value": "0x0000c068" } ], "repeated": 0, "id": 9192 }, { "timestamp": "2026-05-29 01:05:24,524", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002504" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002504" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 9193 }, { "timestamp": "2026-05-29 01:05:24,524", "thread_id": "4720", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5809fb6a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002504" } ], "repeated": 0, "id": 9194 }, { "timestamp": "2026-05-29 01:05:24,524", "thread_id": "4720", "caller": "0x7fff57fc2897", "parentcaller": "0x7fff5809fb7b", "category": "synchronization", "api": "NtDeleteAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "Atom", "value": "0x0000c068" } ], "repeated": 0, "id": 9195 }, { "timestamp": "2026-05-29 01:05:24,524", "thread_id": "6252", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 9196 }, { "timestamp": "2026-05-29 01:05:24,524", "thread_id": "6160", "caller": "0x7fff40c74428", "parentcaller": "0x7fff40c73a03", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "F0AE1542-F497-484B-A175-A20DB09144BA" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "8DC24A1A-6314-4769-9D68-179786F4CED6" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 9197 }, { "timestamp": "2026-05-29 01:05:24,524", "thread_id": "6160", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00020072" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 1, "id": 9198 }, { "timestamp": "2026-05-29 01:05:24,524", "thread_id": "6252", "caller": "0x7fff557c9e99", "parentcaller": "0x7fff557c779f", "category": "filesystem", "api": "CreateDirectoryW", "status": false, "return": "0x00000000", "arguments": [ { "name": "DirectoryName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations" } ], "repeated": 0, "id": 9199 }, { "timestamp": "2026-05-29 01:05:24,524", "thread_id": "4620", "caller": "0x7fff4cbd12d2", "parentcaller": "0x7fff577adf5c", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache" }, { "name": "Handle", "value": "0x00002504" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache" } ], "repeated": 0, "id": 9200 }, { "timestamp": "2026-05-29 01:05:24,524", "thread_id": "4620", "caller": "0x7fff4cbd1a81", "parentcaller": "0x7fff4cbd138a", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002504" }, { "name": "SubKey", "value": "Metadata" }, { "name": "Handle", "value": "0x000024b8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Metadata" } ], "repeated": 0, "id": 9201 }, { "timestamp": "2026-05-29 01:05:24,524", "thread_id": "6160", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00020072" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 2, "id": 9202 }, { "timestamp": "2026-05-29 01:05:24,524", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577af579", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002504" }, { "name": "SubKey", "value": "Package\\Index\\PackageFullName\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" }, { "name": "Handle", "value": "0x00001af0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Index\\PackageFullName\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" } ], "repeated": 0, "id": 9203 }, { "timestamp": "2026-05-29 01:05:24,524", "thread_id": "4620", "caller": "0x7fff4cbd1732", "parentcaller": "0x7fff577af7dc", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "22" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Index\\PackageFullName\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\22" } ], "repeated": 0, "id": 9204 }, { "timestamp": "2026-05-29 01:05:24,524", "thread_id": "4620", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577af5fd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 9205 }, { "timestamp": "2026-05-29 01:05:24,524", "thread_id": "4620", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff57815e2d", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 9206 }, { "timestamp": "2026-05-29 01:05:24,524", "thread_id": "4620", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff57815e8b", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xe0^\\xc8\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00 \\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00" } ], "repeated": 0, "id": 9207 }, { "timestamp": "2026-05-29 01:05:24,524", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577aebe9", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002504" }, { "name": "SubKey", "value": "User\\Index\\UserSid\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "Handle", "value": "0x00001af0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\User\\Index\\UserSid\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 9208 }, { "timestamp": "2026-05-29 01:05:24,540", "thread_id": "4620", "caller": "0x7fff4cbd1732", "parentcaller": "0x7fff577af7dc", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "3" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\User\\Index\\UserSid\\S-1-5-21-3968686040-3210279463-847977608-1001\\3" } ], "repeated": 0, "id": 9209 }, { "timestamp": "2026-05-29 01:05:24,540", "thread_id": "4620", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577aec6d", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 9210 }, { "timestamp": "2026-05-29 01:05:24,540", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577ae9b0", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00002504" }, { "name": "SubKey", "value": "PackageExternalLocation\\Index\\UserAndPackage\\3^22" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\PackageExternalLocation\\Index\\UserAndPackage\\3^22" } ], "repeated": 0, "id": 9211 }, { "timestamp": "2026-05-29 01:05:24,540", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9212 }, { "timestamp": "2026-05-29 01:05:24,540", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577ae9b0", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00002504" }, { "name": "SubKey", "value": "PackageExternalLocation\\Index\\UserAndPackage\\0^22" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\PackageExternalLocation\\Index\\UserAndPackage\\0^22" } ], "repeated": 0, "id": 9213 }, { "timestamp": "2026-05-29 01:05:24,540", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 9214 }, { "timestamp": "2026-05-29 01:05:24,540", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577af308", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002504" }, { "name": "SubKey", "value": "Package\\Data\\22" }, { "name": "Handle", "value": "0x00002450" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\22" } ], "repeated": 0, "id": 9215 }, { "timestamp": "2026-05-29 01:05:24,540", "thread_id": "4620", "caller": "0x7fff4cbd15ac", "parentcaller": "0x7fff4cbd14ff", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002450" }, { "name": "ValueName", "value": "InstalledLocation" }, { "name": "Data", "value": "C:\\Windows\\SystemApps\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\22\\InstalledLocation" } ], "repeated": 0, "id": 9216 }, { "timestamp": "2026-05-29 01:05:24,540", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 9217 }, { "timestamp": "2026-05-29 01:05:24,540", "thread_id": "4620", "caller": "0x7fff4cbd15ac", "parentcaller": "0x7fff4cbd14ff", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002450" }, { "name": "ValueName", "value": "MutableLink" }, { "name": "Data", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\22\\MutableLink" } ], "repeated": 0, "id": 9218 }, { "timestamp": "2026-05-29 01:05:24,540", "thread_id": "4620", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577aed38", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002450" } ], "repeated": 0, "id": 9219 }, { "timestamp": "2026-05-29 01:05:24,540", "thread_id": "4620", "caller": "0x7fff4cbd17f2", "parentcaller": "0x7fff577ae12f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b8" } ], "repeated": 0, "id": 9220 }, { "timestamp": "2026-05-29 01:05:24,540", "thread_id": "4620", "caller": "0x7fff4cbd180b", "parentcaller": "0x7fff577ae12f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002504" } ], "repeated": 0, "id": 9221 }, { "timestamp": "2026-05-29 01:05:24,540", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002490" }, { "name": "ValueName", "value": "{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\WindowsPowerShell\\v1.0\\powershell.exe" }, { "name": "Type", "value": "11" }, { "name": "Buffer", "value": "\\xb7\\xab\\xd9:\\x07\\xef\\xdc\\x01" }, { "name": "BufferLength", "value": "8" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\JumplistData\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\WindowsPowerShell\\v1.0\\powershell.exe" } ], "repeated": 0, "id": 9222 }, { "timestamp": "2026-05-29 01:05:24,540", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002490" } ], "repeated": 0, "id": 9223 }, { "timestamp": "2026-05-29 01:05:24,540", "thread_id": "4620", "caller": "0x7fff4cbd1a81", "parentcaller": "0x7fff4cbd138a", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002504" }, { "name": "SubKey", "value": "Metadata" }, { "name": "Handle", "value": "0x00001af0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Metadata" } ], "repeated": 0, "id": 9224 }, { "timestamp": "2026-05-29 01:05:24,540", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577af579", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002504" }, { "name": "SubKey", "value": "Package\\Index\\PackageFullName\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" }, { "name": "Handle", "value": "0x00002520" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Index\\PackageFullName\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" } ], "repeated": 0, "id": 9225 }, { "timestamp": "2026-05-29 01:05:24,540", "thread_id": "4620", "caller": "0x7fff4cbd1732", "parentcaller": "0x7fff577af7dc", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002520" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "22" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Index\\PackageFullName\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\22" } ], "repeated": 0, "id": 9226 }, { "timestamp": "2026-05-29 01:05:24,540", "thread_id": "4620", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577af5fd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002520" } ], "repeated": 0, "id": 9227 }, { "timestamp": "2026-05-29 01:05:24,540", "thread_id": "4620", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff57815e2d", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 9228 }, { "timestamp": "2026-05-29 01:05:24,540", "thread_id": "4620", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff57815e8b", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "`k\\xc8\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00" } ], "repeated": 0, "id": 9229 }, { "timestamp": "2026-05-29 01:05:24,540", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577aebe9", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002504" }, { "name": "SubKey", "value": "User\\Index\\UserSid\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "Handle", "value": "0x00002520" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\User\\Index\\UserSid\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 9230 }, { "timestamp": "2026-05-29 01:05:24,540", "thread_id": "4620", "caller": "0x7fff4cbd1732", "parentcaller": "0x7fff577af7dc", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002520" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "3" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\User\\Index\\UserSid\\S-1-5-21-3968686040-3210279463-847977608-1001\\3" } ], "repeated": 0, "id": 9231 }, { "timestamp": "2026-05-29 01:05:24,540", "thread_id": "4620", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577aec6d", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002520" } ], "repeated": 0, "id": 9232 }, { "timestamp": "2026-05-29 01:05:24,540", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577ae9b0", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00002504" }, { "name": "SubKey", "value": "PackageExternalLocation\\Index\\UserAndPackage\\3^22" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\PackageExternalLocation\\Index\\UserAndPackage\\3^22" } ], "repeated": 0, "id": 9233 }, { "timestamp": "2026-05-29 01:05:24,540", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577ae9b0", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00002504" }, { "name": "SubKey", "value": "PackageExternalLocation\\Index\\UserAndPackage\\0^22" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\PackageExternalLocation\\Index\\UserAndPackage\\0^22" } ], "repeated": 0, "id": 9234 }, { "timestamp": "2026-05-29 01:05:24,540", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc690f2", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 9235 }, { "timestamp": "2026-05-29 01:05:24,540", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577af308", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002504" }, { "name": "SubKey", "value": "Package\\Data\\22" }, { "name": "Handle", "value": "0x00002520" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\22" } ], "repeated": 0, "id": 9236 }, { "timestamp": "2026-05-29 01:05:24,540", "thread_id": "4620", "caller": "0x7fff4cbd15ac", "parentcaller": "0x7fff4cbd14ff", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002520" }, { "name": "ValueName", "value": "InstalledLocation" }, { "name": "Data", "value": "C:\\Windows\\SystemApps\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\22\\InstalledLocation" } ], "repeated": 0, "id": 9237 }, { "timestamp": "2026-05-29 01:05:24,540", "thread_id": "4620", "caller": "0x7fff4cbd15ac", "parentcaller": "0x7fff4cbd14ff", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002520" }, { "name": "ValueName", "value": "MutableLink" }, { "name": "Data", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\22\\MutableLink" } ], "repeated": 0, "id": 9238 }, { "timestamp": "2026-05-29 01:05:24,540", "thread_id": "4620", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577aed38", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002520" } ], "repeated": 0, "id": 9239 }, { "timestamp": "2026-05-29 01:05:24,540", "thread_id": "4620", "caller": "0x7fff4cbd17f2", "parentcaller": "0x7fff577ae12f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 9240 }, { "timestamp": "2026-05-29 01:05:24,540", "thread_id": "4620", "caller": "0x7fff4cbd180b", "parentcaller": "0x7fff577ae12f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002504" } ], "repeated": 0, "id": 9241 }, { "timestamp": "2026-05-29 01:05:24,540", "thread_id": "4696", "caller": "0x7ff79bc8a418", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b8" } ], "repeated": 0, "id": 9242 }, { "timestamp": "2026-05-29 01:05:24,540", "thread_id": "4344", "caller": "0x7ff79bcd3bb4", "parentcaller": "0x00000000", "category": "registry", "api": "RegNotifyChangeKeyValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\" }, { "name": "NotifyFilter", "value": "0x10000005" }, { "name": "WatchSubtree", "value": "1" }, { "name": "Asynchronous", "value": "1" } ], "repeated": 0, "id": 9243 }, { "timestamp": "2026-05-29 01:05:24,540", "thread_id": "4344", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd15e8a", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 9244 }, { "timestamp": "2026-05-29 01:05:24,540", "thread_id": "4344", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd15e8a", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 9245 }, { "timestamp": "2026-05-29 01:05:24,540", "thread_id": "4344", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd15e8a", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000024b8" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search" } ], "repeated": 0, "id": 9246 }, { "timestamp": "2026-05-29 01:05:24,540", "thread_id": "4344", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd15e8a", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000024b8" }, { "name": "ValueName", "value": "BackgroundAppGlobalToggle" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\BackgroundAppGlobalToggle" } ], "repeated": 0, "id": 9247 }, { "timestamp": "2026-05-29 01:05:24,540", "thread_id": "4344", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd15e8a", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b8" } ], "repeated": 0, "id": 9248 }, { "timestamp": "2026-05-29 01:05:24,540", "thread_id": "4504", "caller": "0x7ff79bcd3bb4", "parentcaller": "0x00000000", "category": "registry", "api": "RegNotifyChangeKeyValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\" }, { "name": "NotifyFilter", "value": "0x10000005" }, { "name": "WatchSubtree", "value": "1" }, { "name": "Asynchronous", "value": "1" } ], "repeated": 0, "id": 9249 }, { "timestamp": "2026-05-29 01:05:24,540", "thread_id": "4504", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd15e8a", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 9250 }, { "timestamp": "2026-05-29 01:05:24,540", "thread_id": "4500", "caller": "0x7ff79bcd3bb4", "parentcaller": "0x00000000", "category": "registry", "api": "RegNotifyChangeKeyValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\" }, { "name": "NotifyFilter", "value": "0x10000005" }, { "name": "WatchSubtree", "value": "1" }, { "name": "Asynchronous", "value": "1" } ], "repeated": 0, "id": 9251 }, { "timestamp": "2026-05-29 01:05:24,540", "thread_id": "4500", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd15e8a", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 2, "id": 9252 }, { "timestamp": "2026-05-29 01:05:24,540", "thread_id": "4500", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd15e8a", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 1, "id": 9253 }, { "timestamp": "2026-05-29 01:05:24,540", "thread_id": "4500", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd15e8a", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000024b8" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search" } ], "repeated": 0, "id": 9254 }, { "timestamp": "2026-05-29 01:05:24,555", "thread_id": "4500", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd15e8a", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000024b8" }, { "name": "ValueName", "value": "BackgroundAppGlobalToggle" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\BackgroundAppGlobalToggle" } ], "repeated": 0, "id": 9255 }, { "timestamp": "2026-05-29 01:05:24,555", "thread_id": "4504", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd15e8a", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000024a0" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search" } ], "repeated": 0, "id": 9256 }, { "timestamp": "2026-05-29 01:05:24,555", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 9257 }, { "timestamp": "2026-05-29 01:05:24,555", "thread_id": "4620", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 9258 }, { "timestamp": "2026-05-29 01:05:24,555", "thread_id": "4620", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 9259 }, { "timestamp": "2026-05-29 01:05:24,555", "thread_id": "4620", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateChange\\PackageList\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateChange\\PackageList\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" } ], "repeated": 0, "id": 9260 }, { "timestamp": "2026-05-29 01:05:24,555", "thread_id": "4620", "caller": "0x7fff577b26e8", "parentcaller": "0x7fff577b279b", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xf7 \\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00c\\x00r\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00l\\x00i\\x00e\\x00n\\x00t\\x00.\\x00C\\x00B\\x00S\\x00_\\x001\\x000\\x000\\x000\\x00.\\x001\\x009\\x000\\x005\\x003\\x00" } ], "repeated": 0, "id": 9261 }, { "timestamp": "2026-05-29 01:05:24,555", "thread_id": "4620", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 9262 }, { "timestamp": "2026-05-29 01:05:24,555", "thread_id": "4620", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001258" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 9263 }, { "timestamp": "2026-05-29 01:05:24,555", "thread_id": "4620", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002488" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00001258" }, { "name": "ObjectAttributesName", "value": "S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 9264 }, { "timestamp": "2026-05-29 01:05:24,555", "thread_id": "4620", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002488" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 9265 }, { "timestamp": "2026-05-29 01:05:24,555", "thread_id": "4620", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002530" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00002488" }, { "name": "ObjectAttributesName", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" } ], "repeated": 0, "id": 9266 }, { "timestamp": "2026-05-29 01:05:24,555", "thread_id": "4620", "caller": "0x7fff577b4086", "parentcaller": "0x7fff577b27b6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" } ], "repeated": 0, "id": 9267 }, { "timestamp": "2026-05-29 01:05:24,555", "thread_id": "4620", "caller": "0x7fff577b40c3", "parentcaller": "0x7fff577b27b6", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002530" }, { "name": "ValueName", "value": "PackageStatus" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\PackageStatus" } ], "repeated": 0, "id": 9268 }, { "timestamp": "2026-05-29 01:05:24,555", "thread_id": "4620", "caller": "0x7fff577b40d4", "parentcaller": "0x7fff577b27b6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002530" } ], "repeated": 0, "id": 9269 }, { "timestamp": "2026-05-29 01:05:24,555", "thread_id": "4504", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd15e8a", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024a0" } ], "repeated": 0, "id": 9270 }, { "timestamp": "2026-05-29 01:05:24,555", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 9271 }, { "timestamp": "2026-05-29 01:05:24,555", "thread_id": "4500", "caller": "0x7ff79bcd3bb4", "parentcaller": "0x00000000", "category": "registry", "api": "RegNotifyChangeKeyValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\" }, { "name": "NotifyFilter", "value": "0x10000005" }, { "name": "WatchSubtree", "value": "1" }, { "name": "Asynchronous", "value": "1" } ], "repeated": 0, "id": 9272 }, { "timestamp": "2026-05-29 01:05:24,555", "thread_id": "4500", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd15e8a", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 9273 }, { "timestamp": "2026-05-29 01:05:24,555", "thread_id": "4620", "caller": "0x7fff44bc5d4a", "parentcaller": "0x7fff44bc618f", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "DBCE7E40-7345-439D-B12C-114A11819A09" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "130A2F65-2BE7-4309-9A58-A9052FF2B61C" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 9274 }, { "timestamp": "2026-05-29 01:05:24,555", "thread_id": "4620", "caller": "0x7fff4cbd12d2", "parentcaller": "0x7fff577adc16", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache" }, { "name": "Handle", "value": "0x00002414" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache" } ], "repeated": 0, "id": 9275 }, { "timestamp": "2026-05-29 01:05:24,555", "thread_id": "4620", "caller": "0x7fff4cbd1a81", "parentcaller": "0x7fff4cbd138a", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002414" }, { "name": "SubKey", "value": "Metadata" }, { "name": "Handle", "value": "0x00002524" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Metadata" } ], "repeated": 0, "id": 9276 }, { "timestamp": "2026-05-29 01:05:24,555", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577af579", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002414" }, { "name": "SubKey", "value": "Package\\Index\\PackageFullName\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" }, { "name": "Handle", "value": "0x00002490" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Index\\PackageFullName\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" } ], "repeated": 0, "id": 9277 }, { "timestamp": "2026-05-29 01:05:24,555", "thread_id": "4620", "caller": "0x7fff4cbd1732", "parentcaller": "0x7fff577af7dc", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002490" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "22" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Index\\PackageFullName\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\22" } ], "repeated": 0, "id": 9278 }, { "timestamp": "2026-05-29 01:05:24,555", "thread_id": "4620", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577af5fd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002490" } ], "repeated": 0, "id": 9279 }, { "timestamp": "2026-05-29 01:05:24,555", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577af308", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002414" }, { "name": "SubKey", "value": "Package\\Data\\22" }, { "name": "Handle", "value": "0x00002490" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\22" } ], "repeated": 0, "id": 9280 }, { "timestamp": "2026-05-29 01:05:24,555", "thread_id": "4620", "caller": "0x7fff4cbd16ad", "parentcaller": "0x7fff5781d320", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002490" }, { "name": "ValueName", "value": "PackageOrigin" }, { "name": "Data", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\22\\PackageOrigin" } ], "repeated": 0, "id": 9281 }, { "timestamp": "2026-05-29 01:05:24,555", "thread_id": "4620", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577aed38", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002490" } ], "repeated": 0, "id": 9282 }, { "timestamp": "2026-05-29 01:05:24,555", "thread_id": "4620", "caller": "0x7fff4cbd17f2", "parentcaller": "0x7fff577adcce", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002524" } ], "repeated": 0, "id": 9283 }, { "timestamp": "2026-05-29 01:05:24,555", "thread_id": "4620", "caller": "0x7fff4cbd180b", "parentcaller": "0x7fff577adcce", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002414" } ], "repeated": 1, "id": 9284 }, { "timestamp": "2026-05-29 01:05:24,555", "thread_id": "4620", "caller": "0x7fff59f867b9", "parentcaller": "0x7fff5781ad43", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002524" } ], "repeated": 0, "id": 9285 }, { "timestamp": "2026-05-29 01:05:24,555", "thread_id": "4620", "caller": "0x7fff4cbd12d2", "parentcaller": "0x7fff577adf5c", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache" }, { "name": "Handle", "value": "0x00002524" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache" } ], "repeated": 0, "id": 9286 }, { "timestamp": "2026-05-29 01:05:24,555", "thread_id": "4620", "caller": "0x7fff4cbd1a81", "parentcaller": "0x7fff4cbd138a", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002524" }, { "name": "SubKey", "value": "Metadata" }, { "name": "Handle", "value": "0x00002414" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Metadata" } ], "repeated": 0, "id": 9287 }, { "timestamp": "2026-05-29 01:05:24,555", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577af579", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002524" }, { "name": "SubKey", "value": "Package\\Index\\PackageFullName\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" }, { "name": "Handle", "value": "0x00002490" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Index\\PackageFullName\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" } ], "repeated": 0, "id": 9288 }, { "timestamp": "2026-05-29 01:05:24,555", "thread_id": "4620", "caller": "0x7fff4cbd1732", "parentcaller": "0x7fff577af7dc", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002490" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "22" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Index\\PackageFullName\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\22" } ], "repeated": 0, "id": 9289 }, { "timestamp": "2026-05-29 01:05:24,555", "thread_id": "4620", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577af5fd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002490" } ], "repeated": 0, "id": 9290 }, { "timestamp": "2026-05-29 01:05:24,555", "thread_id": "4620", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff57815e2d", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 9291 }, { "timestamp": "2026-05-29 01:05:24,555", "thread_id": "4620", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff57815e8b", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "`e\\xc8\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\\\x00S\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00" } ], "repeated": 0, "id": 9292 }, { "timestamp": "2026-05-29 01:05:24,555", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577aebe9", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002524" }, { "name": "SubKey", "value": "User\\Index\\UserSid\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "Handle", "value": "0x00002490" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\User\\Index\\UserSid\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 9293 }, { "timestamp": "2026-05-29 01:05:24,555", "thread_id": "4620", "caller": "0x7fff4cbd1732", "parentcaller": "0x7fff577af7dc", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002490" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "3" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\User\\Index\\UserSid\\S-1-5-21-3968686040-3210279463-847977608-1001\\3" } ], "repeated": 0, "id": 9294 }, { "timestamp": "2026-05-29 01:05:24,555", "thread_id": "4620", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577aec6d", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002490" } ], "repeated": 0, "id": 9295 }, { "timestamp": "2026-05-29 01:05:24,555", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577ae9b0", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00002524" }, { "name": "SubKey", "value": "PackageExternalLocation\\Index\\UserAndPackage\\3^22" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\PackageExternalLocation\\Index\\UserAndPackage\\3^22" } ], "repeated": 0, "id": 9296 }, { "timestamp": "2026-05-29 01:05:24,555", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577ae9b0", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00002524" }, { "name": "SubKey", "value": "PackageExternalLocation\\Index\\UserAndPackage\\0^22" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\PackageExternalLocation\\Index\\UserAndPackage\\0^22" } ], "repeated": 0, "id": 9297 }, { "timestamp": "2026-05-29 01:05:24,555", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577af308", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002524" }, { "name": "SubKey", "value": "Package\\Data\\22" }, { "name": "Handle", "value": "0x00002490" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\22" } ], "repeated": 0, "id": 9298 }, { "timestamp": "2026-05-29 01:05:24,555", "thread_id": "4620", "caller": "0x7fff4cbd15ac", "parentcaller": "0x7fff4cbd14ff", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002490" }, { "name": "ValueName", "value": "InstalledLocation" }, { "name": "Data", "value": "C:\\Windows\\SystemApps\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\22\\InstalledLocation" } ], "repeated": 0, "id": 9299 }, { "timestamp": "2026-05-29 01:05:24,555", "thread_id": "4620", "caller": "0x7fff4cbd15ac", "parentcaller": "0x7fff4cbd14ff", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002490" }, { "name": "ValueName", "value": "MutableLink" }, { "name": "Data", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\22\\MutableLink" } ], "repeated": 0, "id": 9300 }, { "timestamp": "2026-05-29 01:05:24,555", "thread_id": "4620", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577aed38", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002490" } ], "repeated": 0, "id": 9301 }, { "timestamp": "2026-05-29 01:05:24,555", "thread_id": "4620", "caller": "0x7fff4cbd17f2", "parentcaller": "0x7fff577ae12f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002414" } ], "repeated": 0, "id": 9302 }, { "timestamp": "2026-05-29 01:05:24,555", "thread_id": "4620", "caller": "0x7fff4cbd180b", "parentcaller": "0x7fff577ae12f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002524" } ], "repeated": 0, "id": 9303 }, { "timestamp": "2026-05-29 01:05:24,555", "thread_id": "4620", "caller": "0x7fff4cbd12d2", "parentcaller": "0x7fff4ce4f3d5", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache" }, { "name": "Handle", "value": "0x00002524" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache" } ], "repeated": 0, "id": 9304 }, { "timestamp": "2026-05-29 01:05:24,555", "thread_id": "4620", "caller": "0x7fff4cbd1a81", "parentcaller": "0x7fff4cbd138a", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002524" }, { "name": "SubKey", "value": "Metadata" }, { "name": "Handle", "value": "0x00002414" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Metadata" } ], "repeated": 0, "id": 9305 }, { "timestamp": "2026-05-29 01:05:24,555", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff4ce6726d", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002524" }, { "name": "SubKey", "value": "Package\\Index\\PackageFullName\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" }, { "name": "Handle", "value": "0x00002490" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Index\\PackageFullName\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" } ], "repeated": 0, "id": 9306 }, { "timestamp": "2026-05-29 01:05:24,555", "thread_id": "4620", "caller": "0x7fff4cbd1732", "parentcaller": "0x7fff4ce672d1", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002490" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "22" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Index\\PackageFullName\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\22" } ], "repeated": 0, "id": 9307 }, { "timestamp": "2026-05-29 01:05:24,555", "thread_id": "4620", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff4ce67302", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002490" } ], "repeated": 0, "id": 9308 }, { "timestamp": "2026-05-29 01:05:24,555", "thread_id": "4500", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd15e8a", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 9309 }, { "timestamp": "2026-05-29 01:05:24,555", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff4ce66f0d", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002524" }, { "name": "SubKey", "value": "Package\\Data\\22" }, { "name": "Handle", "value": "0x00002490" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\22" } ], "repeated": 0, "id": 9310 }, { "timestamp": "2026-05-29 01:05:24,555", "thread_id": "4620", "caller": "0x7fff4cbd16ad", "parentcaller": "0x7fff4ce7d91c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002490" }, { "name": "ValueName", "value": "Flags" }, { "name": "Data", "value": "8913992" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\22\\Flags" } ], "repeated": 0, "id": 9311 }, { "timestamp": "2026-05-29 01:05:24,555", "thread_id": "4620", "caller": "0x7fff4cbd15ac", "parentcaller": "0x7fff4cbd14ff", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002490" }, { "name": "ValueName", "value": "InstalledLocation" }, { "name": "Data", "value": "C:\\Windows\\SystemApps\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\22\\InstalledLocation" } ], "repeated": 0, "id": 9312 }, { "timestamp": "2026-05-29 01:05:24,555", "thread_id": "4620", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff4ce66913", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002490" } ], "repeated": 0, "id": 9313 }, { "timestamp": "2026-05-29 01:05:24,555", "thread_id": "4620", "caller": "0x7fff4cbd17f2", "parentcaller": "0x7fff4ce4f481", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002414" } ], "repeated": 0, "id": 9314 }, { "timestamp": "2026-05-29 01:05:24,555", "thread_id": "4620", "caller": "0x7fff4cbd180b", "parentcaller": "0x7fff4ce4f481", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002524" } ], "repeated": 0, "id": 9315 }, { "timestamp": "2026-05-29 01:05:24,555", "thread_id": "4620", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff59f667b5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xee \\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\xf05\\xf0L\\xff\\x7f\\x00\\x00\\x86\\xde\\x80W\\xff\\x7f\\x00\\x00\t\\x00\\x00\\x00^t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xee \\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 9316 }, { "timestamp": "2026-05-29 01:05:24,555", "thread_id": "4620", "caller": "0x7fff59f667ec", "parentcaller": "0x7fff577b5140", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002524" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 9317 }, { "timestamp": "2026-05-29 01:05:24,555", "thread_id": "4620", "caller": "0x7fff57562450", "parentcaller": "0x7fff4ce5d33f", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00002524" }, { "name": "SubKey", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppContainer\\Storage\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\\ResourcesConfig" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppContainer\\Storage\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\\ResourcesConfig" } ], "repeated": 0, "id": 9318 }, { "timestamp": "2026-05-29 01:05:24,555", "thread_id": "4620", "caller": "0x7fff57562486", "parentcaller": "0x7fff4ce5d33f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002524" } ], "repeated": 0, "id": 9319 }, { "timestamp": "2026-05-29 01:05:24,555", "thread_id": "4620", "caller": "0x7fff5781026b", "parentcaller": "0x7fff4ce46110", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002524" } ], "repeated": 0, "id": 9320 }, { "timestamp": "2026-05-29 01:05:24,555", "thread_id": "4620", "caller": "0x7fff4ce461a3", "parentcaller": "0x7fff4ce46123", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 9321 }, { "timestamp": "2026-05-29 01:05:24,555", "thread_id": "4620", "caller": "0x7fff4ce461ff", "parentcaller": "0x7fff4ce46123", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x80\\xdc\\xaa\\x0c\\x00\\x00\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00\\xa8\\xdc\\xaa\\x0c\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc8\\xdc\\xaa\\x0c\\x00\\x00\\x00\\x00T\\x00S\\x00A\\x00:\\x00/\\x00/\\x00P\\x00r\\x00o\\x00c\\x00U\\x00n\\x00i\\x00q\\x00u\\x00e\\x00W\\x00\\x00\\x00\\x00\\x00\\x00\\x00%\\xf1\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 9322 }, { "timestamp": "2026-05-29 01:05:24,555", "thread_id": "4620", "caller": "0x7fff577d6785", "parentcaller": "0x7fff4ce46131", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002524" } ], "repeated": 0, "id": 9323 }, { "timestamp": "2026-05-29 01:05:24,555", "thread_id": "4620", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 9324 }, { "timestamp": "2026-05-29 01:05:24,555", "thread_id": "4620", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 9325 }, { "timestamp": "2026-05-29 01:05:24,555", "thread_id": "4620", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Mrt\\_Merged" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Mrt\\_Merged" } ], "repeated": 0, "id": 9326 }, { "timestamp": "2026-05-29 01:05:24,555", "thread_id": "4620", "caller": "0x7fff577d1e5c", "parentcaller": "0x7fff4ce52bda", "category": "filesystem", "api": "NtQueryFullAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\SystemApps\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\\resources.pri" } ], "repeated": 0, "id": 9327 }, { "timestamp": "2026-05-29 01:05:24,555", "thread_id": "4620", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002524" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\SystemApps\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\\resources.pri" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9328 }, { "timestamp": "2026-05-29 01:05:24,555", "thread_id": "4620", "caller": "0x7fff57814097", "parentcaller": "0x7fff4ce4ec60", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002524" }, { "name": "HandleName", "value": "C:\\Windows\\SystemApps\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\\resources.pri" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00 *\\x00\\x00\\x00\\x00\\x00\\xb0\\x1f*\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 9329 }, { "timestamp": "2026-05-29 01:05:24,555", "thread_id": "4620", "caller": "0x7fff577cf0e1", "parentcaller": "0x7fff577cef40", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002414" }, { "name": "DesiredAccess", "value": "0x000f0005", "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x00002524" }, { "name": "FileName", "value": "C:\\Windows\\SystemApps\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\\resources.pri" } ], "repeated": 0, "id": 9330 }, { "timestamp": "2026-05-29 01:05:24,555", "thread_id": "4620", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002414" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x13260000" }, { "name": "SectionOffset", "value": "0x0320ebf0" }, { "name": "ViewSize", "value": "0x002a2000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9331 }, { "timestamp": "2026-05-29 01:05:24,555", "thread_id": "4620", "caller": "0x7fff577d6785", "parentcaller": "0x7fff4ce4ed05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002414" } ], "repeated": 0, "id": 9332 }, { "timestamp": "2026-05-29 01:05:24,555", "thread_id": "4620", "caller": "0x7fff577d6785", "parentcaller": "0x7fff4ce4ed17", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002524" } ], "repeated": 0, "id": 9333 }, { "timestamp": "2026-05-29 01:05:24,555", "thread_id": "4620", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff59f667b5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "p\\xe7 \\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\x96\\xd9\\x0b\\x00\\x00\\x00\\x00\\x86\\xde\\x80W\\xff\\x7f\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\xe7 \\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 9334 }, { "timestamp": "2026-05-29 01:05:24,555", "thread_id": "4620", "caller": "0x7fff59f667ec", "parentcaller": "0x7fff577b5140", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002524" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 9335 }, { "timestamp": "2026-05-29 01:05:24,555", "thread_id": "4620", "caller": "0x7fff57562450", "parentcaller": "0x7fff4ce5d33f", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00002524" }, { "name": "SubKey", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppContainer\\Storage\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\\ResourcesConfig" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppContainer\\Storage\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\\ResourcesConfig" } ], "repeated": 0, "id": 9336 }, { "timestamp": "2026-05-29 01:05:24,555", "thread_id": "4620", "caller": "0x7fff57562486", "parentcaller": "0x7fff4ce5d33f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002524" } ], "repeated": 0, "id": 9337 }, { "timestamp": "2026-05-29 01:05:24,555", "thread_id": "4500", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd15e8a", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000024a0" }, { "name": "ValueName", "value": "BackgroundAppGlobalToggle" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\BackgroundAppGlobalToggle" } ], "repeated": 0, "id": 9338 }, { "timestamp": "2026-05-29 01:05:24,555", "thread_id": "4500", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd15e8a", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024a0" } ], "repeated": 0, "id": 9339 }, { "timestamp": "2026-05-29 01:05:24,555", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 9340 }, { "timestamp": "2026-05-29 01:05:24,555", "thread_id": "4620", "caller": "0x7fff54fcd469", "parentcaller": "0x7fff54fcd2ee", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 9341 }, { "timestamp": "2026-05-29 01:05:24,555", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 9342 }, { "timestamp": "2026-05-29 01:05:24,571", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc68e6a", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 2, "id": 9343 }, { "timestamp": "2026-05-29 01:05:24,571", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xdf\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x005\\x18\\xff\\x7f\\x00\\x00X\\xe0\\\\x03\\x00\\x00\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 9344 }, { "timestamp": "2026-05-29 01:05:24,571", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002450" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 9345 }, { "timestamp": "2026-05-29 01:05:24,571", "thread_id": "4696", "caller": "0x7ff79bc8a418", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002450" } ], "repeated": 0, "id": 9346 }, { "timestamp": "2026-05-29 01:05:24,571", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 9347 }, { "timestamp": "2026-05-29 01:05:24,571", "thread_id": "4620", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff4ce4e4df", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x13260000" }, { "name": "RegionSize", "value": "0x002a2000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 9348 }, { "timestamp": "2026-05-29 01:05:24,571", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 9349 }, { "timestamp": "2026-05-29 01:05:24,571", "thread_id": "4636", "caller": "0x7fff58c2c304", "parentcaller": "0x7fff44c012c7", "category": "windows", "api": "SendNotifyMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000100ac" }, { "name": "Message", "value": "0x00000403" } ], "repeated": 0, "id": 9350 }, { "timestamp": "2026-05-29 01:05:24,571", "thread_id": "4636", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xf9\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x1c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4636" } ], "repeated": 0, "id": 9351 }, { "timestamp": "2026-05-29 01:05:24,571", "thread_id": "4720", "caller": "0x7fff58c2ce12", "parentcaller": "0x7fff581be858", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000100ac" }, { "name": "Message", "value": "0x00000404" } ], "repeated": 0, "id": 9352 }, { "timestamp": "2026-05-29 01:05:24,571", "thread_id": "4576", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\x11\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4576" } ], "repeated": 0, "id": 9353 }, { "timestamp": "2026-05-29 01:05:24,571", "thread_id": "4576", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000177c" }, { "name": "ValueName", "value": "ZvpebfbsgJvaqbjf.Pyvrag.POF_pj5a1u2gklrjl!JvaqbjfOnpxhc" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\ZvpebfbsgJvaqbjf.Pyvrag.POF_pj5a1u2gklrjl!JvaqbjfOnpxhc" } ], "repeated": 1, "id": 9354 }, { "timestamp": "2026-05-29 01:05:24,571", "thread_id": "4576", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\x11\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4576" } ], "repeated": 0, "id": 9355 }, { "timestamp": "2026-05-29 01:05:24,571", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9356 }, { "timestamp": "2026-05-29 01:05:24,571", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000404" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 9357 }, { "timestamp": "2026-05-29 01:05:24,571", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9358 }, { "timestamp": "2026-05-29 01:05:24,571", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000404" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 9359 }, { "timestamp": "2026-05-29 01:05:24,571", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9360 }, { "timestamp": "2026-05-29 01:05:24,571", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000404" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 9361 }, { "timestamp": "2026-05-29 01:05:24,571", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9362 }, { "timestamp": "2026-05-29 01:05:24,571", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000404" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 9363 }, { "timestamp": "2026-05-29 01:05:24,571", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9364 }, { "timestamp": "2026-05-29 01:05:24,571", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000404" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 9365 }, { "timestamp": "2026-05-29 01:05:24,571", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9366 }, { "timestamp": "2026-05-29 01:05:24,571", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000404" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 9367 }, { "timestamp": "2026-05-29 01:05:24,571", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9368 }, { "timestamp": "2026-05-29 01:05:24,571", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000404" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 9369 }, { "timestamp": "2026-05-29 01:05:24,571", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9370 }, { "timestamp": "2026-05-29 01:05:24,571", "thread_id": "4636", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000404" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 9371 }, { "timestamp": "2026-05-29 01:05:24,571", "thread_id": "4636", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xf9\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x1c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4636" } ], "repeated": 0, "id": 9372 }, { "timestamp": "2026-05-29 01:05:24,587", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc68e6a", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 2, "id": 9373 }, { "timestamp": "2026-05-29 01:05:24,587", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xdf\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x005\\x18\\xff\\x7f\\x00\\x00X\\xe0\\\\x03\\x00\\x00\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 9374 }, { "timestamp": "2026-05-29 01:05:24,587", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000024b4" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 9375 }, { "timestamp": "2026-05-29 01:05:24,587", "thread_id": "4696", "caller": "0x7ff79bc8a418", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" } ], "repeated": 0, "id": 9376 }, { "timestamp": "2026-05-29 01:05:24,602", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc68e6a", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 2, "id": 9377 }, { "timestamp": "2026-05-29 01:05:24,602", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xe2\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x005\\x18\\xff\\x7f\\x00\\x00(\\xe3\\\\x03\\x00\\x00\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 9378 }, { "timestamp": "2026-05-29 01:05:24,602", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002450" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 9379 }, { "timestamp": "2026-05-29 01:05:24,602", "thread_id": "4696", "caller": "0x7ff79bc8a418", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002450" } ], "repeated": 0, "id": 9380 }, { "timestamp": "2026-05-29 01:05:24,602", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc68e6a", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 2, "id": 9381 }, { "timestamp": "2026-05-29 01:05:24,602", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xdf\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x005\\x18\\xff\\x7f\\x00\\x00X\\xe0\\\\x03\\x00\\x00\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 9382 }, { "timestamp": "2026-05-29 01:05:24,602", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002450" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 9383 }, { "timestamp": "2026-05-29 01:05:24,602", "thread_id": "4696", "caller": "0x7ff79bc8a418", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002450" } ], "repeated": 0, "id": 9384 }, { "timestamp": "2026-05-29 01:05:24,633", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc68e6a", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 2, "id": 9385 }, { "timestamp": "2026-05-29 01:05:24,633", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xdf\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x005\\x18\\xff\\x7f\\x00\\x00X\\xe0\\\\x03\\x00\\x00\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 9386 }, { "timestamp": "2026-05-29 01:05:24,633", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000024b4" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 9387 }, { "timestamp": "2026-05-29 01:05:24,633", "thread_id": "4696", "caller": "0x7ff79bc8a418", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" } ], "repeated": 0, "id": 9388 }, { "timestamp": "2026-05-29 01:05:24,665", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc68e6a", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 2, "id": 9389 }, { "timestamp": "2026-05-29 01:05:24,665", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xdf\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x005\\x18\\xff\\x7f\\x00\\x00X\\xe0\\\\x03\\x00\\x00\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 9390 }, { "timestamp": "2026-05-29 01:05:24,665", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000024ac" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 9391 }, { "timestamp": "2026-05-29 01:05:24,665", "thread_id": "4696", "caller": "0x7ff79bc8a418", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024ac" } ], "repeated": 0, "id": 9392 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff57fc2755", "parentcaller": "0x7fff57fc2699", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "-\\x00%\\x00D\\x004\\x00#\\x00!\\x00`\\x00`\\x00`\\x00`\\x00`\\x00K\\x00D\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x000\\x008\\x00$\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00" }, { "name": "Size", "value": "64" }, { "name": "Atom", "value": "0x0000c07d" } ], "repeated": 0, "id": 9393 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000024ac" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000024b4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 9394 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000024b4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "SectionOffset", "value": "0x0779f1f0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9395 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff5807d567", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 9396 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000024b4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "SectionOffset", "value": "0x0779f1f0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9397 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5807d5a3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" } ], "repeated": 0, "id": 9398 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff5584a889", "parentcaller": "0x7fff55854528", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}" }, { "name": "Handle", "value": "0x000024b6" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}" } ], "repeated": 0, "id": 9399 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000024b6" }, { "name": "ValueName", "value": "SortOrderIndex" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\SortOrderIndex" } ], "repeated": 0, "id": 9400 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff5585457e", "parentcaller": "0x7fff55853dab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b6" } ], "repeated": 0, "id": 9401 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff558548a0", "parentcaller": "0x7fff558545a7", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}" } ], "repeated": 0, "id": 9402 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff558548a0", "parentcaller": "0x7fff558545bf", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}" } ], "repeated": 0, "id": 9403 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff58c914d4", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 9404 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff57fc2755", "parentcaller": "0x7fff57fc2699", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "-\\x00%\\x00D\\x004\\x00#\\x00!\\x00`\\x00`\\x00`\\x00`\\x00`\\x00K\\x00D\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x000\\x008\\x00$\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00" }, { "name": "Size", "value": "64" }, { "name": "Atom", "value": "0x0000c07d" } ], "repeated": 0, "id": 9405 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000024ac" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000024ac" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 9406 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5809fb6a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024ac" } ], "repeated": 0, "id": 9407 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff57fc2897", "parentcaller": "0x7fff5809fb7b", "category": "synchronization", "api": "NtDeleteAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "Atom", "value": "0x0000c07d" } ], "repeated": 0, "id": 9408 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff57fc2755", "parentcaller": "0x7fff57fc2699", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "-\\x00%\\x00D\\x004\\x00#\\x00!\\x00`\\x00`\\x00`\\x00`\\x00`\\x00H\\x00D\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x000\\x008\\x00$\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00" }, { "name": "Size", "value": "64" }, { "name": "Atom", "value": "0x0000c072" } ], "repeated": 0, "id": 9409 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000024a0" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000024ac" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 9410 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000024ac" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "SectionOffset", "value": "0x0779f1f0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9411 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff5807d567", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 9412 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000024ac" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "SectionOffset", "value": "0x0779f1f0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9413 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5807d5a3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024ac" } ], "repeated": 0, "id": 9414 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff5584a889", "parentcaller": "0x7fff55854528", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}" }, { "name": "Handle", "value": "0x000024ae" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}" } ], "repeated": 0, "id": 9415 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000024ae" }, { "name": "ValueName", "value": "SortOrderIndex" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\SortOrderIndex" } ], "repeated": 0, "id": 9416 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff5585457e", "parentcaller": "0x7fff55853dab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024ae" } ], "repeated": 0, "id": 9417 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff558548a0", "parentcaller": "0x7fff558545a7", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}" } ], "repeated": 0, "id": 9418 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff558548a0", "parentcaller": "0x7fff558545bf", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}" } ], "repeated": 0, "id": 9419 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff58c914d4", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 9420 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff57fc2755", "parentcaller": "0x7fff57fc2699", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "-\\x00%\\x00D\\x004\\x00#\\x00!\\x00`\\x00`\\x00`\\x00`\\x00`\\x00H\\x00D\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x000\\x008\\x00$\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00" }, { "name": "Size", "value": "64" }, { "name": "Atom", "value": "0x0000c072" } ], "repeated": 0, "id": 9421 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000024a0" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000024a0" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 9422 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5809fb6a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024a0" } ], "repeated": 0, "id": 9423 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff57fc2897", "parentcaller": "0x7fff5809fb7b", "category": "synchronization", "api": "NtDeleteAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "Atom", "value": "0x0000c072" } ], "repeated": 0, "id": 9424 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff57fc2755", "parentcaller": "0x7fff57fc2699", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "-\\x00%\\x00D\\x004\\x00#\\x00!\\x00`\\x00`\\x00`\\x00`\\x00`\\x00,\\x00E\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x000\\x008\\x00$\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00" }, { "name": "Size", "value": "64" }, { "name": "Atom", "value": "0x0000c077" } ], "repeated": 0, "id": 9425 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002530" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000024a0" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 9426 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000024a0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "SectionOffset", "value": "0x0779f1f0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9427 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff5807d567", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 9428 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000024a0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "SectionOffset", "value": "0x0779f1f0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9429 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5807d5a3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024a0" } ], "repeated": 0, "id": 9430 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff5584a889", "parentcaller": "0x7fff55854528", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}" }, { "name": "Handle", "value": "0x000024a2" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}" } ], "repeated": 0, "id": 9431 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000024a2" }, { "name": "ValueName", "value": "SortOrderIndex" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\SortOrderIndex" } ], "repeated": 0, "id": 9432 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff5585457e", "parentcaller": "0x7fff55853dab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024a2" } ], "repeated": 0, "id": 9433 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff558548a0", "parentcaller": "0x7fff558545a7", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}" } ], "repeated": 0, "id": 9434 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff558548a0", "parentcaller": "0x7fff558545bf", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}" } ], "repeated": 0, "id": 9435 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff58c914d4", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 9436 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff57fc2755", "parentcaller": "0x7fff57fc2699", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "-\\x00%\\x00D\\x004\\x00#\\x00!\\x00`\\x00`\\x00`\\x00`\\x00`\\x00,\\x00E\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x000\\x008\\x00$\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00" }, { "name": "Size", "value": "64" }, { "name": "Atom", "value": "0x0000c077" } ], "repeated": 0, "id": 9437 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002530" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002530" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 9438 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5809fb6a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002530" } ], "repeated": 0, "id": 9439 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff57fc2897", "parentcaller": "0x7fff5809fb7b", "category": "synchronization", "api": "NtDeleteAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "Atom", "value": "0x0000c077" } ], "repeated": 0, "id": 9440 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff57fc2755", "parentcaller": "0x7fff57fc2699", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "-\\x00%\\x00D\\x004\\x00#\\x00!\\x00`\\x00`\\x00`\\x00`\\x00`\\x00B\\x00D\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x000\\x008\\x00$\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00" }, { "name": "Size", "value": "64" }, { "name": "Atom", "value": "0x0000c085" } ], "repeated": 0, "id": 9441 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002488" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002450" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 9442 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002450" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9443 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff5807d567", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 9444 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002450" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9445 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5807d5a3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002450" } ], "repeated": 0, "id": 9446 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff58c2c942", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 9447 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff57fc2755", "parentcaller": "0x7fff57fc2699", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "-\\x00%\\x00D\\x004\\x00#\\x00!\\x00`\\x00`\\x00`\\x00`\\x00`\\x00B\\x00D\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x000\\x008\\x00$\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00" }, { "name": "Size", "value": "64" }, { "name": "Atom", "value": "0x0000c085" } ], "repeated": 0, "id": 9448 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002488" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002488" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 9449 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5809fb6a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" } ], "repeated": 0, "id": 9450 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff57fc2897", "parentcaller": "0x7fff5809fb7b", "category": "synchronization", "api": "NtDeleteAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "Atom", "value": "0x0000c085" } ], "repeated": 0, "id": 9451 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff57fc2755", "parentcaller": "0x7fff57fc2699", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "-\\x00%\\x00D\\x004\\x00#\\x00!\\x00`\\x00`\\x00`\\x00`\\x00`\\x00)\\x00E\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x000\\x008\\x00$\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00" }, { "name": "Size", "value": "64" }, { "name": "Atom", "value": "0x0000c06f" } ], "repeated": 0, "id": 9452 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002524" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002488" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 9453 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002488" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9454 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff5807d567", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 9455 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002488" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9456 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5807d5a3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" } ], "repeated": 0, "id": 9457 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff58c2c942", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 9458 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff57fc2755", "parentcaller": "0x7fff57fc2699", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "-\\x00%\\x00D\\x004\\x00#\\x00!\\x00`\\x00`\\x00`\\x00`\\x00`\\x00)\\x00E\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x000\\x008\\x00$\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00" }, { "name": "Size", "value": "64" }, { "name": "Atom", "value": "0x0000c06f" } ], "repeated": 0, "id": 9459 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002524" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002524" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 9460 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5809fb6a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002524" } ], "repeated": 0, "id": 9461 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff57fc2897", "parentcaller": "0x7fff5809fb7b", "category": "synchronization", "api": "NtDeleteAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "Atom", "value": "0x0000c06f" } ], "repeated": 0, "id": 9462 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff57fc2755", "parentcaller": "0x7fff57fc2699", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "-\\x00%\\x00D\\x004\\x00#\\x00!\\x00`\\x00`\\x00`\\x00`\\x00`\\x00%\\x00D\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x000\\x008\\x00$\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00" }, { "name": "Size", "value": "64" }, { "name": "Atom", "value": "0x0000c07e" } ], "repeated": 0, "id": 9463 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002414" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002524" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 9464 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002524" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9465 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff5807d567", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 9466 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002524" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9467 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5807d5a3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002524" } ], "repeated": 0, "id": 9468 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff58c2c942", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 9469 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff57fc2755", "parentcaller": "0x7fff57fc2699", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "-\\x00%\\x00D\\x004\\x00#\\x00!\\x00`\\x00`\\x00`\\x00`\\x00`\\x00%\\x00D\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x000\\x008\\x00$\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00" }, { "name": "Size", "value": "64" }, { "name": "Atom", "value": "0x0000c07e" } ], "repeated": 0, "id": 9470 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002414" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002414" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 9471 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5809fb6a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002414" } ], "repeated": 0, "id": 9472 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff57fc2897", "parentcaller": "0x7fff5809fb7b", "category": "synchronization", "api": "NtDeleteAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "Atom", "value": "0x0000c07e" } ], "repeated": 0, "id": 9473 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff57fc2755", "parentcaller": "0x7fff57fc2699", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "-\\x00%\\x00D\\x004\\x00#\\x00!\\x00`\\x00`\\x00`\\x00`\\x00`\\x00D\\x00D\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x000\\x008\\x00$\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00" }, { "name": "Size", "value": "64" }, { "name": "Atom", "value": "0x0000c07f" } ], "repeated": 0, "id": 9474 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002490" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002414" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 9475 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002414" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9476 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff5807d567", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 9477 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002414" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9478 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5807d5a3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002414" } ], "repeated": 0, "id": 9479 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff58c2c942", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 9480 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff57fc2755", "parentcaller": "0x7fff57fc2699", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "-\\x00%\\x00D\\x004\\x00#\\x00!\\x00`\\x00`\\x00`\\x00`\\x00`\\x00D\\x00D\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x000\\x008\\x00$\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00" }, { "name": "Size", "value": "64" }, { "name": "Atom", "value": "0x0000c07f" } ], "repeated": 0, "id": 9481 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002490" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002490" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 9482 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5809fb6a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002490" } ], "repeated": 0, "id": 9483 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff57fc2897", "parentcaller": "0x7fff5809fb7b", "category": "synchronization", "api": "NtDeleteAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "Atom", "value": "0x0000c07f" } ], "repeated": 0, "id": 9484 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff57fc2755", "parentcaller": "0x7fff57fc2699", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "-\\x00%\\x00D\\x004\\x00#\\x00!\\x00`\\x00`\\x00`\\x00`\\x00`\\x00G\\x00D\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x000\\x008\\x00$\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00" }, { "name": "Size", "value": "64" }, { "name": "Atom", "value": "0x0000c080" } ], "repeated": 0, "id": 9485 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000249c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002490" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 9486 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002490" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9487 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff5807d567", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 9488 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002490" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9489 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5807d5a3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002490" } ], "repeated": 0, "id": 9490 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff58c2c942", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 9491 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff57fc2755", "parentcaller": "0x7fff57fc2699", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "-\\x00%\\x00D\\x004\\x00#\\x00!\\x00`\\x00`\\x00`\\x00`\\x00`\\x00G\\x00D\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x000\\x008\\x00$\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00" }, { "name": "Size", "value": "64" }, { "name": "Atom", "value": "0x0000c080" } ], "repeated": 0, "id": 9492 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000249c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000249c" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 9493 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5809fb6a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000249c" } ], "repeated": 0, "id": 9494 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff57fc2897", "parentcaller": "0x7fff5809fb7b", "category": "synchronization", "api": "NtDeleteAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "Atom", "value": "0x0000c080" } ], "repeated": 0, "id": 9495 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff57fc2755", "parentcaller": "0x7fff57fc2699", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "-\\x00%\\x00D\\x004\\x00#\\x00!\\x00`\\x00`\\x00`\\x00`\\x00`\\x00,\\x00E\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x000\\x008\\x00$\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00" }, { "name": "Size", "value": "64" }, { "name": "Atom", "value": "0x0000c079" } ], "repeated": 0, "id": 9496 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002530" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000249c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 9497 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000249c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9498 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff5807d567", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 9499 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000249c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9500 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5807d5a3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000249c" } ], "repeated": 0, "id": 9501 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff58c2c942", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 9502 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff57fc2755", "parentcaller": "0x7fff57fc2699", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "-\\x00%\\x00D\\x004\\x00#\\x00!\\x00`\\x00`\\x00`\\x00`\\x00`\\x00,\\x00E\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x000\\x008\\x00$\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00" }, { "name": "Size", "value": "64" }, { "name": "Atom", "value": "0x0000c079" } ], "repeated": 0, "id": 9503 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002530" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002530" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 9504 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5809fb6a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002530" } ], "repeated": 0, "id": 9505 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff57fc2897", "parentcaller": "0x7fff5809fb7b", "category": "synchronization", "api": "NtDeleteAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "Atom", "value": "0x0000c079" } ], "repeated": 0, "id": 9506 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff57fc2755", "parentcaller": "0x7fff57fc2699", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "-\\x00%\\x00D\\x004\\x00#\\x00!\\x00`\\x00`\\x00`\\x00`\\x00`\\x00H\\x00D\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x000\\x008\\x00$\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00" }, { "name": "Size", "value": "64" }, { "name": "Atom", "value": "0x0000c087" } ], "repeated": 0, "id": 9507 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000024a0" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002530" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 9508 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002530" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9509 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff5807d567", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 9510 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002530" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9511 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5807d5a3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002530" } ], "repeated": 0, "id": 9512 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff58c2c942", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 9513 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff57fc2755", "parentcaller": "0x7fff57fc2699", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "-\\x00%\\x00D\\x004\\x00#\\x00!\\x00`\\x00`\\x00`\\x00`\\x00`\\x00H\\x00D\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x000\\x008\\x00$\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00" }, { "name": "Size", "value": "64" }, { "name": "Atom", "value": "0x0000c087" } ], "repeated": 0, "id": 9514 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000024a0" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000024a0" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 9515 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5809fb6a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024a0" } ], "repeated": 0, "id": 9516 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff57fc2897", "parentcaller": "0x7fff5809fb7b", "category": "synchronization", "api": "NtDeleteAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "Atom", "value": "0x0000c087" } ], "repeated": 0, "id": 9517 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff57fc2755", "parentcaller": "0x7fff57fc2699", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "-\\x00%\\x00D\\x004\\x00#\\x00!\\x00`\\x00`\\x00`\\x00`\\x00`\\x00K\\x00D\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x000\\x008\\x00$\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00" }, { "name": "Size", "value": "64" }, { "name": "Atom", "value": "0x0000c089" } ], "repeated": 0, "id": 9518 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000024ac" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000024a0" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 9519 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000024a0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9520 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff5807d567", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 9521 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000024a0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9522 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5807d5a3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024a0" } ], "repeated": 0, "id": 9523 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff58c2c942", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 9524 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff57fc2755", "parentcaller": "0x7fff57fc2699", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "-\\x00%\\x00D\\x004\\x00#\\x00!\\x00`\\x00`\\x00`\\x00`\\x00`\\x00K\\x00D\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x000\\x008\\x00$\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00" }, { "name": "Size", "value": "64" }, { "name": "Atom", "value": "0x0000c089" } ], "repeated": 0, "id": 9525 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000024ac" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000024ac" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 9526 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5809fb6a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024ac" } ], "repeated": 0, "id": 9527 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff57fc2897", "parentcaller": "0x7fff5809fb7b", "category": "synchronization", "api": "NtDeleteAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "Atom", "value": "0x0000c089" } ], "repeated": 0, "id": 9528 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff57fc2755", "parentcaller": "0x7fff57fc2699", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "-\\x00%\\x00D\\x004\\x00#\\x00!\\x00`\\x00`\\x00`\\x00`\\x00`\\x00M\\x00D\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x000\\x008\\x00$\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00" }, { "name": "Size", "value": "64" }, { "name": "Atom", "value": "0x0000c077" } ], "repeated": 0, "id": 9529 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000024b4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000024ac" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 9530 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000024ac" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9531 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff5807d567", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 9532 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000024ac" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9533 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5807d5a3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024ac" } ], "repeated": 0, "id": 9534 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff58c2c942", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 9535 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff57fc2755", "parentcaller": "0x7fff57fc2699", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "-\\x00%\\x00D\\x004\\x00#\\x00!\\x00`\\x00`\\x00`\\x00`\\x00`\\x00M\\x00D\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x000\\x008\\x00$\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00" }, { "name": "Size", "value": "64" }, { "name": "Atom", "value": "0x0000c077" } ], "repeated": 0, "id": 9536 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000024b4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000024b4" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 9537 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5809fb6a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" } ], "repeated": 0, "id": 9538 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff57fc2897", "parentcaller": "0x7fff5809fb7b", "category": "synchronization", "api": "NtDeleteAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "Atom", "value": "0x0000c077" } ], "repeated": 0, "id": 9539 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff57fc2755", "parentcaller": "0x7fff57fc2699", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "-\\x00%\\x00D\\x004\\x00#\\x00!\\x00`\\x00`\\x00`\\x00`\\x00`\\x00L\\x00D\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x000\\x008\\x00$\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00" }, { "name": "Size", "value": "64" }, { "name": "Atom", "value": "0x0000c072" } ], "repeated": 0, "id": 9540 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000024b0" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000024b4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 9541 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000024b4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9542 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff5807d567", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 9543 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000024b4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9544 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5807d5a3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" } ], "repeated": 0, "id": 9545 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff58c2c942", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 9546 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff57fc2755", "parentcaller": "0x7fff57fc2699", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "-\\x00%\\x00D\\x004\\x00#\\x00!\\x00`\\x00`\\x00`\\x00`\\x00`\\x00L\\x00D\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x000\\x008\\x00$\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00" }, { "name": "Size", "value": "64" }, { "name": "Atom", "value": "0x0000c072" } ], "repeated": 0, "id": 9547 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000024b0" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000024b0" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 9548 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5809fb6a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b0" } ], "repeated": 0, "id": 9549 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff57fc2897", "parentcaller": "0x7fff5809fb7b", "category": "synchronization", "api": "NtDeleteAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "Atom", "value": "0x0000c072" } ], "repeated": 0, "id": 9550 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff57fc2755", "parentcaller": "0x7fff57fc2699", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "-\\x00%\\x00D\\x004\\x00#\\x00!\\x00`\\x00`\\x00`\\x00`\\x00`\\x00J\\x00D\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x000\\x008\\x00$\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00" }, { "name": "Size", "value": "64" }, { "name": "Atom", "value": "0x0000c07d" } ], "repeated": 0, "id": 9551 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000024a8" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000024b0" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 9552 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000024b0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9553 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff5807d567", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 9554 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000024b0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9555 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5807d5a3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b0" } ], "repeated": 0, "id": 9556 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff58c2c942", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 9557 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff57fc2755", "parentcaller": "0x7fff57fc2699", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "-\\x00%\\x00D\\x004\\x00#\\x00!\\x00`\\x00`\\x00`\\x00`\\x00`\\x00J\\x00D\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x000\\x008\\x00$\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00" }, { "name": "Size", "value": "64" }, { "name": "Atom", "value": "0x0000c07d" } ], "repeated": 0, "id": 9558 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000024a8" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000024a8" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 9559 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5809fb6a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024a8" } ], "repeated": 0, "id": 9560 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff57fc2897", "parentcaller": "0x7fff5809fb7b", "category": "synchronization", "api": "NtDeleteAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "Atom", "value": "0x0000c07d" } ], "repeated": 0, "id": 9561 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff57fc2755", "parentcaller": "0x7fff57fc2699", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "-\\x00%\\x00D\\x004\\x00#\\x00!\\x00`\\x00`\\x00`\\x00`\\x00`\\x008\\x00D\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x000\\x008\\x00$\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00" }, { "name": "Size", "value": "64" }, { "name": "Atom", "value": "0x0000c06d" } ], "repeated": 0, "id": 9562 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002460" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000024a8" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 9563 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000024a8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9564 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff5807d567", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 9565 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000024a8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9566 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5807d5a3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024a8" } ], "repeated": 0, "id": 9567 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff58c2c942", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 9568 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff57fc2755", "parentcaller": "0x7fff57fc2699", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "-\\x00%\\x00D\\x004\\x00#\\x00!\\x00`\\x00`\\x00`\\x00`\\x00`\\x008\\x00D\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x000\\x008\\x00$\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00" }, { "name": "Size", "value": "64" }, { "name": "Atom", "value": "0x0000c06d" } ], "repeated": 0, "id": 9569 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002460" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002460" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 9570 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5809fb6a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002460" } ], "repeated": 0, "id": 9571 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff57fc2897", "parentcaller": "0x7fff5809fb7b", "category": "synchronization", "api": "NtDeleteAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "Atom", "value": "0x0000c06d" } ], "repeated": 0, "id": 9572 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff57fc2755", "parentcaller": "0x7fff57fc2699", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "-\\x00%\\x00D\\x004\\x00#\\x00!\\x00`\\x00`\\x00`\\x00`\\x00`\\x00Y\\x00A\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x000\\x008\\x00$\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00" }, { "name": "Size", "value": "64" }, { "name": "Atom", "value": "0x0000c066" } ], "repeated": 0, "id": 9573 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000021e4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002460" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 9574 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002460" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "SectionOffset", "value": "0x0779f1f0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9575 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff5807d567", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 9576 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002460" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "SectionOffset", "value": "0x0779f1f0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9577 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5807d5a3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002460" } ], "repeated": 0, "id": 9578 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff5584a889", "parentcaller": "0x7fff55854528", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}" }, { "name": "Handle", "value": "0x00002462" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}" } ], "repeated": 0, "id": 9579 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002462" }, { "name": "ValueName", "value": "SortOrderIndex" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\SortOrderIndex" } ], "repeated": 0, "id": 9580 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff5585457e", "parentcaller": "0x7fff55853dab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002462" } ], "repeated": 0, "id": 9581 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff558548a0", "parentcaller": "0x7fff558545a7", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}" } ], "repeated": 0, "id": 9582 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff558548a0", "parentcaller": "0x7fff558545bf", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}" } ], "repeated": 0, "id": 9583 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff58c914d4", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 9584 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff57fc2755", "parentcaller": "0x7fff57fc2699", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "-\\x00%\\x00D\\x004\\x00#\\x00!\\x00`\\x00`\\x00`\\x00`\\x00`\\x00Y\\x00A\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x000\\x008\\x00$\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00" }, { "name": "Size", "value": "64" }, { "name": "Atom", "value": "0x0000c066" } ], "repeated": 0, "id": 9585 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000021e4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000021e4" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 9586 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5809fb6a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000021e4" } ], "repeated": 0, "id": 9587 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff57fc2897", "parentcaller": "0x7fff5809fb7b", "category": "synchronization", "api": "NtDeleteAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "Atom", "value": "0x0000c066" } ], "repeated": 0, "id": 9588 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff57fc2755", "parentcaller": "0x7fff57fc2699", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "-\\x00%\\x00D\\x004\\x00#\\x00!\\x00`\\x00`\\x00`\\x00`\\x00`\\x00&\\x00E\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x000\\x008\\x00$\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00" }, { "name": "Size", "value": "64" }, { "name": "Atom", "value": "0x0000c08a" } ], "repeated": 0, "id": 9589 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002518" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000021e4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 9590 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000021e4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "SectionOffset", "value": "0x0779f1f0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9591 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff5807d567", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 9592 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000021e4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "SectionOffset", "value": "0x0779f1f0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9593 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5807d5a3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000021e4" } ], "repeated": 0, "id": 9594 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff5584a889", "parentcaller": "0x7fff55854528", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}" }, { "name": "Handle", "value": "0x000021e6" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}" } ], "repeated": 0, "id": 9595 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000021e6" }, { "name": "ValueName", "value": "SortOrderIndex" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\SortOrderIndex" } ], "repeated": 0, "id": 9596 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff5585457e", "parentcaller": "0x7fff55853dab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000021e6" } ], "repeated": 0, "id": 9597 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff558548a0", "parentcaller": "0x7fff558545a7", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}" } ], "repeated": 0, "id": 9598 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff558548a0", "parentcaller": "0x7fff558545bf", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}" } ], "repeated": 0, "id": 9599 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff58c914d4", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 9600 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff57fc2755", "parentcaller": "0x7fff57fc2699", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "-\\x00%\\x00D\\x004\\x00#\\x00!\\x00`\\x00`\\x00`\\x00`\\x00`\\x00&\\x00E\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x000\\x008\\x00$\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00" }, { "name": "Size", "value": "64" }, { "name": "Atom", "value": "0x0000c08a" } ], "repeated": 0, "id": 9601 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002518" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002518" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 9602 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5809fb6a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002518" } ], "repeated": 0, "id": 9603 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff57fc2897", "parentcaller": "0x7fff5809fb7b", "category": "synchronization", "api": "NtDeleteAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "Atom", "value": "0x0000c08a" } ], "repeated": 0, "id": 9604 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff57fc2755", "parentcaller": "0x7fff57fc2699", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "-\\x00%\\x00D\\x004\\x00#\\x00!\\x00`\\x00`\\x00`\\x00`\\x00`\\x00.\\x00E\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x000\\x008\\x00$\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00" }, { "name": "Size", "value": "64" }, { "name": "Atom", "value": "0x0000c08b" } ], "repeated": 0, "id": 9605 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002538" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002518" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 9606 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002518" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "SectionOffset", "value": "0x0779f1f0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9607 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff5807d567", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 9608 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002518" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "SectionOffset", "value": "0x0779f1f0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9609 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5807d5a3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002518" } ], "repeated": 0, "id": 9610 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff5584a889", "parentcaller": "0x7fff55854528", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}" }, { "name": "Handle", "value": "0x0000251a" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}" } ], "repeated": 0, "id": 9611 }, { "timestamp": "2026-05-29 01:05:24,758", "thread_id": "4720", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000251a" }, { "name": "ValueName", "value": "SortOrderIndex" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\SortOrderIndex" } ], "repeated": 0, "id": 9612 }, { "timestamp": "2026-05-29 01:05:24,774", "thread_id": "4720", "caller": "0x7fff5585457e", "parentcaller": "0x7fff55853dab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000251a" } ], "repeated": 0, "id": 9613 }, { "timestamp": "2026-05-29 01:05:24,774", "thread_id": "4720", "caller": "0x7fff558548a0", "parentcaller": "0x7fff558545a7", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}" } ], "repeated": 0, "id": 9614 }, { "timestamp": "2026-05-29 01:05:24,774", "thread_id": "4720", "caller": "0x7fff558548a0", "parentcaller": "0x7fff558545bf", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}" } ], "repeated": 0, "id": 9615 }, { "timestamp": "2026-05-29 01:05:24,774", "thread_id": "4720", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff58c914d4", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 9616 }, { "timestamp": "2026-05-29 01:05:24,774", "thread_id": "4720", "caller": "0x7fff57fc2755", "parentcaller": "0x7fff57fc2699", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "-\\x00%\\x00D\\x004\\x00#\\x00!\\x00`\\x00`\\x00`\\x00`\\x00`\\x00.\\x00E\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x000\\x008\\x00$\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00" }, { "name": "Size", "value": "64" }, { "name": "Atom", "value": "0x0000c08b" } ], "repeated": 0, "id": 9617 }, { "timestamp": "2026-05-29 01:05:24,774", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002538" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002538" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 9618 }, { "timestamp": "2026-05-29 01:05:24,774", "thread_id": "4720", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5809fb6a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002538" } ], "repeated": 0, "id": 9619 }, { "timestamp": "2026-05-29 01:05:24,774", "thread_id": "4720", "caller": "0x7fff57fc2897", "parentcaller": "0x7fff5809fb7b", "category": "synchronization", "api": "NtDeleteAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "Atom", "value": "0x0000c08b" } ], "repeated": 0, "id": 9620 }, { "timestamp": "2026-05-29 01:05:24,774", "thread_id": "4720", "caller": "0x7fff57fc2755", "parentcaller": "0x7fff57fc2699", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "-\\x00%\\x00D\\x004\\x00#\\x00!\\x00`\\x00`\\x00`\\x00`\\x00`\\x007\\x00D\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x000\\x008\\x00$\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00" }, { "name": "Size", "value": "64" }, { "name": "Atom", "value": "0x0000c071" } ], "repeated": 0, "id": 9621 }, { "timestamp": "2026-05-29 01:05:24,774", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000245c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002538" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 9622 }, { "timestamp": "2026-05-29 01:05:24,774", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002538" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9623 }, { "timestamp": "2026-05-29 01:05:24,774", "thread_id": "4720", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff5807d567", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 9624 }, { "timestamp": "2026-05-29 01:05:24,774", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002538" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9625 }, { "timestamp": "2026-05-29 01:05:24,774", "thread_id": "4720", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5807d5a3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002538" } ], "repeated": 0, "id": 9626 }, { "timestamp": "2026-05-29 01:05:24,774", "thread_id": "4720", "caller": "0x7fff58c83991", "parentcaller": "0x7fff58c29e7d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 3, "id": 9627 }, { "timestamp": "2026-05-29 01:05:24,774", "thread_id": "4720", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff58c2c942", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 9628 }, { "timestamp": "2026-05-29 01:05:24,774", "thread_id": "4720", "caller": "0x7fff57fc2755", "parentcaller": "0x7fff57fc2699", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "-\\x00%\\x00D\\x004\\x00#\\x00!\\x00`\\x00`\\x00`\\x00`\\x00`\\x007\\x00D\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x000\\x008\\x00$\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00" }, { "name": "Size", "value": "64" }, { "name": "Atom", "value": "0x0000c071" } ], "repeated": 0, "id": 9629 }, { "timestamp": "2026-05-29 01:05:24,774", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000245c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000245c" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 9630 }, { "timestamp": "2026-05-29 01:05:24,774", "thread_id": "4720", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5809fb6a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000245c" } ], "repeated": 0, "id": 9631 }, { "timestamp": "2026-05-29 01:05:24,774", "thread_id": "4720", "caller": "0x7fff57fc2897", "parentcaller": "0x7fff5809fb7b", "category": "synchronization", "api": "NtDeleteAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "Atom", "value": "0x0000c071" } ], "repeated": 0, "id": 9632 }, { "timestamp": "2026-05-29 01:05:24,774", "thread_id": "4720", "caller": "0x7fff57fc2755", "parentcaller": "0x7fff57fc2699", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "-\\x00%\\x00D\\x004\\x00#\\x00!\\x00`\\x00`\\x00`\\x00`\\x00`\\x00?\\x00D\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x000\\x008\\x00$\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00" }, { "name": "Size", "value": "64" }, { "name": "Atom", "value": "0x0000c08b" } ], "repeated": 0, "id": 9633 }, { "timestamp": "2026-05-29 01:05:24,774", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000247c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000245c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 9634 }, { "timestamp": "2026-05-29 01:05:24,774", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000245c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9635 }, { "timestamp": "2026-05-29 01:05:24,774", "thread_id": "4720", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff5807d567", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 9636 }, { "timestamp": "2026-05-29 01:05:24,774", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000245c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9637 }, { "timestamp": "2026-05-29 01:05:24,774", "thread_id": "4720", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5807d5a3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000245c" } ], "repeated": 0, "id": 9638 }, { "timestamp": "2026-05-29 01:05:24,774", "thread_id": "4720", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff58c2c942", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 9639 }, { "timestamp": "2026-05-29 01:05:24,774", "thread_id": "4720", "caller": "0x7fff57fc2755", "parentcaller": "0x7fff57fc2699", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "-\\x00%\\x00D\\x004\\x00#\\x00!\\x00`\\x00`\\x00`\\x00`\\x00`\\x00?\\x00D\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x000\\x008\\x00$\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00" }, { "name": "Size", "value": "64" }, { "name": "Atom", "value": "0x0000c08b" } ], "repeated": 0, "id": 9640 }, { "timestamp": "2026-05-29 01:05:24,774", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000247c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000247c" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 9641 }, { "timestamp": "2026-05-29 01:05:24,774", "thread_id": "4720", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5809fb6a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000247c" } ], "repeated": 0, "id": 9642 }, { "timestamp": "2026-05-29 01:05:24,774", "thread_id": "4720", "caller": "0x7fff57fc2897", "parentcaller": "0x7fff5809fb7b", "category": "synchronization", "api": "NtDeleteAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "Atom", "value": "0x0000c08b" } ], "repeated": 0, "id": 9643 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff57fc2755", "parentcaller": "0x7fff57fc2699", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "-\\x00%\\x00D\\x004\\x00#\\x00!\\x00`\\x00`\\x00`\\x00`\\x00`\\x00?\\x00D\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x000\\x008\\x00$\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00" }, { "name": "Size", "value": "64" }, { "name": "Atom", "value": "0x0000c083" } ], "repeated": 0, "id": 9644 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000247c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000245c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 9645 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000245c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "SectionOffset", "value": "0x0779f1f0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9646 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff5807d567", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 9647 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000245c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "SectionOffset", "value": "0x0779f1f0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9648 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5807d5a3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000245c" } ], "repeated": 0, "id": 9649 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff5584a889", "parentcaller": "0x7fff55854528", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}" }, { "name": "Handle", "value": "0x0000245e" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}" } ], "repeated": 0, "id": 9650 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000245e" }, { "name": "ValueName", "value": "SortOrderIndex" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\SortOrderIndex" } ], "repeated": 0, "id": 9651 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff5585457e", "parentcaller": "0x7fff55853dab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000245e" } ], "repeated": 0, "id": 9652 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff558548a0", "parentcaller": "0x7fff558545a7", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}" } ], "repeated": 0, "id": 9653 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff558548a0", "parentcaller": "0x7fff558545bf", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}" } ], "repeated": 0, "id": 9654 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff58c914d4", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 9655 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff57fc2755", "parentcaller": "0x7fff57fc2699", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "-\\x00%\\x00D\\x004\\x00#\\x00!\\x00`\\x00`\\x00`\\x00`\\x00`\\x00?\\x00D\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x000\\x008\\x00$\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00" }, { "name": "Size", "value": "64" }, { "name": "Atom", "value": "0x0000c083" } ], "repeated": 0, "id": 9656 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000247c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000247c" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 9657 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5809fb6a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000247c" } ], "repeated": 0, "id": 9658 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff57fc2897", "parentcaller": "0x7fff5809fb7b", "category": "synchronization", "api": "NtDeleteAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "Atom", "value": "0x0000c083" } ], "repeated": 0, "id": 9659 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff57fc2755", "parentcaller": "0x7fff57fc2699", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "-\\x00%\\x00D\\x004\\x00#\\x00!\\x00`\\x00`\\x00`\\x00`\\x00`\\x00F\\x00D\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x000\\x008\\x00$\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00" }, { "name": "Size", "value": "64" }, { "name": "Atom", "value": "0x0000c082" } ], "repeated": 0, "id": 9660 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002498" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000016a8" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 9661 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000016a8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "SectionOffset", "value": "0x0779f1f0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9662 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff5807d567", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 9663 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000016a8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "SectionOffset", "value": "0x0779f1f0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9664 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5807d5a3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000016a8" } ], "repeated": 0, "id": 9665 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff5584a889", "parentcaller": "0x7fff55854528", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}" }, { "name": "Handle", "value": "0x000016aa" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}" } ], "repeated": 0, "id": 9666 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000016aa" }, { "name": "ValueName", "value": "SortOrderIndex" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\SortOrderIndex" } ], "repeated": 0, "id": 9667 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff5585457e", "parentcaller": "0x7fff55853dab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000016aa" } ], "repeated": 0, "id": 9668 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff558548a0", "parentcaller": "0x7fff558545a7", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}" } ], "repeated": 0, "id": 9669 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff558548a0", "parentcaller": "0x7fff558545bf", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}" } ], "repeated": 0, "id": 9670 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff58c914d4", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 9671 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff57fc2755", "parentcaller": "0x7fff57fc2699", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "-\\x00%\\x00D\\x004\\x00#\\x00!\\x00`\\x00`\\x00`\\x00`\\x00`\\x00F\\x00D\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x000\\x008\\x00$\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00" }, { "name": "Size", "value": "64" }, { "name": "Atom", "value": "0x0000c082" } ], "repeated": 0, "id": 9672 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002498" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002498" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 9673 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5809fb6a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002498" } ], "repeated": 0, "id": 9674 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff57fc2897", "parentcaller": "0x7fff5809fb7b", "category": "synchronization", "api": "NtDeleteAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "Atom", "value": "0x0000c082" } ], "repeated": 0, "id": 9675 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff57fc2755", "parentcaller": "0x7fff57fc2699", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "-\\x00%\\x00D\\x004\\x00#\\x00!\\x00`\\x00`\\x00`\\x00`\\x00`\\x00F\\x00D\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x000\\x008\\x00$\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00" }, { "name": "Size", "value": "64" }, { "name": "Atom", "value": "0x0000c082" } ], "repeated": 0, "id": 9676 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002498" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000016a8" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 9677 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000016a8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "SectionOffset", "value": "0x0779f1f0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9678 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff5807d567", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 9679 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000016a8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "SectionOffset", "value": "0x0779f1f0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9680 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5807d5a3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000016a8" } ], "repeated": 0, "id": 9681 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff5584a889", "parentcaller": "0x7fff55854528", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}" }, { "name": "Handle", "value": "0x000016aa" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}" } ], "repeated": 0, "id": 9682 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000016aa" }, { "name": "ValueName", "value": "SortOrderIndex" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\SortOrderIndex" } ], "repeated": 0, "id": 9683 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff5585457e", "parentcaller": "0x7fff55853dab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000016aa" } ], "repeated": 0, "id": 9684 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff558548a0", "parentcaller": "0x7fff558545a7", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}" } ], "repeated": 0, "id": 9685 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff558548a0", "parentcaller": "0x7fff558545bf", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}" } ], "repeated": 0, "id": 9686 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff58c914d4", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 9687 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff57fc2755", "parentcaller": "0x7fff57fc2699", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "-\\x00%\\x00D\\x004\\x00#\\x00!\\x00`\\x00`\\x00`\\x00`\\x00`\\x00F\\x00D\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x000\\x008\\x00$\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00" }, { "name": "Size", "value": "64" }, { "name": "Atom", "value": "0x0000c082" } ], "repeated": 0, "id": 9688 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002498" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002498" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 9689 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5809fb6a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002498" } ], "repeated": 0, "id": 9690 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff57fc2897", "parentcaller": "0x7fff5809fb7b", "category": "synchronization", "api": "NtDeleteAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "Atom", "value": "0x0000c082" } ], "repeated": 0, "id": 9691 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff57fc2755", "parentcaller": "0x7fff57fc2699", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "-\\x00%\\x00D\\x004\\x00#\\x00!\\x00`\\x00`\\x00`\\x00`\\x00`\\x00N\\x00D\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x000\\x008\\x00$\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00" }, { "name": "Size", "value": "64" }, { "name": "Atom", "value": "0x0000c08c" } ], "repeated": 0, "id": 9692 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000024b8" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002498" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 9693 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002498" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9694 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff5807d567", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 9695 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002498" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9696 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5807d5a3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002498" } ], "repeated": 0, "id": 9697 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff58c2c942", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 9698 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff57fc2755", "parentcaller": "0x7fff57fc2699", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "-\\x00%\\x00D\\x004\\x00#\\x00!\\x00`\\x00`\\x00`\\x00`\\x00`\\x00N\\x00D\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x000\\x008\\x00$\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00" }, { "name": "Size", "value": "64" }, { "name": "Atom", "value": "0x0000c08c" } ], "repeated": 0, "id": 9699 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000024b8" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000024b8" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 9700 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5809fb6a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b8" } ], "repeated": 0, "id": 9701 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff57fc2897", "parentcaller": "0x7fff5809fb7b", "category": "synchronization", "api": "NtDeleteAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "Atom", "value": "0x0000c08c" } ], "repeated": 0, "id": 9702 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff57fc2755", "parentcaller": "0x7fff57fc2699", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "-\\x00%\\x00D\\x004\\x00#\\x00!\\x00`\\x00`\\x00`\\x00`\\x00`\\x00!\\x00E\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x000\\x008\\x00$\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00" }, { "name": "Size", "value": "64" }, { "name": "Atom", "value": "0x0000c08d" } ], "repeated": 0, "id": 9703 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002504" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000247c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 9704 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000247c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9705 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff5807d567", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 9706 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000247c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9707 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5807d5a3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000247c" } ], "repeated": 0, "id": 9708 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff58c2c942", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 9709 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff57fc2755", "parentcaller": "0x7fff57fc2699", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "-\\x00%\\x00D\\x004\\x00#\\x00!\\x00`\\x00`\\x00`\\x00`\\x00`\\x00!\\x00E\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x000\\x008\\x00$\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00" }, { "name": "Size", "value": "64" }, { "name": "Atom", "value": "0x0000c08d" } ], "repeated": 0, "id": 9710 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002504" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002504" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 9711 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5809fb6a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002504" } ], "repeated": 0, "id": 9712 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff57fc2897", "parentcaller": "0x7fff5809fb7b", "category": "synchronization", "api": "NtDeleteAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "Atom", "value": "0x0000c08d" } ], "repeated": 0, "id": 9713 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff57fc2755", "parentcaller": "0x7fff57fc2699", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "-\\x00%\\x00D\\x004\\x00#\\x00!\\x00`\\x00`\\x00`\\x00`\\x00`\\x00J\\x006\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x000\\x008\\x00$\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00" }, { "name": "Size", "value": "64" }, { "name": "Atom", "value": "0x0000c082" } ], "repeated": 0, "id": 9714 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000016a8" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002504" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 9715 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002504" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9716 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff5807d567", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 9717 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002504" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9718 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5807d5a3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002504" } ], "repeated": 0, "id": 9719 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff58c2c942", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 9720 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff57fc2755", "parentcaller": "0x7fff57fc2699", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "-\\x00%\\x00D\\x004\\x00#\\x00!\\x00`\\x00`\\x00`\\x00`\\x00`\\x00J\\x006\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x000\\x008\\x00$\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00" }, { "name": "Size", "value": "64" }, { "name": "Atom", "value": "0x0000c082" } ], "repeated": 0, "id": 9721 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000016a8" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000016a8" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 9722 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5809fb6a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000016a8" } ], "repeated": 0, "id": 9723 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff57fc2897", "parentcaller": "0x7fff5809fb7b", "category": "synchronization", "api": "NtDeleteAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "Atom", "value": "0x0000c082" } ], "repeated": 0, "id": 9724 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff57fc2755", "parentcaller": "0x7fff57fc2699", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "-\\x00%\\x00D\\x004\\x00#\\x00!\\x00`\\x00`\\x00`\\x00`\\x00`\\x00B\\x000\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x000\\x008\\x00$\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00" }, { "name": "Size", "value": "64" }, { "name": "Atom", "value": "0x0000c08c" } ], "repeated": 0, "id": 9725 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001088" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000016a8" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 9726 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000016a8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9727 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff5807d567", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 9728 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000016a8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9729 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5807d5a3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000016a8" } ], "repeated": 0, "id": 9730 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff58c2c942", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 9731 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff57fc2755", "parentcaller": "0x7fff57fc2699", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "-\\x00%\\x00D\\x004\\x00#\\x00!\\x00`\\x00`\\x00`\\x00`\\x00`\\x00B\\x000\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x000\\x008\\x00$\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00" }, { "name": "Size", "value": "64" }, { "name": "Atom", "value": "0x0000c08c" } ], "repeated": 0, "id": 9732 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001088" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001088" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 9733 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5809fb6a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001088" } ], "repeated": 0, "id": 9734 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff57fc2897", "parentcaller": "0x7fff5809fb7b", "category": "synchronization", "api": "NtDeleteAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "Atom", "value": "0x0000c08c" } ], "repeated": 0, "id": 9735 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff57fc2755", "parentcaller": "0x7fff57fc2699", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "-\\x00%\\x00D\\x004\\x00#\\x00!\\x00`\\x00`\\x00`\\x00`\\x00`\\x00R\\x00D\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x000\\x008\\x00$\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00" }, { "name": "Size", "value": "64" }, { "name": "Atom", "value": "0x0000c08d" } ], "repeated": 0, "id": 9736 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000024c8" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001088" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 9737 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001088" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9738 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff5807d567", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 9739 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001088" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9740 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5807d5a3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001088" } ], "repeated": 0, "id": 9741 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff58c2c942", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 9742 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff57fc2755", "parentcaller": "0x7fff57fc2699", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "-\\x00%\\x00D\\x004\\x00#\\x00!\\x00`\\x00`\\x00`\\x00`\\x00`\\x00R\\x00D\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x000\\x008\\x00$\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00" }, { "name": "Size", "value": "64" }, { "name": "Atom", "value": "0x0000c08d" } ], "repeated": 0, "id": 9743 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000024c8" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000024c8" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 9744 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5809fb6a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024c8" } ], "repeated": 0, "id": 9745 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff57fc2897", "parentcaller": "0x7fff5809fb7b", "category": "synchronization", "api": "NtDeleteAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "Atom", "value": "0x0000c08d" } ], "repeated": 0, "id": 9746 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff57fc2755", "parentcaller": "0x7fff57fc2699", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "-\\x00%\\x00D\\x004\\x00#\\x00!\\x00`\\x00`\\x00`\\x00`\\x00`\\x00)\\x00D\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x000\\x008\\x00$\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00" }, { "name": "Size", "value": "64" }, { "name": "Atom", "value": "0x0000c083" } ], "repeated": 0, "id": 9747 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002424" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000024c8" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 9748 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000024c8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9749 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff5807d567", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 9750 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000024c8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9751 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5807d5a3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024c8" } ], "repeated": 0, "id": 9752 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff58c2c942", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 9753 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff57fc2755", "parentcaller": "0x7fff57fc2699", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "-\\x00%\\x00D\\x004\\x00#\\x00!\\x00`\\x00`\\x00`\\x00`\\x00`\\x00)\\x00D\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x000\\x008\\x00$\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00" }, { "name": "Size", "value": "64" }, { "name": "Atom", "value": "0x0000c083" } ], "repeated": 0, "id": 9754 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002424" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002424" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 9755 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5809fb6a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002424" } ], "repeated": 0, "id": 9756 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff57fc2897", "parentcaller": "0x7fff5809fb7b", "category": "synchronization", "api": "NtDeleteAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "Atom", "value": "0x0000c083" } ], "repeated": 0, "id": 9757 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff57fc2755", "parentcaller": "0x7fff57fc2699", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "-\\x00%\\x00D\\x004\\x00#\\x00!\\x00`\\x00`\\x00`\\x00`\\x00`\\x00#\\x00C\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x000\\x008\\x00$\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00" }, { "name": "Size", "value": "64" }, { "name": "Atom", "value": "0x0000c082" } ], "repeated": 0, "id": 9758 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000230c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002424" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 9759 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002424" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9760 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff5807d567", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 9761 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002424" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9762 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5807d5a3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002424" } ], "repeated": 0, "id": 9763 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff58c2c942", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 9764 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff57fc2755", "parentcaller": "0x7fff57fc2699", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "-\\x00%\\x00D\\x004\\x00#\\x00!\\x00`\\x00`\\x00`\\x00`\\x00`\\x00#\\x00C\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x000\\x008\\x00$\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00" }, { "name": "Size", "value": "64" }, { "name": "Atom", "value": "0x0000c082" } ], "repeated": 0, "id": 9765 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000230c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000230c" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 9766 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5809fb6a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000230c" } ], "repeated": 0, "id": 9767 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff57fc2897", "parentcaller": "0x7fff5809fb7b", "category": "synchronization", "api": "NtDeleteAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "Atom", "value": "0x0000c082" } ], "repeated": 0, "id": 9768 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff57fc2755", "parentcaller": "0x7fff57fc2699", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "-\\x00%\\x00D\\x004\\x00#\\x00!\\x00`\\x00`\\x00`\\x00`\\x00`\\x006\\x00@\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x000\\x008\\x00$\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00" }, { "name": "Size", "value": "64" }, { "name": "Atom", "value": "0x0000c08b" } ], "repeated": 0, "id": 9769 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002058" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000230c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 9770 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000230c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9771 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff5807d567", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 9772 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000230c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9773 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5807d5a3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000230c" } ], "repeated": 0, "id": 9774 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff58c2c942", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 9775 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff57fc2755", "parentcaller": "0x7fff57fc2699", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "-\\x00%\\x00D\\x004\\x00#\\x00!\\x00`\\x00`\\x00`\\x00`\\x00`\\x006\\x00@\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x000\\x008\\x00$\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00" }, { "name": "Size", "value": "64" }, { "name": "Atom", "value": "0x0000c08b" } ], "repeated": 0, "id": 9776 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002058" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002058" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 9777 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5809fb6a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002058" } ], "repeated": 0, "id": 9778 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff57fc2897", "parentcaller": "0x7fff5809fb7b", "category": "synchronization", "api": "NtDeleteAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "Atom", "value": "0x0000c08b" } ], "repeated": 0, "id": 9779 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff57fc2755", "parentcaller": "0x7fff57fc2699", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "-\\x00%\\x00D\\x004\\x00#\\x00!\\x00`\\x00`\\x00`\\x00`\\x00`\\x00>\\x00B\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x000\\x008\\x00$\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00" }, { "name": "Size", "value": "64" }, { "name": "Atom", "value": "0x0000c08c" } ], "repeated": 0, "id": 9780 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002278" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002058" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 9781 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002058" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9782 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff5807d567", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 9783 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002058" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9784 }, { "timestamp": "2026-05-29 01:05:24,790", "thread_id": "4720", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5807d5a3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002058" } ], "repeated": 0, "id": 9785 }, { "timestamp": "2026-05-29 01:05:24,805", "thread_id": "4720", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff58c2c942", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 9786 }, { "timestamp": "2026-05-29 01:05:24,805", "thread_id": "4720", "caller": "0x7fff57fc2755", "parentcaller": "0x7fff57fc2699", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "-\\x00%\\x00D\\x004\\x00#\\x00!\\x00`\\x00`\\x00`\\x00`\\x00`\\x00>\\x00B\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x000\\x008\\x00$\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00" }, { "name": "Size", "value": "64" }, { "name": "Atom", "value": "0x0000c08c" } ], "repeated": 0, "id": 9787 }, { "timestamp": "2026-05-29 01:05:24,805", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002278" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002278" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 9788 }, { "timestamp": "2026-05-29 01:05:24,821", "thread_id": "4720", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5809fb6a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002278" } ], "repeated": 0, "id": 9789 }, { "timestamp": "2026-05-29 01:05:24,821", "thread_id": "4720", "caller": "0x7fff57fc2897", "parentcaller": "0x7fff5809fb7b", "category": "synchronization", "api": "NtDeleteAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "Atom", "value": "0x0000c08c" } ], "repeated": 0, "id": 9790 }, { "timestamp": "2026-05-29 01:05:24,821", "thread_id": "4720", "caller": "0x7fff57fc2755", "parentcaller": "0x7fff57fc2699", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "-\\x00%\\x00D\\x004\\x00#\\x00!\\x00`\\x00`\\x00`\\x00`\\x00`\\x00@\\x00E\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x000\\x008\\x00$\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00" }, { "name": "Size", "value": "64" }, { "name": "Atom", "value": "0x0000c071" } ], "repeated": 0, "id": 9791 }, { "timestamp": "2026-05-29 01:05:24,821", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002580" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002278" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 9792 }, { "timestamp": "2026-05-29 01:05:24,821", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002278" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9793 }, { "timestamp": "2026-05-29 01:05:24,821", "thread_id": "4720", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff5807d567", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 9794 }, { "timestamp": "2026-05-29 01:05:24,821", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002278" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9795 }, { "timestamp": "2026-05-29 01:05:24,821", "thread_id": "4720", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5807d5a3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002278" } ], "repeated": 0, "id": 9796 }, { "timestamp": "2026-05-29 01:05:24,821", "thread_id": "4720", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff58c2c942", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 9797 }, { "timestamp": "2026-05-29 01:05:24,821", "thread_id": "4720", "caller": "0x7fff57fc2755", "parentcaller": "0x7fff57fc2699", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "-\\x00%\\x00D\\x004\\x00#\\x00!\\x00`\\x00`\\x00`\\x00`\\x00`\\x00@\\x00E\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x000\\x008\\x00$\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00" }, { "name": "Size", "value": "64" }, { "name": "Atom", "value": "0x0000c071" } ], "repeated": 0, "id": 9798 }, { "timestamp": "2026-05-29 01:05:24,821", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002580" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002580" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 9799 }, { "timestamp": "2026-05-29 01:05:24,821", "thread_id": "4720", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5809fb6a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002580" } ], "repeated": 0, "id": 9800 }, { "timestamp": "2026-05-29 01:05:24,821", "thread_id": "4720", "caller": "0x7fff57fc2897", "parentcaller": "0x7fff5809fb7b", "category": "synchronization", "api": "NtDeleteAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "Atom", "value": "0x0000c071" } ], "repeated": 0, "id": 9801 }, { "timestamp": "2026-05-29 01:05:24,821", "thread_id": "4720", "caller": "0x7fff57fc2755", "parentcaller": "0x7fff57fc2699", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "-\\x00%\\x00D\\x004\\x00#\\x00!\\x00`\\x00`\\x00`\\x00`\\x00`\\x00A\\x00E\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x000\\x008\\x00$\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00" }, { "name": "Size", "value": "64" }, { "name": "Atom", "value": "0x0000c08d" } ], "repeated": 0, "id": 9802 }, { "timestamp": "2026-05-29 01:05:24,821", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002584" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002580" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 9803 }, { "timestamp": "2026-05-29 01:05:24,821", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002580" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9804 }, { "timestamp": "2026-05-29 01:05:24,821", "thread_id": "4720", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff5807d567", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 9805 }, { "timestamp": "2026-05-29 01:05:24,821", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002580" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9806 }, { "timestamp": "2026-05-29 01:05:24,821", "thread_id": "4720", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5807d5a3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002580" } ], "repeated": 0, "id": 9807 }, { "timestamp": "2026-05-29 01:05:24,821", "thread_id": "4720", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff58c2c942", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 9808 }, { "timestamp": "2026-05-29 01:05:24,821", "thread_id": "4720", "caller": "0x7fff57fc2755", "parentcaller": "0x7fff57fc2699", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "-\\x00%\\x00D\\x004\\x00#\\x00!\\x00`\\x00`\\x00`\\x00`\\x00`\\x00A\\x00E\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x000\\x008\\x00$\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00" }, { "name": "Size", "value": "64" }, { "name": "Atom", "value": "0x0000c08d" } ], "repeated": 0, "id": 9809 }, { "timestamp": "2026-05-29 01:05:24,821", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002584" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002584" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 9810 }, { "timestamp": "2026-05-29 01:05:24,821", "thread_id": "4720", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5809fb6a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002584" } ], "repeated": 0, "id": 9811 }, { "timestamp": "2026-05-29 01:05:24,821", "thread_id": "4720", "caller": "0x7fff57fc2897", "parentcaller": "0x7fff5809fb7b", "category": "synchronization", "api": "NtDeleteAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "Atom", "value": "0x0000c08d" } ], "repeated": 0, "id": 9812 }, { "timestamp": "2026-05-29 01:05:24,821", "thread_id": "4720", "caller": "0x7fff57fc2755", "parentcaller": "0x7fff57fc2699", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "-\\x00%\\x00D\\x004\\x00#\\x00!\\x00`\\x00`\\x00`\\x00`\\x00`\\x00B\\x00E\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x000\\x008\\x00$\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00" }, { "name": "Size", "value": "64" }, { "name": "Atom", "value": "0x0000c08a" } ], "repeated": 0, "id": 9813 }, { "timestamp": "2026-05-29 01:05:24,821", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002588" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002584" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 9814 }, { "timestamp": "2026-05-29 01:05:24,821", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002584" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9815 }, { "timestamp": "2026-05-29 01:05:24,821", "thread_id": "4720", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff5807d567", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 9816 }, { "timestamp": "2026-05-29 01:05:24,821", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002584" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9817 }, { "timestamp": "2026-05-29 01:05:24,821", "thread_id": "4720", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5807d5a3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002584" } ], "repeated": 0, "id": 9818 }, { "timestamp": "2026-05-29 01:05:24,821", "thread_id": "4720", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff58c2c942", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 9819 }, { "timestamp": "2026-05-29 01:05:24,821", "thread_id": "4720", "caller": "0x7fff57fc2755", "parentcaller": "0x7fff57fc2699", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "-\\x00%\\x00D\\x004\\x00#\\x00!\\x00`\\x00`\\x00`\\x00`\\x00`\\x00B\\x00E\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x000\\x008\\x00$\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00" }, { "name": "Size", "value": "64" }, { "name": "Atom", "value": "0x0000c08a" } ], "repeated": 0, "id": 9820 }, { "timestamp": "2026-05-29 01:05:24,821", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002588" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002588" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 9821 }, { "timestamp": "2026-05-29 01:05:24,821", "thread_id": "4720", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5809fb6a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002588" } ], "repeated": 0, "id": 9822 }, { "timestamp": "2026-05-29 01:05:24,821", "thread_id": "4720", "caller": "0x7fff57fc2897", "parentcaller": "0x7fff5809fb7b", "category": "synchronization", "api": "NtDeleteAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "Atom", "value": "0x0000c08a" } ], "repeated": 0, "id": 9823 }, { "timestamp": "2026-05-29 01:05:24,821", "thread_id": "4720", "caller": "0x7fff57fc2755", "parentcaller": "0x7fff57fc2699", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "-\\x00%\\x00D\\x004\\x00#\\x00!\\x00`\\x00`\\x00`\\x00`\\x00`\\x00C\\x00E\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x000\\x008\\x00$\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00" }, { "name": "Size", "value": "64" }, { "name": "Atom", "value": "0x0000c066" } ], "repeated": 0, "id": 9824 }, { "timestamp": "2026-05-29 01:05:24,821", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000258c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002588" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 9825 }, { "timestamp": "2026-05-29 01:05:24,821", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002588" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "SectionOffset", "value": "0x0779f1f0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9826 }, { "timestamp": "2026-05-29 01:05:24,821", "thread_id": "4720", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff5807d567", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 9827 }, { "timestamp": "2026-05-29 01:05:24,821", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002588" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "SectionOffset", "value": "0x0779f1f0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9828 }, { "timestamp": "2026-05-29 01:05:24,821", "thread_id": "4720", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5807d5a3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002588" } ], "repeated": 0, "id": 9829 }, { "timestamp": "2026-05-29 01:05:24,821", "thread_id": "4720", "caller": "0x7fff5584a889", "parentcaller": "0x7fff55854528", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}" }, { "name": "Handle", "value": "0x0000258a" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}" } ], "repeated": 0, "id": 9830 }, { "timestamp": "2026-05-29 01:05:24,821", "thread_id": "4720", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000258a" }, { "name": "ValueName", "value": "SortOrderIndex" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\SortOrderIndex" } ], "repeated": 0, "id": 9831 }, { "timestamp": "2026-05-29 01:05:24,821", "thread_id": "4720", "caller": "0x7fff5585457e", "parentcaller": "0x7fff55853dab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000258a" } ], "repeated": 0, "id": 9832 }, { "timestamp": "2026-05-29 01:05:24,821", "thread_id": "4720", "caller": "0x7fff558548a0", "parentcaller": "0x7fff558545a7", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}" } ], "repeated": 0, "id": 9833 }, { "timestamp": "2026-05-29 01:05:24,821", "thread_id": "4720", "caller": "0x7fff558548a0", "parentcaller": "0x7fff558545bf", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}" } ], "repeated": 0, "id": 9834 }, { "timestamp": "2026-05-29 01:05:24,821", "thread_id": "4720", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff58c914d4", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 9835 }, { "timestamp": "2026-05-29 01:05:24,821", "thread_id": "4720", "caller": "0x7fff57fc2755", "parentcaller": "0x7fff57fc2699", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "-\\x00%\\x00D\\x004\\x00#\\x00!\\x00`\\x00`\\x00`\\x00`\\x00`\\x00C\\x00E\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x000\\x008\\x00$\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00" }, { "name": "Size", "value": "64" }, { "name": "Atom", "value": "0x0000c066" } ], "repeated": 0, "id": 9836 }, { "timestamp": "2026-05-29 01:05:24,821", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000258c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000258c" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 9837 }, { "timestamp": "2026-05-29 01:05:24,821", "thread_id": "4720", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5809fb6a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000258c" } ], "repeated": 0, "id": 9838 }, { "timestamp": "2026-05-29 01:05:24,821", "thread_id": "4720", "caller": "0x7fff57fc2897", "parentcaller": "0x7fff5809fb7b", "category": "synchronization", "api": "NtDeleteAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "Atom", "value": "0x0000c066" } ], "repeated": 0, "id": 9839 }, { "timestamp": "2026-05-29 01:05:24,821", "thread_id": "4720", "caller": "0x7fff57fc2755", "parentcaller": "0x7fff57fc2699", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "-\\x00%\\x00D\\x004\\x00#\\x00!\\x00`\\x00`\\x00`\\x00`\\x00`\\x00D\\x00E\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x000\\x008\\x00$\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00" }, { "name": "Size", "value": "64" }, { "name": "Atom", "value": "0x0000c08c" } ], "repeated": 0, "id": 9840 }, { "timestamp": "2026-05-29 01:05:24,821", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002590" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002058" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 9841 }, { "timestamp": "2026-05-29 01:05:24,821", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002058" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "SectionOffset", "value": "0x0779f1f0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9842 }, { "timestamp": "2026-05-29 01:05:24,821", "thread_id": "4720", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff5807d567", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 9843 }, { "timestamp": "2026-05-29 01:05:24,821", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002058" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "SectionOffset", "value": "0x0779f1f0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9844 }, { "timestamp": "2026-05-29 01:05:24,821", "thread_id": "4720", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5807d5a3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002058" } ], "repeated": 0, "id": 9845 }, { "timestamp": "2026-05-29 01:05:24,837", "thread_id": "4720", "caller": "0x7fff5584a889", "parentcaller": "0x7fff55854528", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}" }, { "name": "Handle", "value": "0x0000205a" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}" } ], "repeated": 0, "id": 9846 }, { "timestamp": "2026-05-29 01:05:24,837", "thread_id": "4720", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000205a" }, { "name": "ValueName", "value": "SortOrderIndex" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\SortOrderIndex" } ], "repeated": 0, "id": 9847 }, { "timestamp": "2026-05-29 01:05:24,837", "thread_id": "4720", "caller": "0x7fff5585457e", "parentcaller": "0x7fff55853dab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000205a" } ], "repeated": 0, "id": 9848 }, { "timestamp": "2026-05-29 01:05:24,837", "thread_id": "4720", "caller": "0x7fff558548a0", "parentcaller": "0x7fff558545a7", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}" } ], "repeated": 0, "id": 9849 }, { "timestamp": "2026-05-29 01:05:24,837", "thread_id": "4720", "caller": "0x7fff558548a0", "parentcaller": "0x7fff558545bf", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}" } ], "repeated": 0, "id": 9850 }, { "timestamp": "2026-05-29 01:05:24,837", "thread_id": "4720", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff58c914d4", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 9851 }, { "timestamp": "2026-05-29 01:05:24,837", "thread_id": "4720", "caller": "0x7fff57fc2755", "parentcaller": "0x7fff57fc2699", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "-\\x00%\\x00D\\x004\\x00#\\x00!\\x00`\\x00`\\x00`\\x00`\\x00`\\x00D\\x00E\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x000\\x008\\x00$\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00" }, { "name": "Size", "value": "64" }, { "name": "Atom", "value": "0x0000c08c" } ], "repeated": 0, "id": 9852 }, { "timestamp": "2026-05-29 01:05:24,837", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002590" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002590" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 9853 }, { "timestamp": "2026-05-29 01:05:24,837", "thread_id": "4720", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5809fb6a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002590" } ], "repeated": 0, "id": 9854 }, { "timestamp": "2026-05-29 01:05:24,837", "thread_id": "4720", "caller": "0x7fff57fc2897", "parentcaller": "0x7fff5809fb7b", "category": "synchronization", "api": "NtDeleteAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "Atom", "value": "0x0000c08c" } ], "repeated": 0, "id": 9855 }, { "timestamp": "2026-05-29 01:05:24,837", "thread_id": "4720", "caller": "0x7fff57fc2755", "parentcaller": "0x7fff57fc2699", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "-\\x00%\\x00D\\x004\\x00#\\x00!\\x00`\\x00`\\x00`\\x00`\\x00`\\x00E\\x00E\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x000\\x008\\x00$\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00" }, { "name": "Size", "value": "64" }, { "name": "Atom", "value": "0x0000c08c" } ], "repeated": 0, "id": 9856 }, { "timestamp": "2026-05-29 01:05:24,837", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002594" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000258c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 9857 }, { "timestamp": "2026-05-29 01:05:24,837", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000258c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "SectionOffset", "value": "0x0779f1f0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9858 }, { "timestamp": "2026-05-29 01:05:24,837", "thread_id": "4720", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff5807d567", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 9859 }, { "timestamp": "2026-05-29 01:05:24,837", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000258c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "SectionOffset", "value": "0x0779f1f0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9860 }, { "timestamp": "2026-05-29 01:05:24,837", "thread_id": "4720", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5807d5a3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000258c" } ], "repeated": 0, "id": 9861 }, { "timestamp": "2026-05-29 01:05:24,837", "thread_id": "4720", "caller": "0x7fff5584a889", "parentcaller": "0x7fff55854528", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}" }, { "name": "Handle", "value": "0x0000258e" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}" } ], "repeated": 0, "id": 9862 }, { "timestamp": "2026-05-29 01:05:24,837", "thread_id": "4720", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000258e" }, { "name": "ValueName", "value": "SortOrderIndex" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\SortOrderIndex" } ], "repeated": 0, "id": 9863 }, { "timestamp": "2026-05-29 01:05:24,837", "thread_id": "4720", "caller": "0x7fff5585457e", "parentcaller": "0x7fff55853dab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000258e" } ], "repeated": 0, "id": 9864 }, { "timestamp": "2026-05-29 01:05:24,837", "thread_id": "4720", "caller": "0x7fff558548a0", "parentcaller": "0x7fff558545a7", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}" } ], "repeated": 0, "id": 9865 }, { "timestamp": "2026-05-29 01:05:24,837", "thread_id": "4720", "caller": "0x7fff558548a0", "parentcaller": "0x7fff558545bf", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}" } ], "repeated": 0, "id": 9866 }, { "timestamp": "2026-05-29 01:05:24,837", "thread_id": "4720", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff58c914d4", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 9867 }, { "timestamp": "2026-05-29 01:05:24,837", "thread_id": "4720", "caller": "0x7fff57fc2755", "parentcaller": "0x7fff57fc2699", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "-\\x00%\\x00D\\x004\\x00#\\x00!\\x00`\\x00`\\x00`\\x00`\\x00`\\x00E\\x00E\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x000\\x008\\x00$\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00" }, { "name": "Size", "value": "64" }, { "name": "Atom", "value": "0x0000c08c" } ], "repeated": 0, "id": 9868 }, { "timestamp": "2026-05-29 01:05:24,837", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002594" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002594" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 9869 }, { "timestamp": "2026-05-29 01:05:24,837", "thread_id": "4720", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5809fb6a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002594" } ], "repeated": 0, "id": 9870 }, { "timestamp": "2026-05-29 01:05:24,837", "thread_id": "4720", "caller": "0x7fff57fc2897", "parentcaller": "0x7fff5809fb7b", "category": "synchronization", "api": "NtDeleteAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "Atom", "value": "0x0000c08c" } ], "repeated": 0, "id": 9871 }, { "timestamp": "2026-05-29 01:05:24,837", "thread_id": "4720", "caller": "0x7fff57fc2755", "parentcaller": "0x7fff57fc2699", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "-\\x00%\\x00D\\x004\\x00#\\x00!\\x00`\\x00`\\x00`\\x00`\\x00`\\x00F\\x00E\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x000\\x008\\x00$\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00" }, { "name": "Size", "value": "64" }, { "name": "Atom", "value": "0x0000c08b" } ], "repeated": 0, "id": 9872 }, { "timestamp": "2026-05-29 01:05:24,837", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002598" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002590" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 9873 }, { "timestamp": "2026-05-29 01:05:24,837", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002590" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9874 }, { "timestamp": "2026-05-29 01:05:24,837", "thread_id": "4720", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff5807d567", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 9875 }, { "timestamp": "2026-05-29 01:05:24,837", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002590" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9876 }, { "timestamp": "2026-05-29 01:05:24,837", "thread_id": "4720", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5807d5a3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002590" } ], "repeated": 0, "id": 9877 }, { "timestamp": "2026-05-29 01:05:24,837", "thread_id": "4720", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff58c2c942", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 9878 }, { "timestamp": "2026-05-29 01:05:24,837", "thread_id": "4720", "caller": "0x7fff57fc2755", "parentcaller": "0x7fff57fc2699", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "-\\x00%\\x00D\\x004\\x00#\\x00!\\x00`\\x00`\\x00`\\x00`\\x00`\\x00F\\x00E\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x000\\x008\\x00$\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00" }, { "name": "Size", "value": "64" }, { "name": "Atom", "value": "0x0000c08b" } ], "repeated": 0, "id": 9879 }, { "timestamp": "2026-05-29 01:05:24,837", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002598" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002598" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 9880 }, { "timestamp": "2026-05-29 01:05:24,837", "thread_id": "4720", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5809fb6a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002598" } ], "repeated": 0, "id": 9881 }, { "timestamp": "2026-05-29 01:05:24,837", "thread_id": "4720", "caller": "0x7fff57fc2897", "parentcaller": "0x7fff5809fb7b", "category": "synchronization", "api": "NtDeleteAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "Atom", "value": "0x0000c08b" } ], "repeated": 0, "id": 9882 }, { "timestamp": "2026-05-29 01:05:24,837", "thread_id": "4720", "caller": "0x7fff57fc2755", "parentcaller": "0x7fff57fc2699", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "-\\x00%\\x00D\\x004\\x00#\\x00!\\x00`\\x00`\\x00`\\x00`\\x00`\\x00G\\x00E\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x000\\x008\\x00$\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00" }, { "name": "Size", "value": "64" }, { "name": "Atom", "value": "0x0000c082" } ], "repeated": 0, "id": 9883 }, { "timestamp": "2026-05-29 01:05:24,837", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000259c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002598" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 9884 }, { "timestamp": "2026-05-29 01:05:24,837", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002598" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9885 }, { "timestamp": "2026-05-29 01:05:24,837", "thread_id": "4720", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff5807d567", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 9886 }, { "timestamp": "2026-05-29 01:05:24,837", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002598" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9887 }, { "timestamp": "2026-05-29 01:05:24,837", "thread_id": "4720", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5807d5a3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002598" } ], "repeated": 0, "id": 9888 }, { "timestamp": "2026-05-29 01:05:24,837", "thread_id": "4720", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff58c2c942", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 9889 }, { "timestamp": "2026-05-29 01:05:24,837", "thread_id": "4720", "caller": "0x7fff57fc2755", "parentcaller": "0x7fff57fc2699", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "-\\x00%\\x00D\\x004\\x00#\\x00!\\x00`\\x00`\\x00`\\x00`\\x00`\\x00G\\x00E\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x000\\x008\\x00$\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00" }, { "name": "Size", "value": "64" }, { "name": "Atom", "value": "0x0000c082" } ], "repeated": 0, "id": 9890 }, { "timestamp": "2026-05-29 01:05:24,837", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000259c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000259c" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 9891 }, { "timestamp": "2026-05-29 01:05:24,837", "thread_id": "4720", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5809fb6a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000259c" } ], "repeated": 0, "id": 9892 }, { "timestamp": "2026-05-29 01:05:24,837", "thread_id": "4720", "caller": "0x7fff57fc2897", "parentcaller": "0x7fff5809fb7b", "category": "synchronization", "api": "NtDeleteAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "Atom", "value": "0x0000c082" } ], "repeated": 0, "id": 9893 }, { "timestamp": "2026-05-29 01:05:25,055", "thread_id": "4500", "caller": "0x7ff79bcd3bb4", "parentcaller": "0x00000000", "category": "registry", "api": "RegNotifyChangeKeyValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\" }, { "name": "NotifyFilter", "value": "0x10000005" }, { "name": "WatchSubtree", "value": "1" }, { "name": "Asynchronous", "value": "1" } ], "repeated": 1, "id": 9894 }, { "timestamp": "2026-05-29 01:05:25,055", "thread_id": "4500", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd15e8a", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 9895 }, { "timestamp": "2026-05-29 01:05:25,055", "thread_id": "4500", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd15e8a", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 9896 }, { "timestamp": "2026-05-29 01:05:25,055", "thread_id": "4504", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd15e8a", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 9897 }, { "timestamp": "2026-05-29 01:05:25,055", "thread_id": "4500", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd15e8a", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002594" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search" } ], "repeated": 0, "id": 9898 }, { "timestamp": "2026-05-29 01:05:25,055", "thread_id": "4504", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd15e8a", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 9899 }, { "timestamp": "2026-05-29 01:05:25,055", "thread_id": "4500", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd15e8a", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002594" }, { "name": "ValueName", "value": "BackgroundAppGlobalToggle" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\BackgroundAppGlobalToggle" } ], "repeated": 0, "id": 9900 }, { "timestamp": "2026-05-29 01:05:25,055", "thread_id": "4500", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd15e8a", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002594" } ], "repeated": 0, "id": 9901 }, { "timestamp": "2026-05-29 01:05:25,055", "thread_id": "4504", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd15e8a", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000258c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search" } ], "repeated": 0, "id": 9902 }, { "timestamp": "2026-05-29 01:05:25,055", "thread_id": "4504", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd15e8a", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000258c" }, { "name": "ValueName", "value": "BackgroundAppGlobalToggle" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\BackgroundAppGlobalToggle" } ], "repeated": 0, "id": 9903 }, { "timestamp": "2026-05-29 01:05:25,055", "thread_id": "4504", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd15e8a", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000258c" } ], "repeated": 0, "id": 9904 }, { "timestamp": "2026-05-29 01:05:25,133", "thread_id": "4696", "caller": "0x7ff79bc76bd8", "parentcaller": "0x7ff79bc8a0c8", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00010110" }, { "name": "Message", "value": "0x0000c028" } ], "repeated": 0, "id": 9905 }, { "timestamp": "2026-05-29 01:05:25,133", "thread_id": "5000", "caller": "0x7fff5855dd9d", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002588" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000430" }, { "name": "ObjectAttributesName", "value": "Windows.Internal.Shell.TaskFlow.DataEngine.AppViewTitleChangeData" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Shell.TaskFlow.DataEngine.AppViewTitleChangeData" } ], "repeated": 0, "id": 9906 }, { "timestamp": "2026-05-29 01:05:25,133", "thread_id": "5000", "caller": "0x7fff5855ddf7", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002588" }, { "name": "KeyInformation", "value": "7_\\xffea\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00\\xff82\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00I\\x00n\\x00t\\x00e\\x00r\\x00n\\x00a\\x00l\\x00.\\x00S\\x00h\\x00e\\x00l\\x00l\\x00.\\x00T\\x00a\\x00s\\x00k\\x00F\\x00l\\x00o\\x00w\\x00.\\x00D\\x00a\\x00t\\x00a\\x00E\\x00n\\x00g\\x00i\\x00n\\x00e\\x00.\\x00A\\x00p\\x00p\\x00V\\x00i\\x00e\\x00w\\x00T\\x00i\\x00t\\x00l\\x00e\\x00C\\x00h\\x00a\\x00n\\x00g\\x00e\\x00D\\x00a\\x00t\\x00a\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xff8c%\\x01\\x00\\x00\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\xffc4\\x02%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\r%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0EzX\\xffff\\x7f\\x00\\x00\\xfff8\\x1fp\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff0\\xffec\\x19\\x08\\x00\\x00\\x00\\x00\\xff87\\xff9dNX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00v\\xffca\\x0b\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\x1fp\\x0c\\x00\\x00\\x00\\x00\\x00v\\xffca\\x0b\\x00\\x00\\x00\\x00\\xff90_\\xffc8\\x0b\\x00\\x00\\x00\\x00\\xffc7\\xffb3\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\xfff6sNX\\xffff\\x7f\\x00\\x00\\xff90\\xfff7\\xffa7\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xff90_\\xffc8\\x0b\\x00\\x00\\x00\\x00P\\xfff2\\xffaa\\x0c\\x00\\x00\\x00\\x00P\\xfff2\\xffaa\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00v\\xffca\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x006\\xff8cYX\\xffff\\x7f\\x00\\x00 \\x15\\xff85\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffe0\\xffed\\x19\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffe0\\xffed\\x19\\x08\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 9907 }, { "timestamp": "2026-05-29 01:05:25,133", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002588" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Shell.TaskFlow.DataEngine.AppViewTitleChangeData\\ActivationType" } ], "repeated": 0, "id": 9908 }, { "timestamp": "2026-05-29 01:05:25,133", "thread_id": "5000", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002588" }, { "name": "ValueName", "value": "Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Shell.TaskFlow.DataEngine.AppViewTitleChangeData\\Server" } ], "repeated": 0, "id": 9909 }, { "timestamp": "2026-05-29 01:05:25,133", "thread_id": "5000", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff585700bb", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002588" }, { "name": "ValueName", "value": "DllPath" }, { "name": "Data", "value": "C:\\Windows\\System32\\TaskFlowDataEngine.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Shell.TaskFlow.DataEngine.AppViewTitleChangeData\\DllPath" } ], "repeated": 0, "id": 9910 }, { "timestamp": "2026-05-29 01:05:25,133", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002588" }, { "name": "ValueName", "value": "Threading" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Shell.TaskFlow.DataEngine.AppViewTitleChangeData\\Threading" } ], "repeated": 0, "id": 9911 }, { "timestamp": "2026-05-29 01:05:25,133", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002588" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Shell.TaskFlow.DataEngine.AppViewTitleChangeData\\TrustLevel" } ], "repeated": 0, "id": 9912 }, { "timestamp": "2026-05-29 01:05:25,133", "thread_id": "5000", "caller": "0x7fff584bc0fc", "parentcaller": "0x7fff58554170", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00002588" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Shell.TaskFlow.DataEngine.AppViewTitleChangeData\\CustomAttributes" } ], "repeated": 0, "id": 9913 }, { "timestamp": "2026-05-29 01:05:25,133", "thread_id": "5000", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002588" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Shell.TaskFlow.DataEngine.AppViewTitleChangeData\\RemoteServer" } ], "repeated": 0, "id": 9914 }, { "timestamp": "2026-05-29 01:05:25,133", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002588" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Shell.TaskFlow.DataEngine.AppViewTitleChangeData\\ActivateAsUser" } ], "repeated": 0, "id": 9915 }, { "timestamp": "2026-05-29 01:05:25,133", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002588" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Shell.TaskFlow.DataEngine.AppViewTitleChangeData\\ActivateInSharedBroker" } ], "repeated": 0, "id": 9916 }, { "timestamp": "2026-05-29 01:05:25,133", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002588" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Shell.TaskFlow.DataEngine.AppViewTitleChangeData\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 9917 }, { "timestamp": "2026-05-29 01:05:25,133", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58562222", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002588" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Shell.TaskFlow.DataEngine.AppViewTitleChangeData\\Permissions" } ], "repeated": 0, "id": 9918 }, { "timestamp": "2026-05-29 01:05:25,133", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002588" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Shell.TaskFlow.DataEngine.AppViewTitleChangeData\\ActivateOnHostFlags" } ], "repeated": 0, "id": 9919 }, { "timestamp": "2026-05-29 01:05:25,133", "thread_id": "5000", "caller": "0x7fff58557226", "parentcaller": "0x7fff5855ca23", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002588" } ], "repeated": 0, "id": 9920 }, { "timestamp": "2026-05-29 01:05:25,133", "thread_id": "5000", "caller": "0x7fff425702f3", "parentcaller": "0x7fff42570634", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9921 }, { "timestamp": "2026-05-29 01:05:25,133", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 9922 }, { "timestamp": "2026-05-29 01:05:25,133", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 9923 }, { "timestamp": "2026-05-29 01:05:25,133", "thread_id": "6252", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 9924 }, { "timestamp": "2026-05-29 01:05:25,133", "thread_id": "4620", "caller": "0x7fff40c74428", "parentcaller": "0x7fff40c73a03", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "F0AE1542-F497-484B-A175-A20DB09144BA" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "8DC24A1A-6314-4769-9D68-179786F4CED6" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 9925 }, { "timestamp": "2026-05-29 01:05:25,133", "thread_id": "4620", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00020072" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 1, "id": 9926 }, { "timestamp": "2026-05-29 01:05:25,133", "thread_id": "6252", "caller": "0x7fff557c9e99", "parentcaller": "0x7fff557c779f", "category": "filesystem", "api": "CreateDirectoryW", "status": false, "return": "0x00000000", "arguments": [ { "name": "DirectoryName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations" } ], "repeated": 0, "id": 9927 }, { "timestamp": "2026-05-29 01:05:25,133", "thread_id": "6252", "caller": "0x7fff577d07f5", "parentcaller": "0x7fff577cc03b", "category": "filesystem", "api": "NtQueryAttributesFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\590aee7bdd69b59b.automaticDestinations-ms" } ], "repeated": 0, "id": 9928 }, { "timestamp": "2026-05-29 01:05:25,133", "thread_id": "4620", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00020072" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 2, "id": 9929 }, { "timestamp": "2026-05-29 01:05:25,133", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 9930 }, { "timestamp": "2026-05-29 01:05:25,243", "thread_id": "4696", "caller": "0x7ff79bc91360", "parentcaller": "0x7ff79bc5d2c3", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9931 }, { "timestamp": "2026-05-29 01:05:25,243", "thread_id": "4696", "caller": "0x7ff79bc7a06e", "parentcaller": "0x7ff79bc78f2b", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 9932 }, { "timestamp": "2026-05-29 01:05:25,243", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc78f2b", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "CLSID\\{56AD4C5D-B908-4F85-8FF1-7940C29B3BCF}\\Instance" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\CLSID\\{56AD4C5D-B908-4F85-8FF1-7940C29B3BCF}\\Instance" } ], "repeated": 0, "id": 9933 }, { "timestamp": "2026-05-29 01:05:25,243", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc78f2b", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 9934 }, { "timestamp": "2026-05-29 01:05:25,243", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc78f2b", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff58be0000", "arguments": [ { "name": "lpLibFileName", "value": "shell32.dll" }, { "name": "dwFlags", "value": "0x00004000" } ], "repeated": 0, "id": 9935 }, { "timestamp": "2026-05-29 01:05:25,243", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc78f2b", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "SHELL32.dll" }, { "name": "ModuleHandle", "value": "0x7fff58be0000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff58c378f0" } ], "repeated": 0, "id": 9936 }, { "timestamp": "2026-05-29 01:05:25,243", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc78f2b", "category": "synchronization", "api": "NtFindAtom", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "AtomName", "value": "{9F4C2855-9F79-4B39-A8D0-E1D42DE1D5F3} 3" }, { "name": "Atom", "value": "0x00000000" } ], "repeated": 0, "id": 9937 }, { "timestamp": "2026-05-29 01:05:25,243", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc68e6a", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 2, "id": 9938 }, { "timestamp": "2026-05-29 01:05:25,243", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xe2\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x005\\x18\\xff\\x7f\\x00\\x00(\\xe3\\\\x03\\x00\\x00\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 9939 }, { "timestamp": "2026-05-29 01:05:25,243", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000259c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 9940 }, { "timestamp": "2026-05-29 01:05:25,243", "thread_id": "4696", "caller": "0x7ff79bc8a418", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000259c" } ], "repeated": 0, "id": 9941 }, { "timestamp": "2026-05-29 01:05:25,243", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc68e6a", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 2, "id": 9942 }, { "timestamp": "2026-05-29 01:05:25,243", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xe2\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x005\\x18\\xff\\x7f\\x00\\x00(\\xe3\\\\x03\\x00\\x00\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 9943 }, { "timestamp": "2026-05-29 01:05:25,243", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000259c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 9944 }, { "timestamp": "2026-05-29 01:05:25,243", "thread_id": "4696", "caller": "0x7ff79bc8a418", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000259c" } ], "repeated": 0, "id": 9945 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588f616", "parentcaller": "0x7fff5588bf43", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "Handle", "value": "0x0000258c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 9946 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bf7f", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000258c" }, { "name": "SubKey", "value": "{528c102f-0000-0000-0000-300300000000}\\" }, { "name": "Handle", "value": "0x000025a0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\" } ], "repeated": 0, "id": 9947 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bfa7", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000258c" } ], "repeated": 0, "id": 9948 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025a0" }, { "name": "ValueName", "value": "Generation" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation" } ], "repeated": 0, "id": 9949 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bfeb", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025a0" } ], "repeated": 0, "id": 9950 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff557b4361", "parentcaller": "0x7fff557b3e47", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9951 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588f616", "parentcaller": "0x7fff5588bf43", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "Handle", "value": "0x000025a0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 9952 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bf7f", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000025a0" }, { "name": "SubKey", "value": "{528c102f-0000-0000-0000-300300000000}\\" }, { "name": "Handle", "value": "0x0000258c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\" } ], "repeated": 0, "id": 9953 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bfa7", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025a0" } ], "repeated": 0, "id": 9954 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000258c" }, { "name": "ValueName", "value": "Generation" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation" } ], "repeated": 0, "id": 9955 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bfeb", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000258c" } ], "repeated": 0, "id": 9956 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff577d07f5", "parentcaller": "0x7fff58ac212a", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\" } ], "repeated": 0, "id": 9957 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588f616", "parentcaller": "0x7fff5588bf43", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "Handle", "value": "0x0000258c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 9958 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bf7f", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000258c" }, { "name": "SubKey", "value": "{528c102f-0000-0000-0000-300300000000}\\" }, { "name": "Handle", "value": "0x000025a0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\" } ], "repeated": 0, "id": 9959 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bfa7", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000258c" } ], "repeated": 0, "id": 9960 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025a0" }, { "name": "ValueName", "value": "Generation" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation" } ], "repeated": 0, "id": 9961 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bfeb", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025a0" } ], "repeated": 0, "id": 9962 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff557b4361", "parentcaller": "0x7fff557b3e47", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9963 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588f616", "parentcaller": "0x7fff5588bf43", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "Handle", "value": "0x000025a0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 9964 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bf7f", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000025a0" }, { "name": "SubKey", "value": "{528c102f-0000-0000-0000-300300000000}\\" }, { "name": "Handle", "value": "0x0000258c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\" } ], "repeated": 0, "id": 9965 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bfa7", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025a0" } ], "repeated": 0, "id": 9966 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000258c" }, { "name": "ValueName", "value": "Generation" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation" } ], "repeated": 0, "id": 9967 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bfeb", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000258c" } ], "repeated": 0, "id": 9968 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff577d07f5", "parentcaller": "0x7fff58ac212a", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\" } ], "repeated": 0, "id": 9969 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588f616", "parentcaller": "0x7fff5588bf43", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "Handle", "value": "0x0000258c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 9970 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bf7f", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000258c" }, { "name": "SubKey", "value": "{528c102f-0000-0000-0000-300300000000}\\" }, { "name": "Handle", "value": "0x000025a0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\" } ], "repeated": 0, "id": 9971 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bfa7", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000258c" } ], "repeated": 0, "id": 9972 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025a0" }, { "name": "ValueName", "value": "Generation" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation" } ], "repeated": 0, "id": 9973 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bfeb", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025a0" } ], "repeated": 0, "id": 9974 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff557b4361", "parentcaller": "0x7fff557b3e47", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9975 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588f616", "parentcaller": "0x7fff5588bf43", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "Handle", "value": "0x000025a0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 9976 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bf7f", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000025a0" }, { "name": "SubKey", "value": "{528c102f-0000-0000-0000-300300000000}\\" }, { "name": "Handle", "value": "0x0000258c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\" } ], "repeated": 0, "id": 9977 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bfa7", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025a0" } ], "repeated": 0, "id": 9978 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000258c" }, { "name": "ValueName", "value": "Generation" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation" } ], "repeated": 0, "id": 9979 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bfeb", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000258c" } ], "repeated": 0, "id": 9980 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff577d07f5", "parentcaller": "0x7fff58ac212a", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\" } ], "repeated": 0, "id": 9981 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588f616", "parentcaller": "0x7fff5588bf43", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "Handle", "value": "0x0000258c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 9982 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bf7f", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000258c" }, { "name": "SubKey", "value": "{528c102f-0000-0000-0000-300300000000}\\" }, { "name": "Handle", "value": "0x000025a0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\" } ], "repeated": 0, "id": 9983 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bfa7", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000258c" } ], "repeated": 0, "id": 9984 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025a0" }, { "name": "ValueName", "value": "Generation" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation" } ], "repeated": 0, "id": 9985 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bfeb", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025a0" } ], "repeated": 0, "id": 9986 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff557b4361", "parentcaller": "0x7fff557b3e47", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9987 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588f616", "parentcaller": "0x7fff5588bf43", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "Handle", "value": "0x000025a0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 9988 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bf7f", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000025a0" }, { "name": "SubKey", "value": "{528c102f-0000-0000-0000-300300000000}\\" }, { "name": "Handle", "value": "0x0000258c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\" } ], "repeated": 0, "id": 9989 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bfa7", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025a0" } ], "repeated": 0, "id": 9990 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000258c" }, { "name": "ValueName", "value": "Generation" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation" } ], "repeated": 0, "id": 9991 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bfeb", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000258c" } ], "repeated": 0, "id": 9992 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff577d07f5", "parentcaller": "0x7fff58ac212a", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\" } ], "repeated": 0, "id": 9993 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588f616", "parentcaller": "0x7fff5588bf43", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "Handle", "value": "0x0000258c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 9994 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bf7f", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000258c" }, { "name": "SubKey", "value": "{528c102f-0000-0000-0000-300300000000}\\" }, { "name": "Handle", "value": "0x000025a0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\" } ], "repeated": 0, "id": 9995 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bfa7", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000258c" } ], "repeated": 0, "id": 9996 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025a0" }, { "name": "ValueName", "value": "Generation" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation" } ], "repeated": 0, "id": 9997 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bfeb", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025a0" } ], "repeated": 0, "id": 9998 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff557b4361", "parentcaller": "0x7fff557b3e47", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9999 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588f616", "parentcaller": "0x7fff5588bf43", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "Handle", "value": "0x000025a0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 10000 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bf7f", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000025a0" }, { "name": "SubKey", "value": "{528c102f-0000-0000-0000-300300000000}\\" }, { "name": "Handle", "value": "0x0000258c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\" } ], "repeated": 0, "id": 10001 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bfa7", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025a0" } ], "repeated": 0, "id": 10002 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000258c" }, { "name": "ValueName", "value": "Generation" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation" } ], "repeated": 0, "id": 10003 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bfeb", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000258c" } ], "repeated": 0, "id": 10004 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff577d07f5", "parentcaller": "0x7fff58ac212a", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\" } ], "repeated": 0, "id": 10005 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588f616", "parentcaller": "0x7fff5588bf43", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "Handle", "value": "0x0000258c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 10006 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bf7f", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000258c" }, { "name": "SubKey", "value": "{528c102f-0000-0000-0000-300300000000}\\" }, { "name": "Handle", "value": "0x000025a0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\" } ], "repeated": 0, "id": 10007 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bfa7", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000258c" } ], "repeated": 0, "id": 10008 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025a0" }, { "name": "ValueName", "value": "Generation" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation" } ], "repeated": 0, "id": 10009 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bfeb", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025a0" } ], "repeated": 0, "id": 10010 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff557b4361", "parentcaller": "0x7fff557b3e47", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 10011 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588f616", "parentcaller": "0x7fff5588bf43", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "Handle", "value": "0x000025a0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 10012 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bf7f", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000025a0" }, { "name": "SubKey", "value": "{528c102f-0000-0000-0000-300300000000}\\" }, { "name": "Handle", "value": "0x0000258c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\" } ], "repeated": 0, "id": 10013 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bfa7", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025a0" } ], "repeated": 0, "id": 10014 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000258c" }, { "name": "ValueName", "value": "Generation" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation" } ], "repeated": 0, "id": 10015 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bfeb", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000258c" } ], "repeated": 0, "id": 10016 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff577d07f5", "parentcaller": "0x7fff58ac212a", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\" } ], "repeated": 0, "id": 10017 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588f616", "parentcaller": "0x7fff5588bf43", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "Handle", "value": "0x0000258c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 10018 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bf7f", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000258c" }, { "name": "SubKey", "value": "{528c102f-0000-0000-0000-300300000000}\\" }, { "name": "Handle", "value": "0x000025a0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\" } ], "repeated": 0, "id": 10019 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bfa7", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000258c" } ], "repeated": 0, "id": 10020 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025a0" }, { "name": "ValueName", "value": "Generation" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation" } ], "repeated": 0, "id": 10021 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bfeb", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025a0" } ], "repeated": 0, "id": 10022 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff557b4361", "parentcaller": "0x7fff557b3e47", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 10023 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588f616", "parentcaller": "0x7fff5588bf43", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "Handle", "value": "0x000025a0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 10024 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bf7f", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000025a0" }, { "name": "SubKey", "value": "{528c102f-0000-0000-0000-300300000000}\\" }, { "name": "Handle", "value": "0x0000258c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\" } ], "repeated": 0, "id": 10025 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bfa7", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025a0" } ], "repeated": 0, "id": 10026 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000258c" }, { "name": "ValueName", "value": "Generation" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation" } ], "repeated": 0, "id": 10027 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bfeb", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000258c" } ], "repeated": 0, "id": 10028 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff577d07f5", "parentcaller": "0x7fff58ac212a", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\" } ], "repeated": 0, "id": 10029 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588f616", "parentcaller": "0x7fff5588bf43", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "Handle", "value": "0x0000258c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 10030 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bf7f", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000258c" }, { "name": "SubKey", "value": "{528c102f-0000-0000-0000-300300000000}\\" }, { "name": "Handle", "value": "0x000025a0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\" } ], "repeated": 0, "id": 10031 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bfa7", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000258c" } ], "repeated": 0, "id": 10032 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025a0" }, { "name": "ValueName", "value": "Generation" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation" } ], "repeated": 0, "id": 10033 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bfeb", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025a0" } ], "repeated": 0, "id": 10034 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff557b4361", "parentcaller": "0x7fff557b3e47", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 10035 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588f616", "parentcaller": "0x7fff5588bf43", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "Handle", "value": "0x000025a0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 10036 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bf7f", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000025a0" }, { "name": "SubKey", "value": "{528c102f-0000-0000-0000-300300000000}\\" }, { "name": "Handle", "value": "0x0000258c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\" } ], "repeated": 0, "id": 10037 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bfa7", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025a0" } ], "repeated": 0, "id": 10038 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000258c" }, { "name": "ValueName", "value": "Generation" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation" } ], "repeated": 0, "id": 10039 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bfeb", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000258c" } ], "repeated": 0, "id": 10040 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff577d07f5", "parentcaller": "0x7fff58ac212a", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\" } ], "repeated": 0, "id": 10041 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588f616", "parentcaller": "0x7fff5588bf43", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "Handle", "value": "0x0000258c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 10042 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bf7f", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000258c" }, { "name": "SubKey", "value": "{528c102f-0000-0000-0000-300300000000}\\" }, { "name": "Handle", "value": "0x000025a0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\" } ], "repeated": 0, "id": 10043 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bfa7", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000258c" } ], "repeated": 0, "id": 10044 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025a0" }, { "name": "ValueName", "value": "Generation" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation" } ], "repeated": 0, "id": 10045 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bfeb", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025a0" } ], "repeated": 0, "id": 10046 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff557b4361", "parentcaller": "0x7fff557b3e47", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 10047 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588f616", "parentcaller": "0x7fff5588bf43", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "Handle", "value": "0x000025a0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 10048 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bf7f", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000025a0" }, { "name": "SubKey", "value": "{528c102f-0000-0000-0000-300300000000}\\" }, { "name": "Handle", "value": "0x0000258c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\" } ], "repeated": 0, "id": 10049 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bfa7", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025a0" } ], "repeated": 0, "id": 10050 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000258c" }, { "name": "ValueName", "value": "Generation" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation" } ], "repeated": 0, "id": 10051 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bfeb", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000258c" } ], "repeated": 0, "id": 10052 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff577d07f5", "parentcaller": "0x7fff58ac212a", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\" } ], "repeated": 0, "id": 10053 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588f616", "parentcaller": "0x7fff5588bf43", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "Handle", "value": "0x0000258c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 10054 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bf7f", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000258c" }, { "name": "SubKey", "value": "{528c102f-0000-0000-0000-300300000000}\\" }, { "name": "Handle", "value": "0x000025a0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\" } ], "repeated": 0, "id": 10055 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bfa7", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000258c" } ], "repeated": 0, "id": 10056 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025a0" }, { "name": "ValueName", "value": "Generation" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation" } ], "repeated": 0, "id": 10057 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bfeb", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025a0" } ], "repeated": 0, "id": 10058 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff557b4361", "parentcaller": "0x7fff557b3e47", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 10059 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588f616", "parentcaller": "0x7fff5588bf43", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "Handle", "value": "0x000025a0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 10060 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bf7f", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000025a0" }, { "name": "SubKey", "value": "{528c102f-0000-0000-0000-300300000000}\\" }, { "name": "Handle", "value": "0x0000258c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\" } ], "repeated": 0, "id": 10061 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bfa7", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025a0" } ], "repeated": 0, "id": 10062 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000258c" }, { "name": "ValueName", "value": "Generation" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation" } ], "repeated": 0, "id": 10063 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bfeb", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000258c" } ], "repeated": 0, "id": 10064 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff577d07f5", "parentcaller": "0x7fff58ac212a", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\" } ], "repeated": 0, "id": 10065 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588f616", "parentcaller": "0x7fff5588bf43", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "Handle", "value": "0x0000258c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 10066 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bf7f", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000258c" }, { "name": "SubKey", "value": "{528c102f-0000-0000-0000-300300000000}\\" }, { "name": "Handle", "value": "0x000025a0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\" } ], "repeated": 0, "id": 10067 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bfa7", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000258c" } ], "repeated": 0, "id": 10068 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025a0" }, { "name": "ValueName", "value": "Generation" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation" } ], "repeated": 0, "id": 10069 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bfeb", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025a0" } ], "repeated": 0, "id": 10070 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff557b4361", "parentcaller": "0x7fff557b3e47", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 10071 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588f616", "parentcaller": "0x7fff5588bf43", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "Handle", "value": "0x000025a0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 10072 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bf7f", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000025a0" }, { "name": "SubKey", "value": "{528c102f-0000-0000-0000-300300000000}\\" }, { "name": "Handle", "value": "0x0000258c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\" } ], "repeated": 0, "id": 10073 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bfa7", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025a0" } ], "repeated": 0, "id": 10074 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000258c" }, { "name": "ValueName", "value": "Generation" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation" } ], "repeated": 0, "id": 10075 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bfeb", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000258c" } ], "repeated": 0, "id": 10076 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff577d07f5", "parentcaller": "0x7fff58ac212a", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\" } ], "repeated": 0, "id": 10077 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588f616", "parentcaller": "0x7fff5588bf43", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "Handle", "value": "0x0000258c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 10078 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bf7f", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000258c" }, { "name": "SubKey", "value": "{528c102f-0000-0000-0000-300300000000}\\" }, { "name": "Handle", "value": "0x000025a0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\" } ], "repeated": 0, "id": 10079 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bfa7", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000258c" } ], "repeated": 0, "id": 10080 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025a0" }, { "name": "ValueName", "value": "Generation" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation" } ], "repeated": 0, "id": 10081 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bfeb", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025a0" } ], "repeated": 0, "id": 10082 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff557b4361", "parentcaller": "0x7fff557b3e47", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 10083 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588f616", "parentcaller": "0x7fff5588bf43", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "Handle", "value": "0x000025a0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 10084 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bf7f", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000025a0" }, { "name": "SubKey", "value": "{528c102f-0000-0000-0000-300300000000}\\" }, { "name": "Handle", "value": "0x0000258c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\" } ], "repeated": 0, "id": 10085 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bfa7", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025a0" } ], "repeated": 0, "id": 10086 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000258c" }, { "name": "ValueName", "value": "Generation" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation" } ], "repeated": 0, "id": 10087 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bfeb", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000258c" } ], "repeated": 0, "id": 10088 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff577d07f5", "parentcaller": "0x7fff58ac212a", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\" } ], "repeated": 0, "id": 10089 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588f616", "parentcaller": "0x7fff5588bf43", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "Handle", "value": "0x0000258c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 10090 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bf7f", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000258c" }, { "name": "SubKey", "value": "{528c102f-0000-0000-0000-300300000000}\\" }, { "name": "Handle", "value": "0x000025a0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\" } ], "repeated": 0, "id": 10091 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bfa7", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000258c" } ], "repeated": 0, "id": 10092 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025a0" }, { "name": "ValueName", "value": "Generation" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation" } ], "repeated": 0, "id": 10093 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bfeb", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025a0" } ], "repeated": 0, "id": 10094 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff557b4361", "parentcaller": "0x7fff557b3e47", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 10095 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588f616", "parentcaller": "0x7fff5588bf43", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "Handle", "value": "0x000025a0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 10096 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bf7f", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000025a0" }, { "name": "SubKey", "value": "{528c102f-0000-0000-0000-300300000000}\\" }, { "name": "Handle", "value": "0x0000258c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\" } ], "repeated": 0, "id": 10097 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bfa7", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025a0" } ], "repeated": 0, "id": 10098 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000258c" }, { "name": "ValueName", "value": "Generation" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation" } ], "repeated": 0, "id": 10099 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bfeb", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000258c" } ], "repeated": 0, "id": 10100 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff577d07f5", "parentcaller": "0x7fff58ac212a", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\" } ], "repeated": 0, "id": 10101 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588f616", "parentcaller": "0x7fff5588bf43", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "Handle", "value": "0x0000258c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 10102 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bf7f", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000258c" }, { "name": "SubKey", "value": "{528c102f-0000-0000-0000-300300000000}\\" }, { "name": "Handle", "value": "0x000025a0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\" } ], "repeated": 0, "id": 10103 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bfa7", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000258c" } ], "repeated": 0, "id": 10104 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025a0" }, { "name": "ValueName", "value": "Generation" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation" } ], "repeated": 0, "id": 10105 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bfeb", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025a0" } ], "repeated": 0, "id": 10106 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff557b4361", "parentcaller": "0x7fff557b3e47", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 10107 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588f616", "parentcaller": "0x7fff5588bf43", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "Handle", "value": "0x000025a0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 10108 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bf7f", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000025a0" }, { "name": "SubKey", "value": "{528c102f-0000-0000-0000-300300000000}\\" }, { "name": "Handle", "value": "0x0000258c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\" } ], "repeated": 0, "id": 10109 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bfa7", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025a0" } ], "repeated": 0, "id": 10110 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000258c" }, { "name": "ValueName", "value": "Generation" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation" } ], "repeated": 0, "id": 10111 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bfeb", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000258c" } ], "repeated": 0, "id": 10112 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff577d07f5", "parentcaller": "0x7fff58ac212a", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\" } ], "repeated": 0, "id": 10113 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588f616", "parentcaller": "0x7fff5588bf43", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "Handle", "value": "0x0000258c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 10114 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bf7f", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000258c" }, { "name": "SubKey", "value": "{528c102f-0000-0000-0000-300300000000}\\" }, { "name": "Handle", "value": "0x000025a0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\" } ], "repeated": 0, "id": 10115 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bfa7", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000258c" } ], "repeated": 0, "id": 10116 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025a0" }, { "name": "ValueName", "value": "Generation" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation" } ], "repeated": 0, "id": 10117 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bfeb", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025a0" } ], "repeated": 0, "id": 10118 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff557b4361", "parentcaller": "0x7fff557b3e47", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 10119 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588f616", "parentcaller": "0x7fff5588bf43", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "Handle", "value": "0x000025a0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 10120 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bf7f", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000025a0" }, { "name": "SubKey", "value": "{528c102f-0000-0000-0000-300300000000}\\" }, { "name": "Handle", "value": "0x0000258c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\" } ], "repeated": 0, "id": 10121 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bfa7", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025a0" } ], "repeated": 0, "id": 10122 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000258c" }, { "name": "ValueName", "value": "Generation" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation" } ], "repeated": 0, "id": 10123 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bfeb", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000258c" } ], "repeated": 0, "id": 10124 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff577d07f5", "parentcaller": "0x7fff58ac212a", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\" } ], "repeated": 0, "id": 10125 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588f616", "parentcaller": "0x7fff5588bf43", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "Handle", "value": "0x0000258c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 10126 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bf7f", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000258c" }, { "name": "SubKey", "value": "{528c102f-0000-0000-0000-300300000000}\\" }, { "name": "Handle", "value": "0x000025a0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\" } ], "repeated": 0, "id": 10127 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bfa7", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000258c" } ], "repeated": 0, "id": 10128 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025a0" }, { "name": "ValueName", "value": "Generation" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation" } ], "repeated": 0, "id": 10129 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bfeb", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025a0" } ], "repeated": 0, "id": 10130 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff557b4361", "parentcaller": "0x7fff557b3e47", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 10131 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588f616", "parentcaller": "0x7fff5588bf43", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "Handle", "value": "0x000025a0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 10132 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bf7f", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000025a0" }, { "name": "SubKey", "value": "{528c102f-0000-0000-0000-300300000000}\\" }, { "name": "Handle", "value": "0x0000258c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\" } ], "repeated": 0, "id": 10133 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bfa7", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025a0" } ], "repeated": 0, "id": 10134 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000258c" }, { "name": "ValueName", "value": "Generation" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation" } ], "repeated": 0, "id": 10135 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bfeb", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000258c" } ], "repeated": 0, "id": 10136 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff577d07f5", "parentcaller": "0x7fff58ac212a", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\" } ], "repeated": 0, "id": 10137 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588f616", "parentcaller": "0x7fff5588bf43", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "Handle", "value": "0x0000258c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 10138 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bf7f", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000258c" }, { "name": "SubKey", "value": "{528c102f-0000-0000-0000-300300000000}\\" }, { "name": "Handle", "value": "0x000025a0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\" } ], "repeated": 0, "id": 10139 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bfa7", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000258c" } ], "repeated": 0, "id": 10140 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025a0" }, { "name": "ValueName", "value": "Generation" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation" } ], "repeated": 0, "id": 10141 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bfeb", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025a0" } ], "repeated": 0, "id": 10142 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff557b4361", "parentcaller": "0x7fff557b3e47", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 10143 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588f616", "parentcaller": "0x7fff5588bf43", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "Handle", "value": "0x000025a0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 10144 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bf7f", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000025a0" }, { "name": "SubKey", "value": "{528c102f-0000-0000-0000-300300000000}\\" }, { "name": "Handle", "value": "0x0000258c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\" } ], "repeated": 0, "id": 10145 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bfa7", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025a0" } ], "repeated": 0, "id": 10146 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000258c" }, { "name": "ValueName", "value": "Generation" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation" } ], "repeated": 0, "id": 10147 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bfeb", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000258c" } ], "repeated": 0, "id": 10148 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff577d07f5", "parentcaller": "0x7fff58ac212a", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\" } ], "repeated": 0, "id": 10149 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588f616", "parentcaller": "0x7fff5588bf43", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "Handle", "value": "0x0000258c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 10150 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bf7f", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000258c" }, { "name": "SubKey", "value": "{528c102f-0000-0000-0000-300300000000}\\" }, { "name": "Handle", "value": "0x000025a0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\" } ], "repeated": 0, "id": 10151 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bfa7", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000258c" } ], "repeated": 0, "id": 10152 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025a0" }, { "name": "ValueName", "value": "Generation" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation" } ], "repeated": 0, "id": 10153 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bfeb", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025a0" } ], "repeated": 0, "id": 10154 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff557b4361", "parentcaller": "0x7fff557b3e47", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 10155 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588f616", "parentcaller": "0x7fff5588bf43", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "Handle", "value": "0x000025a0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 10156 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bf7f", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000025a0" }, { "name": "SubKey", "value": "{528c102f-0000-0000-0000-300300000000}\\" }, { "name": "Handle", "value": "0x0000258c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\" } ], "repeated": 0, "id": 10157 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bfa7", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025a0" } ], "repeated": 0, "id": 10158 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000258c" }, { "name": "ValueName", "value": "Generation" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation" } ], "repeated": 0, "id": 10159 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bfeb", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000258c" } ], "repeated": 0, "id": 10160 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff577d07f5", "parentcaller": "0x7fff58ac212a", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\" } ], "repeated": 0, "id": 10161 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588f616", "parentcaller": "0x7fff5588bf43", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "Handle", "value": "0x0000258c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 10162 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bf7f", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000258c" }, { "name": "SubKey", "value": "{528c102f-0000-0000-0000-300300000000}\\" }, { "name": "Handle", "value": "0x000025a0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\" } ], "repeated": 0, "id": 10163 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bfa7", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000258c" } ], "repeated": 0, "id": 10164 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025a0" }, { "name": "ValueName", "value": "Generation" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation" } ], "repeated": 0, "id": 10165 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bfeb", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025a0" } ], "repeated": 0, "id": 10166 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff557b4361", "parentcaller": "0x7fff557b3e47", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 10167 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588f616", "parentcaller": "0x7fff5588bf43", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "Handle", "value": "0x000025a0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 10168 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bf7f", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000025a0" }, { "name": "SubKey", "value": "{528c102f-0000-0000-0000-300300000000}\\" }, { "name": "Handle", "value": "0x0000258c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\" } ], "repeated": 0, "id": 10169 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bfa7", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025a0" } ], "repeated": 0, "id": 10170 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000258c" }, { "name": "ValueName", "value": "Generation" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation" } ], "repeated": 0, "id": 10171 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bfeb", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000258c" } ], "repeated": 0, "id": 10172 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff577d07f5", "parentcaller": "0x7fff58ac212a", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\" } ], "repeated": 0, "id": 10173 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588f616", "parentcaller": "0x7fff5588bf43", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "Handle", "value": "0x0000258c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 10174 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bf7f", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000258c" }, { "name": "SubKey", "value": "{528c102f-0000-0000-0000-300300000000}\\" }, { "name": "Handle", "value": "0x000025a0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\" } ], "repeated": 0, "id": 10175 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bfa7", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000258c" } ], "repeated": 0, "id": 10176 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025a0" }, { "name": "ValueName", "value": "Generation" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation" } ], "repeated": 0, "id": 10177 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bfeb", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025a0" } ], "repeated": 0, "id": 10178 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff557b4361", "parentcaller": "0x7fff557b3e47", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 10179 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588f616", "parentcaller": "0x7fff5588bf43", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "Handle", "value": "0x000025a0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 10180 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bf7f", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000025a0" }, { "name": "SubKey", "value": "{528c102f-0000-0000-0000-300300000000}\\" }, { "name": "Handle", "value": "0x0000258c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\" } ], "repeated": 0, "id": 10181 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bfa7", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025a0" } ], "repeated": 0, "id": 10182 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000258c" }, { "name": "ValueName", "value": "Generation" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation" } ], "repeated": 0, "id": 10183 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bfeb", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000258c" } ], "repeated": 0, "id": 10184 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff577d07f5", "parentcaller": "0x7fff58ac212a", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\" } ], "repeated": 0, "id": 10185 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588f616", "parentcaller": "0x7fff5588bf43", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "Handle", "value": "0x0000258c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 10186 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bf7f", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000258c" }, { "name": "SubKey", "value": "{528c102f-0000-0000-0000-300300000000}\\" }, { "name": "Handle", "value": "0x000025a0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\" } ], "repeated": 0, "id": 10187 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bfa7", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000258c" } ], "repeated": 0, "id": 10188 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025a0" }, { "name": "ValueName", "value": "Generation" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation" } ], "repeated": 0, "id": 10189 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bfeb", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025a0" } ], "repeated": 0, "id": 10190 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff557b4361", "parentcaller": "0x7fff557b3e47", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 10191 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588f616", "parentcaller": "0x7fff5588bf43", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "Handle", "value": "0x000025a0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 10192 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bf7f", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000025a0" }, { "name": "SubKey", "value": "{528c102f-0000-0000-0000-300300000000}\\" }, { "name": "Handle", "value": "0x0000258c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\" } ], "repeated": 0, "id": 10193 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bfa7", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025a0" } ], "repeated": 0, "id": 10194 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000258c" }, { "name": "ValueName", "value": "Generation" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation" } ], "repeated": 0, "id": 10195 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bfeb", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000258c" } ], "repeated": 0, "id": 10196 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff577d07f5", "parentcaller": "0x7fff58ac212a", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\" } ], "repeated": 0, "id": 10197 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588f616", "parentcaller": "0x7fff5588bf43", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "Handle", "value": "0x0000258c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 10198 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bf7f", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000258c" }, { "name": "SubKey", "value": "{528c102f-0000-0000-0000-300300000000}\\" }, { "name": "Handle", "value": "0x000025a0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\" } ], "repeated": 0, "id": 10199 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bfa7", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000258c" } ], "repeated": 0, "id": 10200 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025a0" }, { "name": "ValueName", "value": "Generation" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation" } ], "repeated": 0, "id": 10201 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bfeb", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025a0" } ], "repeated": 0, "id": 10202 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff557b4361", "parentcaller": "0x7fff557b3e47", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 10203 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588f616", "parentcaller": "0x7fff5588bf43", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "Handle", "value": "0x000025a0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 10204 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bf7f", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000025a0" }, { "name": "SubKey", "value": "{528c102f-0000-0000-0000-300300000000}\\" }, { "name": "Handle", "value": "0x0000258c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\" } ], "repeated": 0, "id": 10205 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bfa7", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025a0" } ], "repeated": 0, "id": 10206 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000258c" }, { "name": "ValueName", "value": "Generation" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation" } ], "repeated": 0, "id": 10207 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bfeb", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000258c" } ], "repeated": 0, "id": 10208 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff577d07f5", "parentcaller": "0x7fff58ac212a", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\" } ], "repeated": 0, "id": 10209 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588f616", "parentcaller": "0x7fff5588bf43", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "Handle", "value": "0x0000258c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 10210 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bf7f", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000258c" }, { "name": "SubKey", "value": "{528c102f-0000-0000-0000-300300000000}\\" }, { "name": "Handle", "value": "0x000025a0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\" } ], "repeated": 0, "id": 10211 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5588bfa7", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000258c" } ], "repeated": 0, "id": 10212 }, { "timestamp": "2026-05-29 01:05:25,337", "thread_id": "4720", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025a0" }, { "name": "ValueName", "value": "Generation" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation" } ], "repeated": 0, "id": 10213 }, { "timestamp": "2026-05-29 01:05:25,352", "thread_id": "4720", "caller": "0x7fff5588bfeb", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025a0" } ], "repeated": 0, "id": 10214 }, { "timestamp": "2026-05-29 01:05:25,352", "thread_id": "4720", "caller": "0x7fff557b4361", "parentcaller": "0x7fff557b3e47", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 10215 }, { "timestamp": "2026-05-29 01:05:25,352", "thread_id": "4720", "caller": "0x7fff5588f616", "parentcaller": "0x7fff5588bf43", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "Handle", "value": "0x000025a0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 10216 }, { "timestamp": "2026-05-29 01:05:25,352", "thread_id": "4720", "caller": "0x7fff5588bf7f", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000025a0" }, { "name": "SubKey", "value": "{528c102f-0000-0000-0000-300300000000}\\" }, { "name": "Handle", "value": "0x0000258c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\" } ], "repeated": 0, "id": 10217 }, { "timestamp": "2026-05-29 01:05:25,352", "thread_id": "4720", "caller": "0x7fff5588bfa7", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025a0" } ], "repeated": 0, "id": 10218 }, { "timestamp": "2026-05-29 01:05:25,352", "thread_id": "4720", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000258c" }, { "name": "ValueName", "value": "Generation" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation" } ], "repeated": 0, "id": 10219 }, { "timestamp": "2026-05-29 01:05:25,352", "thread_id": "4720", "caller": "0x7fff5588bfeb", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000258c" } ], "repeated": 0, "id": 10220 }, { "timestamp": "2026-05-29 01:05:25,352", "thread_id": "4720", "caller": "0x7fff577d07f5", "parentcaller": "0x7fff58ac212a", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\" } ], "repeated": 0, "id": 10221 }, { "timestamp": "2026-05-29 01:05:25,352", "thread_id": "4720", "caller": "0x7fff5588f616", "parentcaller": "0x7fff5588bf43", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "Handle", "value": "0x0000258c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 10222 }, { "timestamp": "2026-05-29 01:05:25,352", "thread_id": "4720", "caller": "0x7fff5588bf7f", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000258c" }, { "name": "SubKey", "value": "{528c102f-0000-0000-0000-300300000000}\\" }, { "name": "Handle", "value": "0x000025a0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\" } ], "repeated": 0, "id": 10223 }, { "timestamp": "2026-05-29 01:05:25,352", "thread_id": "4720", "caller": "0x7fff5588bfa7", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000258c" } ], "repeated": 0, "id": 10224 }, { "timestamp": "2026-05-29 01:05:25,352", "thread_id": "4720", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025a0" }, { "name": "ValueName", "value": "Generation" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation" } ], "repeated": 0, "id": 10225 }, { "timestamp": "2026-05-29 01:05:25,352", "thread_id": "4720", "caller": "0x7fff5588bfeb", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025a0" } ], "repeated": 0, "id": 10226 }, { "timestamp": "2026-05-29 01:05:25,352", "thread_id": "4720", "caller": "0x7fff557b4361", "parentcaller": "0x7fff557b3e47", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 10227 }, { "timestamp": "2026-05-29 01:05:25,352", "thread_id": "4720", "caller": "0x7fff5588f616", "parentcaller": "0x7fff5588bf43", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "Handle", "value": "0x000025a0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 10228 }, { "timestamp": "2026-05-29 01:05:25,352", "thread_id": "4720", "caller": "0x7fff5588bf7f", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000025a0" }, { "name": "SubKey", "value": "{528c102f-0000-0000-0000-300300000000}\\" }, { "name": "Handle", "value": "0x0000258c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\" } ], "repeated": 0, "id": 10229 }, { "timestamp": "2026-05-29 01:05:25,352", "thread_id": "4720", "caller": "0x7fff5588bfa7", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025a0" } ], "repeated": 0, "id": 10230 }, { "timestamp": "2026-05-29 01:05:25,352", "thread_id": "4720", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000258c" }, { "name": "ValueName", "value": "Generation" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation" } ], "repeated": 0, "id": 10231 }, { "timestamp": "2026-05-29 01:05:25,352", "thread_id": "4720", "caller": "0x7fff5588bfeb", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000258c" } ], "repeated": 0, "id": 10232 }, { "timestamp": "2026-05-29 01:05:25,352", "thread_id": "4720", "caller": "0x7fff577d07f5", "parentcaller": "0x7fff58ac212a", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\" } ], "repeated": 0, "id": 10233 }, { "timestamp": "2026-05-29 01:05:25,352", "thread_id": "4720", "caller": "0x7fff5588f616", "parentcaller": "0x7fff5588bf43", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "Handle", "value": "0x0000258c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 10234 }, { "timestamp": "2026-05-29 01:05:25,352", "thread_id": "4720", "caller": "0x7fff5588bf7f", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000258c" }, { "name": "SubKey", "value": "{528c102f-0000-0000-0000-300300000000}\\" }, { "name": "Handle", "value": "0x000025a0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\" } ], "repeated": 0, "id": 10235 }, { "timestamp": "2026-05-29 01:05:25,352", "thread_id": "4720", "caller": "0x7fff5588bfa7", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000258c" } ], "repeated": 0, "id": 10236 }, { "timestamp": "2026-05-29 01:05:25,352", "thread_id": "4720", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025a0" }, { "name": "ValueName", "value": "Generation" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation" } ], "repeated": 0, "id": 10237 }, { "timestamp": "2026-05-29 01:05:25,352", "thread_id": "4720", "caller": "0x7fff5588bfeb", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025a0" } ], "repeated": 0, "id": 10238 }, { "timestamp": "2026-05-29 01:05:25,352", "thread_id": "4720", "caller": "0x7fff557b4361", "parentcaller": "0x7fff557b3e47", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 10239 }, { "timestamp": "2026-05-29 01:05:25,352", "thread_id": "4720", "caller": "0x7fff5588f616", "parentcaller": "0x7fff5588bf43", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "Handle", "value": "0x000025a0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 10240 }, { "timestamp": "2026-05-29 01:05:25,352", "thread_id": "4720", "caller": "0x7fff5588bf7f", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000025a0" }, { "name": "SubKey", "value": "{528c102f-0000-0000-0000-300300000000}\\" }, { "name": "Handle", "value": "0x0000258c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\" } ], "repeated": 0, "id": 10241 }, { "timestamp": "2026-05-29 01:05:25,352", "thread_id": "4720", "caller": "0x7fff5588bfa7", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025a0" } ], "repeated": 0, "id": 10242 }, { "timestamp": "2026-05-29 01:05:25,352", "thread_id": "4720", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000258c" }, { "name": "ValueName", "value": "Generation" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation" } ], "repeated": 0, "id": 10243 }, { "timestamp": "2026-05-29 01:05:25,352", "thread_id": "4720", "caller": "0x7fff5588bfeb", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000258c" } ], "repeated": 0, "id": 10244 }, { "timestamp": "2026-05-29 01:05:25,352", "thread_id": "4720", "caller": "0x7fff577d07f5", "parentcaller": "0x7fff58ac212a", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\" } ], "repeated": 0, "id": 10245 }, { "timestamp": "2026-05-29 01:05:25,352", "thread_id": "4720", "caller": "0x7fff5588f616", "parentcaller": "0x7fff5588bf43", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "Handle", "value": "0x0000258c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 10246 }, { "timestamp": "2026-05-29 01:05:25,352", "thread_id": "4720", "caller": "0x7fff5588bf7f", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000258c" }, { "name": "SubKey", "value": "{528c102f-0000-0000-0000-300300000000}\\" }, { "name": "Handle", "value": "0x000025a0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\" } ], "repeated": 0, "id": 10247 }, { "timestamp": "2026-05-29 01:05:25,352", "thread_id": "4720", "caller": "0x7fff5588bfa7", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000258c" } ], "repeated": 0, "id": 10248 }, { "timestamp": "2026-05-29 01:05:25,352", "thread_id": "4720", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025a0" }, { "name": "ValueName", "value": "Generation" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation" } ], "repeated": 0, "id": 10249 }, { "timestamp": "2026-05-29 01:05:25,352", "thread_id": "4720", "caller": "0x7fff5588bfeb", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025a0" } ], "repeated": 0, "id": 10250 }, { "timestamp": "2026-05-29 01:05:25,352", "thread_id": "4720", "caller": "0x7fff557b4361", "parentcaller": "0x7fff557b3e47", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 10251 }, { "timestamp": "2026-05-29 01:05:25,352", "thread_id": "4720", "caller": "0x7fff5588f616", "parentcaller": "0x7fff5588bf43", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "Handle", "value": "0x000025a0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 10252 }, { "timestamp": "2026-05-29 01:05:25,352", "thread_id": "4720", "caller": "0x7fff5588bf7f", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000025a0" }, { "name": "SubKey", "value": "{528c102f-0000-0000-0000-300300000000}\\" }, { "name": "Handle", "value": "0x0000258c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\" } ], "repeated": 0, "id": 10253 }, { "timestamp": "2026-05-29 01:05:25,352", "thread_id": "4720", "caller": "0x7fff5588bfa7", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025a0" } ], "repeated": 0, "id": 10254 }, { "timestamp": "2026-05-29 01:05:25,352", "thread_id": "4720", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000258c" }, { "name": "ValueName", "value": "Generation" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation" } ], "repeated": 0, "id": 10255 }, { "timestamp": "2026-05-29 01:05:25,352", "thread_id": "4720", "caller": "0x7fff5588bfeb", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000258c" } ], "repeated": 0, "id": 10256 }, { "timestamp": "2026-05-29 01:05:25,352", "thread_id": "4720", "caller": "0x7fff577d07f5", "parentcaller": "0x7fff58ac212a", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\" } ], "repeated": 0, "id": 10257 }, { "timestamp": "2026-05-29 01:05:25,352", "thread_id": "4720", "caller": "0x7fff5588f616", "parentcaller": "0x7fff5588bf43", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "Handle", "value": "0x0000258c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 10258 }, { "timestamp": "2026-05-29 01:05:25,352", "thread_id": "4720", "caller": "0x7fff5588bf7f", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000258c" }, { "name": "SubKey", "value": "{528c102f-0000-0000-0000-300300000000}\\" }, { "name": "Handle", "value": "0x000025a0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\" } ], "repeated": 0, "id": 10259 }, { "timestamp": "2026-05-29 01:05:25,352", "thread_id": "4720", "caller": "0x7fff5588bfa7", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000258c" } ], "repeated": 0, "id": 10260 }, { "timestamp": "2026-05-29 01:05:25,352", "thread_id": "4720", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025a0" }, { "name": "ValueName", "value": "Generation" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation" } ], "repeated": 0, "id": 10261 }, { "timestamp": "2026-05-29 01:05:25,352", "thread_id": "4720", "caller": "0x7fff5588bfeb", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025a0" } ], "repeated": 0, "id": 10262 }, { "timestamp": "2026-05-29 01:05:25,352", "thread_id": "4720", "caller": "0x7fff557b4361", "parentcaller": "0x7fff557b3e47", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 10263 }, { "timestamp": "2026-05-29 01:05:25,352", "thread_id": "4720", "caller": "0x7fff5588f616", "parentcaller": "0x7fff5588bf43", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "Handle", "value": "0x000025a0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 10264 }, { "timestamp": "2026-05-29 01:05:25,352", "thread_id": "4720", "caller": "0x7fff5588bf7f", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000025a0" }, { "name": "SubKey", "value": "{528c102f-0000-0000-0000-300300000000}\\" }, { "name": "Handle", "value": "0x0000258c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\" } ], "repeated": 0, "id": 10265 }, { "timestamp": "2026-05-29 01:05:25,352", "thread_id": "4720", "caller": "0x7fff5588bfa7", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025a0" } ], "repeated": 0, "id": 10266 }, { "timestamp": "2026-05-29 01:05:25,352", "thread_id": "4720", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000258c" }, { "name": "ValueName", "value": "Generation" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation" } ], "repeated": 0, "id": 10267 }, { "timestamp": "2026-05-29 01:05:25,352", "thread_id": "4720", "caller": "0x7fff5588bfeb", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000258c" } ], "repeated": 0, "id": 10268 }, { "timestamp": "2026-05-29 01:05:25,352", "thread_id": "4720", "caller": "0x7fff577d07f5", "parentcaller": "0x7fff58ac212a", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\" } ], "repeated": 0, "id": 10269 }, { "timestamp": "2026-05-29 01:05:25,352", "thread_id": "4720", "caller": "0x7fff5588f616", "parentcaller": "0x7fff5588bf43", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "Handle", "value": "0x0000258c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 10270 }, { "timestamp": "2026-05-29 01:05:25,352", "thread_id": "4720", "caller": "0x7fff5588bf7f", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000258c" }, { "name": "SubKey", "value": "{528c102f-0000-0000-0000-300300000000}\\" }, { "name": "Handle", "value": "0x000025a0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\" } ], "repeated": 0, "id": 10271 }, { "timestamp": "2026-05-29 01:05:25,352", "thread_id": "4720", "caller": "0x7fff5588bfa7", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000258c" } ], "repeated": 0, "id": 10272 }, { "timestamp": "2026-05-29 01:05:25,352", "thread_id": "4720", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025a0" }, { "name": "ValueName", "value": "Generation" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation" } ], "repeated": 0, "id": 10273 }, { "timestamp": "2026-05-29 01:05:25,352", "thread_id": "4720", "caller": "0x7fff5588bfeb", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025a0" } ], "repeated": 0, "id": 10274 }, { "timestamp": "2026-05-29 01:05:25,352", "thread_id": "4720", "caller": "0x7fff557b4361", "parentcaller": "0x7fff557b3e47", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 10275 }, { "timestamp": "2026-05-29 01:05:25,352", "thread_id": "4720", "caller": "0x7fff5588f616", "parentcaller": "0x7fff5588bf43", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "Handle", "value": "0x000025a0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 10276 }, { "timestamp": "2026-05-29 01:05:25,352", "thread_id": "4720", "caller": "0x7fff5588bf7f", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000025a0" }, { "name": "SubKey", "value": "{528c102f-0000-0000-0000-300300000000}\\" }, { "name": "Handle", "value": "0x0000258c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\" } ], "repeated": 0, "id": 10277 }, { "timestamp": "2026-05-29 01:05:25,352", "thread_id": "4720", "caller": "0x7fff5588bfa7", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025a0" } ], "repeated": 0, "id": 10278 }, { "timestamp": "2026-05-29 01:05:25,352", "thread_id": "4720", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000258c" }, { "name": "ValueName", "value": "Generation" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation" } ], "repeated": 0, "id": 10279 }, { "timestamp": "2026-05-29 01:05:25,352", "thread_id": "4720", "caller": "0x7fff5588bfeb", "parentcaller": "0x7fff55875561", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000258c" } ], "repeated": 0, "id": 10280 }, { "timestamp": "2026-05-29 01:05:25,352", "thread_id": "4720", "caller": "0x7fff577d07f5", "parentcaller": "0x7fff58ac212a", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\" } ], "repeated": 0, "id": 10281 }, { "timestamp": "2026-05-29 01:05:25,352", "thread_id": "4668", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff557c3a98", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xf9\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00<\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4668" } ], "repeated": 0, "id": 10282 }, { "timestamp": "2026-05-29 01:05:25,352", "thread_id": "4668", "caller": "0x7fff5808b3e7", "parentcaller": "0x7fff5583bb0a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ShellCompatibility\\Objects\\{679F85CB-0220-4080-B29B-5540CC05AAB6}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ShellCompatibility\\Objects\\{679F85CB-0220-4080-B29B-5540CC05AAB6}" } ], "repeated": 0, "id": 10283 }, { "timestamp": "2026-05-29 01:05:25,352", "thread_id": "4668", "caller": "0x7fff55848063", "parentcaller": "0x7fff557f5501", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" }, { "name": "Handle", "value": "0x000025a4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" } ], "repeated": 0, "id": 10284 }, { "timestamp": "2026-05-29 01:05:25,352", "thread_id": "4668", "caller": "0x7fff558480b3", "parentcaller": "0x7fff557f5501", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000025a4" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 10285 }, { "timestamp": "2026-05-29 01:05:25,352", "thread_id": "4668", "caller": "0x7fff558480df", "parentcaller": "0x7fff557f5501", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025a4" } ], "repeated": 0, "id": 10286 }, { "timestamp": "2026-05-29 01:05:25,352", "thread_id": "4668", "caller": "0x7fff558b2b5a", "parentcaller": "0x7fff558658f2", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001011c" }, { "name": "Message", "value": "0x000004b5" } ], "repeated": 0, "id": 10287 }, { "timestamp": "2026-05-29 01:05:25,352", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff557c403a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002594" } ], "repeated": 0, "id": 10288 }, { "timestamp": "2026-05-29 01:05:25,352", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" } ], "repeated": 0, "id": 10289 }, { "timestamp": "2026-05-29 01:05:25,352", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 10290 }, { "timestamp": "2026-05-29 01:05:25,352", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 10291 }, { "timestamp": "2026-05-29 01:05:26,790", "thread_id": "4720", "caller": "0x7fff577d6785", "parentcaller": "0x7fff58c2e697", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002460" } ], "repeated": 0, "id": 10292 }, { "timestamp": "2026-05-29 01:05:26,790", "thread_id": "4720", "caller": "0x7fff577d6785", "parentcaller": "0x7fff58c2e697", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002538" } ], "repeated": 0, "id": 10293 }, { "timestamp": "2026-05-29 01:05:26,790", "thread_id": "4720", "caller": "0x7fff577d6785", "parentcaller": "0x7fff58c2e697", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002518" } ], "repeated": 0, "id": 10294 }, { "timestamp": "2026-05-29 01:05:26,790", "thread_id": "4720", "caller": "0x7fff577d6785", "parentcaller": "0x7fff58c2e697", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000021e4" } ], "repeated": 0, "id": 10295 }, { "timestamp": "2026-05-29 01:05:27,180", "thread_id": "4696", "caller": "0x7ff79bc76bd8", "parentcaller": "0x7ff79bc8a0c8", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00010110" }, { "name": "Message", "value": "0x0000c028" } ], "repeated": 0, "id": 10296 }, { "timestamp": "2026-05-29 01:05:27,180", "thread_id": "5000", "caller": "0x7fff425702f3", "parentcaller": "0x7fff42570634", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 10297 }, { "timestamp": "2026-05-29 01:05:27,180", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 10298 }, { "timestamp": "2026-05-29 01:05:27,180", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 10299 }, { "timestamp": "2026-05-29 01:05:27,180", "thread_id": "6252", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 10300 }, { "timestamp": "2026-05-29 01:05:27,180", "thread_id": "4620", "caller": "0x7fff40c74428", "parentcaller": "0x7fff40c73a03", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "F0AE1542-F497-484B-A175-A20DB09144BA" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "8DC24A1A-6314-4769-9D68-179786F4CED6" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 10301 }, { "timestamp": "2026-05-29 01:05:27,180", "thread_id": "4620", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00020072" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 1, "id": 10302 }, { "timestamp": "2026-05-29 01:05:27,180", "thread_id": "6252", "caller": "0x7fff557c9e99", "parentcaller": "0x7fff557c779f", "category": "filesystem", "api": "CreateDirectoryW", "status": false, "return": "0x00000000", "arguments": [ { "name": "DirectoryName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations" } ], "repeated": 0, "id": 10303 }, { "timestamp": "2026-05-29 01:05:27,180", "thread_id": "6252", "caller": "0x7fff577d07f5", "parentcaller": "0x7fff577cc03b", "category": "filesystem", "api": "NtQueryAttributesFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\590aee7bdd69b59b.automaticDestinations-ms" } ], "repeated": 0, "id": 10304 }, { "timestamp": "2026-05-29 01:05:27,180", "thread_id": "4620", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00020072" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 2, "id": 10305 }, { "timestamp": "2026-05-29 01:05:27,180", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 10306 }, { "timestamp": "2026-05-29 01:05:27,290", "thread_id": "4696", "caller": "0x7ff79bc91360", "parentcaller": "0x7ff79bc5d2c3", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 10307 }, { "timestamp": "2026-05-29 01:05:27,290", "thread_id": "4696", "caller": "0x7ff79bc7a06e", "parentcaller": "0x7ff79bc78f2b", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 10308 }, { "timestamp": "2026-05-29 01:05:27,290", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc78f2b", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "CLSID\\{56AD4C5D-B908-4F85-8FF1-7940C29B3BCF}\\Instance" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\CLSID\\{56AD4C5D-B908-4F85-8FF1-7940C29B3BCF}\\Instance" } ], "repeated": 0, "id": 10309 }, { "timestamp": "2026-05-29 01:05:27,290", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc78f2b", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 10310 }, { "timestamp": "2026-05-29 01:05:27,290", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc78f2b", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff58be0000", "arguments": [ { "name": "lpLibFileName", "value": "shell32.dll" }, { "name": "dwFlags", "value": "0x00004000" } ], "repeated": 0, "id": 10311 }, { "timestamp": "2026-05-29 01:05:27,290", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc78f2b", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "SHELL32.dll" }, { "name": "ModuleHandle", "value": "0x7fff58be0000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff58c378f0" } ], "repeated": 0, "id": 10312 }, { "timestamp": "2026-05-29 01:05:27,290", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc78f2b", "category": "synchronization", "api": "NtFindAtom", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "AtomName", "value": "{9F4C2855-9F79-4B39-A8D0-E1D42DE1D5F3} 3" }, { "name": "Atom", "value": "0x00000000" } ], "repeated": 0, "id": 10313 }, { "timestamp": "2026-05-29 01:05:27,290", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc68e6a", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 2, "id": 10314 }, { "timestamp": "2026-05-29 01:05:27,290", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xe2\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x005\\x18\\xff\\x7f\\x00\\x00(\\xe3\\\\x03\\x00\\x00\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 10315 }, { "timestamp": "2026-05-29 01:05:27,290", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000021e4" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 10316 }, { "timestamp": "2026-05-29 01:05:27,290", "thread_id": "4696", "caller": "0x7ff79bc8a418", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000021e4" } ], "repeated": 0, "id": 10317 }, { "timestamp": "2026-05-29 01:05:27,477", "thread_id": "4504", "caller": "0x7ff79bc7a2d6", "parentcaller": "0x7ff79bc79b42", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 10318 }, { "timestamp": "2026-05-29 01:05:27,477", "thread_id": "4504", "caller": "0x7ff79bc7a2d6", "parentcaller": "0x7ff79bc79b42", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000016d8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 10319 }, { "timestamp": "2026-05-29 01:05:27,477", "thread_id": "4504", "caller": "0x7ff79bc7a2d6", "parentcaller": "0x7ff79bc79b42", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000177c" }, { "name": "ValueName", "value": "{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\\JvaqbjfCbjreFuryy\\i1.0\\cbjrefuryy.rkr" }, { "name": "Data", "value": "\\x00\\x00\\x00\\x00\\x05\\x00\\x00\\x00\\x0b\\x00\\x00\\x00&8\n\\x00\\x00\\x00\\x80\\xbf\\x00\\x00\\x80\\xbf\\x00\\x00\\x80\\xbf\\x00\\x00\\x80\\xbf\\x00\\x00\\x80\\xbf\\x00\\x00\\x80\\xbf\\x00\\x00\\x80\\xbf\\x00\\x00\\x80\\xbf\\x00\\x00\\x80\\xbf\\x00\\x00\\x80\\xbf\\xff\\xff\\xff\\xff@\\xe3&6\\x07\\xef\\xdc\\x01\\x00\\x00\\x00\\x00" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\\JvaqbjfCbjreFuryy\\i1.0\\cbjrefuryy.rkr" } ], "repeated": 0, "id": 10320 }, { "timestamp": "2026-05-29 01:05:27,477", "thread_id": "4504", "caller": "0x7ff79bc7a2d6", "parentcaller": "0x7ff79bc79b42", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000177c" }, { "name": "ValueName", "value": "{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\\JvaqbjfCbjreFuryy\\i1.0\\cbjrefuryy.rkr" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Buffer", "value": "\\x00\\x00\\x00\\x00\\x05\\x00\\x00\\x00\\x0c\\x00\\x00\\x00&8\n\\x00\\x00\\x00\\x80\\xbf\\x00\\x00\\x80\\xbf\\x00\\x00\\x80\\xbf\\x00\\x00\\x80\\xbf\\x00\\x00\\x80\\xbf\\x00\\x00\\x80\\xbf\\x00\\x00\\x80\\xbf\\x00\\x00\\x80\\xbf\\x00\\x00\\x80\\xbf\\x00\\x00\\x80\\xbf\\xff\\xff\\xff\\xff@\\xe3&6\\x07\\xef\\xdc\\x01\\x00\\x00\\x00\\x00" }, { "name": "BufferLength", "value": "72" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\\JvaqbjfCbjreFuryy\\i1.0\\cbjrefuryy.rkr" } ], "repeated": 0, "id": 10321 }, { "timestamp": "2026-05-29 01:05:27,477", "thread_id": "4504", "caller": "0x7ff79bc7a2d6", "parentcaller": "0x7ff79bc79b42", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000177c" }, { "name": "ValueName", "value": "HRZR_PGYFRFFVBA" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Buffer", "value": "\\x00\\x00\\x00\\x00\\x83\\x00\\x00\\x00\\xff\\x00\\x00\\x00M\\xdeL\\x00\\x19\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x10i\\x02\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00.\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00E\\x00x\\x00p\\x00l\\x00o\\x00r\\x00e\\x00r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "BufferLength", "value": "1612" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\HRZR_PGYFRFFVBA" } ], "repeated": 0, "id": 10322 }, { "timestamp": "2026-05-29 01:05:27,477", "thread_id": "4504", "caller": "0x7ff79bc7a2d6", "parentcaller": "0x7ff79bc79b42", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000016d8" } ], "repeated": 0, "id": 10323 }, { "timestamp": "2026-05-29 01:05:27,587", "thread_id": "4696", "caller": "0x7ff79bc76bd8", "parentcaller": "0x7ff79bc8a0c8", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00010110" }, { "name": "Message", "value": "0x0000c028" } ], "repeated": 0, "id": 10324 }, { "timestamp": "2026-05-29 01:05:27,587", "thread_id": "5000", "caller": "0x7fff425702f3", "parentcaller": "0x7fff42570634", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 10325 }, { "timestamp": "2026-05-29 01:05:27,587", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 10326 }, { "timestamp": "2026-05-29 01:05:27,587", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 10327 }, { "timestamp": "2026-05-29 01:05:27,587", "thread_id": "6252", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 10328 }, { "timestamp": "2026-05-29 01:05:27,587", "thread_id": "4620", "caller": "0x7fff40c74428", "parentcaller": "0x7fff40c73a03", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "F0AE1542-F497-484B-A175-A20DB09144BA" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "8DC24A1A-6314-4769-9D68-179786F4CED6" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 10329 }, { "timestamp": "2026-05-29 01:05:27,587", "thread_id": "4620", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00020072" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 1, "id": 10330 }, { "timestamp": "2026-05-29 01:05:27,587", "thread_id": "6252", "caller": "0x7fff557c9e99", "parentcaller": "0x7fff557c779f", "category": "filesystem", "api": "CreateDirectoryW", "status": false, "return": "0x00000000", "arguments": [ { "name": "DirectoryName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations" } ], "repeated": 0, "id": 10331 }, { "timestamp": "2026-05-29 01:05:27,587", "thread_id": "6252", "caller": "0x7fff577d07f5", "parentcaller": "0x7fff577cc03b", "category": "filesystem", "api": "NtQueryAttributesFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\590aee7bdd69b59b.automaticDestinations-ms" } ], "repeated": 0, "id": 10332 }, { "timestamp": "2026-05-29 01:05:27,587", "thread_id": "4620", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00020072" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 2, "id": 10333 }, { "timestamp": "2026-05-29 01:05:27,587", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 10334 }, { "timestamp": "2026-05-29 01:05:27,696", "thread_id": "4696", "caller": "0x7ff79bc91360", "parentcaller": "0x7ff79bc5d2c3", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 10335 }, { "timestamp": "2026-05-29 01:05:27,696", "thread_id": "4696", "caller": "0x7ff79bc7a06e", "parentcaller": "0x7ff79bc78f2b", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 10336 }, { "timestamp": "2026-05-29 01:05:27,696", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc78f2b", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "CLSID\\{56AD4C5D-B908-4F85-8FF1-7940C29B3BCF}\\Instance" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\CLSID\\{56AD4C5D-B908-4F85-8FF1-7940C29B3BCF}\\Instance" } ], "repeated": 0, "id": 10337 }, { "timestamp": "2026-05-29 01:05:27,696", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc78f2b", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 10338 }, { "timestamp": "2026-05-29 01:05:27,696", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc78f2b", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff58be0000", "arguments": [ { "name": "lpLibFileName", "value": "shell32.dll" }, { "name": "dwFlags", "value": "0x00004000" } ], "repeated": 0, "id": 10339 }, { "timestamp": "2026-05-29 01:05:27,696", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc78f2b", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "SHELL32.dll" }, { "name": "ModuleHandle", "value": "0x7fff58be0000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff58c378f0" } ], "repeated": 0, "id": 10340 }, { "timestamp": "2026-05-29 01:05:27,696", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc78f2b", "category": "synchronization", "api": "NtFindAtom", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "AtomName", "value": "{9F4C2855-9F79-4B39-A8D0-E1D42DE1D5F3} 3" }, { "name": "Atom", "value": "0x00000000" } ], "repeated": 0, "id": 10341 }, { "timestamp": "2026-05-29 01:05:27,696", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc68e6a", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 2, "id": 10342 }, { "timestamp": "2026-05-29 01:05:27,696", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xe2\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x005\\x18\\xff\\x7f\\x00\\x00(\\xe3\\\\x03\\x00\\x00\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 10343 }, { "timestamp": "2026-05-29 01:05:27,696", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000025b0" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 10344 }, { "timestamp": "2026-05-29 01:05:27,696", "thread_id": "4696", "caller": "0x7ff79bc8a418", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025b0" } ], "repeated": 0, "id": 10345 }, { "timestamp": "2026-05-29 01:05:27,696", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc68e6a", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 2, "id": 10346 }, { "timestamp": "2026-05-29 01:05:27,696", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xe2\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x005\\x18\\xff\\x7f\\x00\\x00(\\xe3\\\\x03\\x00\\x00\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 10347 }, { "timestamp": "2026-05-29 01:05:27,696", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000025b0" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 10348 }, { "timestamp": "2026-05-29 01:05:27,696", "thread_id": "4696", "caller": "0x7ff79bc8a418", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025b0" } ], "repeated": 0, "id": 10349 }, { "timestamp": "2026-05-29 01:05:29,352", "thread_id": "4500", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff584fb0ca", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 10350 }, { "timestamp": "2026-05-29 01:05:29,352", "thread_id": "4500", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 10351 }, { "timestamp": "2026-05-29 01:05:29,352", "thread_id": "4500", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 10352 }, { "timestamp": "2026-05-29 01:05:29,352", "thread_id": "4500", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000360" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 10353 }, { "timestamp": "2026-05-29 01:05:29,352", "thread_id": "4504", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 10354 }, { "timestamp": "2026-05-29 01:05:29,352", "thread_id": "4504", "caller": "0x7fff425d6afa", "parentcaller": "0x7fff59fc16e9", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "C2F03A33-21F5-47FA-B4BB-156362A2F239" }, { "name": "ClsContext", "value": "0x00000404", "pretty_value": "CLSCTX_LOCAL_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "6D5140C1-7436-11CE-8034-00AA006009FA" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 10355 }, { "timestamp": "2026-05-29 01:05:29,352", "thread_id": "4504", "caller": "0x7fff41e05bb2", "parentcaller": "0x7fff425d6b65", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00010110" }, { "name": "Message", "value": "0x0000c0e5" } ], "repeated": 0, "id": 10356 }, { "timestamp": "2026-05-29 01:05:29,352", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 10357 }, { "timestamp": "2026-05-29 01:05:29,352", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58085ee4", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002048" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 10358 }, { "timestamp": "2026-05-29 01:05:29,352", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 1, "id": 10359 }, { "timestamp": "2026-05-29 01:05:29,352", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 10360 }, { "timestamp": "2026-05-29 01:05:29,352", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58085ee4", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002048" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 10361 }, { "timestamp": "2026-05-29 01:05:29,352", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 10362 }, { "timestamp": "2026-05-29 01:05:29,352", "thread_id": "4504", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff584fb0ca", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 10363 }, { "timestamp": "2026-05-29 01:05:29,352", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 10364 }, { "timestamp": "2026-05-29 01:05:29,352", "thread_id": "6160", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x18\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6160" } ], "repeated": 0, "id": 10365 }, { "timestamp": "2026-05-29 01:05:29,352", "thread_id": "4504", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xfe\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x98\\x11\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4504" } ], "repeated": 0, "id": 10366 }, { "timestamp": "2026-05-29 01:05:29,352", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 10367 }, { "timestamp": "2026-05-29 01:05:29,352", "thread_id": "6160", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x18\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6160" } ], "repeated": 0, "id": 10368 }, { "timestamp": "2026-05-29 01:05:29,352", "thread_id": "4504", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff584fb0ca", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 10369 }, { "timestamp": "2026-05-29 01:05:29,352", "thread_id": "6160", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x18\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6160" } ], "repeated": 0, "id": 10370 }, { "timestamp": "2026-05-29 01:05:29,446", "thread_id": "4504", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbddbb", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000025a4" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "6136" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" } ], "repeated": 0, "id": 10371 }, { "timestamp": "2026-05-29 01:05:29,446", "thread_id": "4504", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbddbb", "category": "process", "api": "NtOpenProcess", "status": false, "return": "0xffffffffc0000022", "pretty_return": "ACCESS_DENIED", "arguments": [ { "name": "ProcessHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "1180" } ], "repeated": 0, "id": 10372 }, { "timestamp": "2026-05-29 01:05:29,446", "thread_id": "4504", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbddbb", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002594" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "5624" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" } ], "repeated": 0, "id": 10373 }, { "timestamp": "2026-05-29 01:05:29,446", "thread_id": "4504", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbddbb", "category": "process", "api": "NtOpenProcess", "status": false, "return": "0xffffffffc0000022", "pretty_return": "ACCESS_DENIED", "arguments": [ { "name": "ProcessHandle", "value": "0x00002594" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "1048" } ], "repeated": 0, "id": 10374 }, { "timestamp": "2026-05-29 01:05:29,446", "thread_id": "4504", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbddbb", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000025a8" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 10375 }, { "timestamp": "2026-05-29 01:05:29,446", "thread_id": "4504", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbddbb", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000025ac" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "12844" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" } ], "repeated": 0, "id": 10376 }, { "timestamp": "2026-05-29 01:05:29,446", "thread_id": "4504", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbddbb", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000025b0" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "5128" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" } ], "repeated": 0, "id": 10377 }, { "timestamp": "2026-05-29 01:05:29,446", "thread_id": "4504", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbddbb", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000025b4" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "6400" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" } ], "repeated": 0, "id": 10378 }, { "timestamp": "2026-05-29 01:05:29,446", "thread_id": "4504", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xfe\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x98\\x11\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4504" } ], "repeated": 7, "id": 10379 }, { "timestamp": "2026-05-29 01:05:29,446", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 10380 }, { "timestamp": "2026-05-29 01:05:29,446", "thread_id": "4504", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xfe\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x98\\x11\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4504" } ], "repeated": 2, "id": 10381 }, { "timestamp": "2026-05-29 01:05:29,446", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 10382 }, { "timestamp": "2026-05-29 01:05:29,446", "thread_id": "4504", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xfe\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x98\\x11\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4504" } ], "repeated": 1, "id": 10383 }, { "timestamp": "2026-05-29 01:05:29,446", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 10384 }, { "timestamp": "2026-05-29 01:05:29,446", "thread_id": "4504", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xfe\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x98\\x11\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4504" } ], "repeated": 0, "id": 10385 }, { "timestamp": "2026-05-29 01:05:29,446", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 10386 }, { "timestamp": "2026-05-29 01:05:29,446", "thread_id": "4504", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xfe\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x98\\x11\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4504" } ], "repeated": 1, "id": 10387 }, { "timestamp": "2026-05-29 01:05:29,446", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 10388 }, { "timestamp": "2026-05-29 01:05:29,446", "thread_id": "4504", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xfe\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x98\\x11\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4504" } ], "repeated": 2, "id": 10389 }, { "timestamp": "2026-05-29 01:05:29,446", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 10390 }, { "timestamp": "2026-05-29 01:05:29,446", "thread_id": "4504", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xfe\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x98\\x11\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4504" } ], "repeated": 3, "id": 10391 }, { "timestamp": "2026-05-29 01:05:29,446", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 1, "id": 10392 }, { "timestamp": "2026-05-29 01:05:29,446", "thread_id": "4504", "caller": "0x7fff41dbe842", "parentcaller": "0x7fff59fc16e9", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000025b8" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "\\Device\\Bam" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 10393 }, { "timestamp": "2026-05-29 01:05:29,446", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 10394 }, { "timestamp": "2026-05-29 01:05:29,446", "thread_id": "4504", "caller": "0x7fff41dbe8a3", "parentcaller": "0x7fff59fc16e9", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000025b8" }, { "name": "HandleName", "value": "\\Device\\Bam" }, { "name": "IoControlCode", "value": "0x00220004" }, { "name": "InputBuffer", "value": "\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa4%\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9c\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x94%\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa8%\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac%\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0%\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb4%\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 10395 }, { "timestamp": "2026-05-29 01:05:29,446", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 10396 }, { "timestamp": "2026-05-29 01:05:29,446", "thread_id": "4504", "caller": "0x7fff577d6785", "parentcaller": "0x7fff41dbe9a9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025a4" } ], "repeated": 0, "id": 10397 }, { "timestamp": "2026-05-29 01:05:29,446", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 10398 }, { "timestamp": "2026-05-29 01:05:29,446", "thread_id": "4504", "caller": "0x7fff577d6785", "parentcaller": "0x7fff41dbe9a9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002594" } ], "repeated": 0, "id": 10399 }, { "timestamp": "2026-05-29 01:05:29,446", "thread_id": "4504", "caller": "0x7fff577d6785", "parentcaller": "0x7fff41dbe9a9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025a8" } ], "repeated": 0, "id": 10400 }, { "timestamp": "2026-05-29 01:05:29,446", "thread_id": "4504", "caller": "0x7fff577d6785", "parentcaller": "0x7fff41dbe9a9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025ac" } ], "repeated": 0, "id": 10401 }, { "timestamp": "2026-05-29 01:05:29,446", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 10402 }, { "timestamp": "2026-05-29 01:05:29,446", "thread_id": "4504", "caller": "0x7fff577d6785", "parentcaller": "0x7fff41dbe9a9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025b4" } ], "repeated": 0, "id": 10403 }, { "timestamp": "2026-05-29 01:05:29,446", "thread_id": "4504", "caller": "0x7fff41dbe9d8", "parentcaller": "0x7fff59fc16e9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025b8" } ], "repeated": 0, "id": 10404 }, { "timestamp": "2026-05-29 01:05:29,446", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 35, "id": 10405 }, { "timestamp": "2026-05-29 01:05:29,462", "thread_id": "5000", "caller": "0x7fff57fc2755", "parentcaller": "0x7fff57fc2699", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "{\\x00D\\x00A\\x00D\\x00E\\x00F\\x009\\x002\\x00C\\x00-\\x002\\x002\\x007\\x00E\\x00-\\x004\\x006\\x00C\\x000\\x00-\\x009\\x003\\x00C\\x000\\x00-\\x009\\x00F\\x00F\\x00F\\x00A\\x004\\x00D\\x00C\\x000\\x007\\x00D\\x009\\x00}\\x00" }, { "name": "Size", "value": "76" }, { "name": "Atom", "value": "0x0000c04e" } ], "repeated": 0, "id": 10406 }, { "timestamp": "2026-05-29 01:05:29,555", "thread_id": "4696", "caller": "0x7ff79bc76bd8", "parentcaller": "0x7ff79bc8a0c8", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00010110" }, { "name": "Message", "value": "0x0000c028" } ], "repeated": 0, "id": 10407 }, { "timestamp": "2026-05-29 01:05:29,555", "thread_id": "4696", "caller": "0x7ff79bc521d5", "parentcaller": "0x7ff79bc5203a", "category": "system", "api": "GetLastInputInfo", "status": true, "return": "0x00000001", "arguments": [], "repeated": 0, "id": 10408 }, { "timestamp": "2026-05-29 01:05:29,555", "thread_id": "4696", "caller": "0x7ff79bc521fe", "parentcaller": "0x7ff79bc5203a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025c0" } ], "repeated": 0, "id": 10409 }, { "timestamp": "2026-05-29 01:05:29,555", "thread_id": "4696", "caller": "0x7ff79bc521fe", "parentcaller": "0x7ff79bc5203a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025bc" } ], "repeated": 0, "id": 10410 }, { "timestamp": "2026-05-29 01:05:29,555", "thread_id": "4696", "caller": "0x7ff79bc521fe", "parentcaller": "0x7ff79bc5203a", "category": "device", "api": "NtPowerInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "InformationLevel", "value": "16" }, { "name": "InputBuffer", "value": "" }, { "name": "OutputBuffer", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 10411 }, { "timestamp": "2026-05-29 01:05:29,555", "thread_id": "4696", "caller": "0x7ff79bc521fe", "parentcaller": "0x7ff79bc5203a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025bc" } ], "repeated": 0, "id": 10412 }, { "timestamp": "2026-05-29 01:05:29,555", "thread_id": "4696", "caller": "0x7ff79bc76bd8", "parentcaller": "0x7ff79bc8a0c8", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00010110" }, { "name": "Message", "value": "0x0000c028" } ], "repeated": 1, "id": 10413 }, { "timestamp": "2026-05-29 01:05:29,571", "thread_id": "4504", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff584fb0ca", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 10414 }, { "timestamp": "2026-05-29 01:05:29,696", "thread_id": "4696", "caller": "0x7ff79bc5652c", "parentcaller": "0x7ff79bc55d54", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\rsaenh.dll" }, { "name": "BaseAddress", "value": "0x7fff56630000" } ], "repeated": 0, "id": 10415 }, { "timestamp": "2026-05-29 01:05:29,696", "thread_id": "4696", "caller": "0x7ff79bc5652c", "parentcaller": "0x7ff79bc55d54", "category": "crypto", "api": "CryptAcquireContextW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Container", "value": "" }, { "name": "Provider", "value": "" }, { "name": "Flags", "value": "0xf0000000" } ], "repeated": 0, "id": 10416 }, { "timestamp": "2026-05-29 01:05:29,696", "thread_id": "4696", "caller": "0x7ff79bc5655a", "parentcaller": "0x7ff79bc55d54", "category": "crypto", "api": "CryptCreateHash", "status": true, "return": "0x00000001", "arguments": [ { "name": "Algid", "value": "0x00008003", "pretty_value": "MD5" }, { "name": "CryptKey", "value": "0x00000000" }, { "name": "Hash object", "value": "0x0c73e470" } ], "repeated": 0, "id": 10417 }, { "timestamp": "2026-05-29 01:05:29,696", "thread_id": "4696", "caller": "0x7ff79bc565a5", "parentcaller": "0x7ff79bc55d54", "category": "crypto", "api": "CryptHashData", "status": true, "return": "0x00000001", "arguments": [ { "name": "CryptHash", "value": "0x0c73e470" }, { "name": "Buffer", "value": "{\\x007\\x00C\\x005\\x00A\\x004\\x000\\x00E\\x00F\\x00-\\x00A\\x000\\x00F\\x00B\\x00-\\x004\\x00B\\x00F\\x00C\\x00-\\x008\\x007\\x004\\x00A\\x00-\\x00C\\x000\\x00F\\x002\\x00E\\x000\\x00B\\x009\\x00F\\x00A\\x008\\x00E\\x00}\\x00\\\\x00S\\x00t\\x00e\\x00a\\x00m\\x00\\\\x00s\\x00t\\x00e\\x00a\\x00m\\x00.\\x00e\\x00x\\x00e\\x00.\\x001\\x00" }, { "name": "Length", "value": "112" } ], "repeated": 0, "id": 10418 }, { "timestamp": "2026-05-29 01:05:29,696", "thread_id": "4696", "caller": "0x7ff79bc5652c", "parentcaller": "0x7ff79bc55d54", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\rsaenh.dll" }, { "name": "BaseAddress", "value": "0x7fff56630000" } ], "repeated": 0, "id": 10419 }, { "timestamp": "2026-05-29 01:05:29,696", "thread_id": "4696", "caller": "0x7ff79bc5652c", "parentcaller": "0x7ff79bc55d54", "category": "crypto", "api": "CryptAcquireContextW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Container", "value": "" }, { "name": "Provider", "value": "" }, { "name": "Flags", "value": "0xf0000000" } ], "repeated": 0, "id": 10420 }, { "timestamp": "2026-05-29 01:05:29,696", "thread_id": "4696", "caller": "0x7ff79bc5655a", "parentcaller": "0x7ff79bc55d54", "category": "crypto", "api": "CryptCreateHash", "status": true, "return": "0x00000001", "arguments": [ { "name": "Algid", "value": "0x00008003", "pretty_value": "MD5" }, { "name": "CryptKey", "value": "0x00000000" }, { "name": "Hash object", "value": "0x0c73dc90" } ], "repeated": 0, "id": 10421 }, { "timestamp": "2026-05-29 01:05:29,696", "thread_id": "4696", "caller": "0x7ff79bc565a5", "parentcaller": "0x7ff79bc55d54", "category": "crypto", "api": "CryptHashData", "status": true, "return": "0x00000001", "arguments": [ { "name": "CryptHash", "value": "0x0c73dc90" }, { "name": "Buffer", "value": "C\\x00:\\x00\\\\x00U\\x00s\\x00e\\x00r\\x00s\\x00\\\\x00a\\x00d\\x00m\\x00i\\x00n\\x00\\\\x00A\\x00p\\x00p\\x00D\\x00a\\x00t\\x00a\\x00\\\\x00L\\x00o\\x00c\\x00a\\x00l\\x00\\\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00\\\\x00O\\x00n\\x00e\\x00D\\x00r\\x00i\\x00v\\x00e\\x00\\\\x00O\\x00n\\x00e\\x00D\\x00r\\x00i\\x00v\\x00e\\x00.\\x00e\\x00x\\x00e\\x00.\\x005\\x000\\x001\\x00" }, { "name": "Length", "value": "128" } ], "repeated": 0, "id": 10422 }, { "timestamp": "2026-05-29 01:05:29,696", "thread_id": "4696", "caller": "0x7ff79bc5696c", "parentcaller": "0x7ff79bc55d54", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 10423 }, { "timestamp": "2026-05-29 01:05:29,696", "thread_id": "4696", "caller": "0x7ff79bc623a8", "parentcaller": "0x7ff79bc62e19", "category": "system", "api": "LdrGetDllHandle", "status": false, "return": "0xffffffffc0000135", "pretty_return": "DLL_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\SecurityHealthSSO.dll" }, { "name": "ModuleHandle", "value": "0x7fff57ec14a4" } ], "repeated": 0, "id": 10424 }, { "timestamp": "2026-05-29 01:05:29,696", "thread_id": "4696", "caller": "0x7ff79bc8ab52", "parentcaller": "0x7ff79bc896ee", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x0000200a" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 10425 }, { "timestamp": "2026-05-29 01:05:29,696", "thread_id": "4696", "caller": "0x7ff79bc62fcc", "parentcaller": "0x7ff79bc569dd", "category": "system", "api": "CreateTimerQueueTimer", "status": true, "return": "0x00000001", "arguments": [ { "name": "phNewTimer", "value": "0x0c73dd70" }, { "name": "TimerQueue", "value": "0x00000000" }, { "name": "Callback", "value": "0x9be06320" }, { "name": "Parameter", "value": "0x035cb810" }, { "name": "DueTime", "value": "5000" }, { "name": "Period", "value": "1000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 10426 }, { "timestamp": "2026-05-29 01:05:29,696", "thread_id": "4696", "caller": "0x7ff79bc630c3", "parentcaller": "0x7ff79bc569dd", "category": "system", "api": "CreateTimerQueueTimer", "status": true, "return": "0x00000001", "arguments": [ { "name": "phNewTimer", "value": "0x0c73e080" }, { "name": "TimerQueue", "value": "0x00000000" }, { "name": "Callback", "value": "0x9be06320" }, { "name": "Parameter", "value": "0x035cb810" }, { "name": "DueTime", "value": "1000" }, { "name": "Period", "value": "1000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 10427 }, { "timestamp": "2026-05-29 01:05:32,368", "thread_id": "6152", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff557c3b23", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x18\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6152" } ], "repeated": 0, "id": 10428 }, { "timestamp": "2026-05-29 01:05:32,368", "thread_id": "6152", "caller": "0x7fff577ce76a", "parentcaller": "0x7fff584cea0e", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "oleaut32.dll" }, { "name": "ModuleHandle", "value": "0x7fff58860000" } ], "repeated": 0, "id": 10429 }, { "timestamp": "2026-05-29 01:05:34,352", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 10430 }, { "timestamp": "2026-05-29 01:05:34,352", "thread_id": "4620", "caller": "0x7fff428ef240", "parentcaller": "0x7fff4260c46e", "category": "misc", "api": "GetSystemMetrics", "status": false, "return": "0x00000000", "arguments": [ { "name": "SystemMetricIndex", "value": "8192" } ], "repeated": 1, "id": 10431 }, { "timestamp": "2026-05-29 01:05:34,352", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 10432 }, { "timestamp": "2026-05-29 01:05:34,477", "thread_id": "3424", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff557c3b23", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xfe\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00`\r\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "3424" } ], "repeated": 0, "id": 10433 }, { "timestamp": "2026-05-29 01:05:34,477", "thread_id": "5220", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xfd\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00d\\x14\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5220" } ], "repeated": 0, "id": 10434 }, { "timestamp": "2026-05-29 01:05:34,477", "thread_id": "5220", "caller": "0x7fff577ce76a", "parentcaller": "0x7fff584cea0e", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "oleaut32.dll" }, { "name": "ModuleHandle", "value": "0x7fff58860000" } ], "repeated": 1, "id": 10435 }, { "timestamp": "2026-05-29 01:05:34,571", "thread_id": "3424", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbddbb", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000025bc" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "6136" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" } ], "repeated": 0, "id": 10436 }, { "timestamp": "2026-05-29 01:05:34,571", "thread_id": "3424", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbddbb", "category": "process", "api": "NtOpenProcess", "status": false, "return": "0xffffffffc0000022", "pretty_return": "ACCESS_DENIED", "arguments": [ { "name": "ProcessHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "1180" } ], "repeated": 0, "id": 10437 }, { "timestamp": "2026-05-29 01:05:34,571", "thread_id": "3424", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbddbb", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000025c0" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "5624" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" } ], "repeated": 0, "id": 10438 }, { "timestamp": "2026-05-29 01:05:34,571", "thread_id": "3424", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbddbb", "category": "process", "api": "NtOpenProcess", "status": false, "return": "0xffffffffc0000022", "pretty_return": "ACCESS_DENIED", "arguments": [ { "name": "ProcessHandle", "value": "0x000025c0" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "1048" } ], "repeated": 0, "id": 10439 }, { "timestamp": "2026-05-29 01:05:34,571", "thread_id": "3424", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbddbb", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000025c4" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 10440 }, { "timestamp": "2026-05-29 01:05:34,571", "thread_id": "3424", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbddbb", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000025c8" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "12844" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" } ], "repeated": 0, "id": 10441 }, { "timestamp": "2026-05-29 01:05:34,571", "thread_id": "3424", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbddbb", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000025cc" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "5128" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" } ], "repeated": 0, "id": 10442 }, { "timestamp": "2026-05-29 01:05:34,571", "thread_id": "3424", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbddbb", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000025d0" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "6400" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" } ], "repeated": 0, "id": 10443 }, { "timestamp": "2026-05-29 01:05:34,571", "thread_id": "3424", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xfe\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00`\r\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "3424" } ], "repeated": 2, "id": 10444 }, { "timestamp": "2026-05-29 01:05:34,571", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 10445 }, { "timestamp": "2026-05-29 01:05:34,571", "thread_id": "3424", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xfe\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00`\r\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "3424" } ], "repeated": 4, "id": 10446 }, { "timestamp": "2026-05-29 01:05:34,571", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 10447 }, { "timestamp": "2026-05-29 01:05:34,571", "thread_id": "3424", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xfe\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00`\r\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "3424" } ], "repeated": 3, "id": 10448 }, { "timestamp": "2026-05-29 01:05:34,571", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 10449 }, { "timestamp": "2026-05-29 01:05:34,571", "thread_id": "3424", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xfe\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00`\r\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "3424" } ], "repeated": 2, "id": 10450 }, { "timestamp": "2026-05-29 01:05:34,571", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 10451 }, { "timestamp": "2026-05-29 01:05:34,571", "thread_id": "3424", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xfe\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00`\r\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "3424" } ], "repeated": 2, "id": 10452 }, { "timestamp": "2026-05-29 01:05:34,571", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 10453 }, { "timestamp": "2026-05-29 01:05:34,571", "thread_id": "3424", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xfe\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00`\r\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "3424" } ], "repeated": 0, "id": 10454 }, { "timestamp": "2026-05-29 01:05:34,571", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 10455 }, { "timestamp": "2026-05-29 01:05:34,571", "thread_id": "3424", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xfe\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00`\r\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "3424" } ], "repeated": 2, "id": 10456 }, { "timestamp": "2026-05-29 01:05:34,571", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 2, "id": 10457 }, { "timestamp": "2026-05-29 01:05:34,571", "thread_id": "3424", "caller": "0x7fff41dbe842", "parentcaller": "0x7fff59fc16e9", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000025b8" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "\\Device\\Bam" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 10458 }, { "timestamp": "2026-05-29 01:05:34,571", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 10459 }, { "timestamp": "2026-05-29 01:05:34,571", "thread_id": "3424", "caller": "0x7fff41dbe8a3", "parentcaller": "0x7fff59fc16e9", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000025b8" }, { "name": "HandleName", "value": "\\Device\\Bam" }, { "name": "IoControlCode", "value": "0x00220004" }, { "name": "InputBuffer", "value": "\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xbc%\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9c\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0%\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc4%\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc8%\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xcc%\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0%\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 10460 }, { "timestamp": "2026-05-29 01:05:34,571", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 10461 }, { "timestamp": "2026-05-29 01:05:34,571", "thread_id": "3424", "caller": "0x7fff577d6785", "parentcaller": "0x7fff41dbe9a9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025c0" } ], "repeated": 0, "id": 10462 }, { "timestamp": "2026-05-29 01:05:34,571", "thread_id": "3424", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025c4" } ], "repeated": 0, "id": 10463 }, { "timestamp": "2026-05-29 01:05:34,571", "thread_id": "3424", "caller": "0x7fff577d6785", "parentcaller": "0x7fff41dbe9a9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025c8" } ], "repeated": 0, "id": 10464 }, { "timestamp": "2026-05-29 01:05:34,571", "thread_id": "3424", "caller": "0x7fff577d6785", "parentcaller": "0x7fff41dbe9a9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025cc" } ], "repeated": 0, "id": 10465 }, { "timestamp": "2026-05-29 01:05:34,571", "thread_id": "3424", "caller": "0x7fff577d6785", "parentcaller": "0x7fff41dbe9a9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025d0" } ], "repeated": 0, "id": 10466 }, { "timestamp": "2026-05-29 01:05:34,571", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 10467 }, { "timestamp": "2026-05-29 01:05:34,571", "thread_id": "3424", "caller": "0x7fff41dbe9d8", "parentcaller": "0x7fff59fc16e9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025b8" } ], "repeated": 0, "id": 10468 }, { "timestamp": "2026-05-29 01:05:34,571", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 33, "id": 10469 }, { "timestamp": "2026-05-29 01:05:36,102", "thread_id": "2440", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432be00e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000231c" } ], "repeated": 0, "id": 10470 }, { "timestamp": "2026-05-29 01:05:36,102", "thread_id": "4340", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432be00e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001f44" } ], "repeated": 0, "id": 10471 }, { "timestamp": "2026-05-29 01:05:36,102", "thread_id": "4664", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432be00e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002158" } ], "repeated": 0, "id": 10472 }, { "timestamp": "2026-05-29 01:05:36,102", "thread_id": "2440", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff432beb8c", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x12d40000" }, { "name": "RegionSize", "value": "0x00100000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 10473 }, { "timestamp": "2026-05-29 01:05:36,102", "thread_id": "4340", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432beba1", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002340" } ], "repeated": 0, "id": 10474 }, { "timestamp": "2026-05-29 01:05:36,102", "thread_id": "2440", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432be04f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000023a0" } ], "repeated": 0, "id": 10475 }, { "timestamp": "2026-05-29 01:05:36,102", "thread_id": "4340", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432be04f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002314" } ], "repeated": 0, "id": 10476 }, { "timestamp": "2026-05-29 01:05:36,102", "thread_id": "4664", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432be00e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002150" } ], "repeated": 0, "id": 10477 }, { "timestamp": "2026-05-29 01:05:36,102", "thread_id": "4664", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432be00e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000112c" } ], "repeated": 0, "id": 10478 }, { "timestamp": "2026-05-29 01:05:36,102", "thread_id": "4664", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432be00e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000216c" } ], "repeated": 0, "id": 10479 }, { "timestamp": "2026-05-29 01:05:36,102", "thread_id": "4664", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432be00e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002194" } ], "repeated": 0, "id": 10480 }, { "timestamp": "2026-05-29 01:05:36,102", "thread_id": "4664", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432be00e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000219c" } ], "repeated": 0, "id": 10481 }, { "timestamp": "2026-05-29 01:05:36,102", "thread_id": "4664", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432be00e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000021a0" } ], "repeated": 0, "id": 10482 }, { "timestamp": "2026-05-29 01:05:36,102", "thread_id": "4664", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432be00e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002198" } ], "repeated": 0, "id": 10483 }, { "timestamp": "2026-05-29 01:05:36,102", "thread_id": "4664", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432be00e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002184" } ], "repeated": 0, "id": 10484 }, { "timestamp": "2026-05-29 01:05:36,102", "thread_id": "4664", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432be00e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000218c" } ], "repeated": 0, "id": 10485 }, { "timestamp": "2026-05-29 01:05:36,102", "thread_id": "4664", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432be00e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002190" } ], "repeated": 0, "id": 10486 }, { "timestamp": "2026-05-29 01:05:36,102", "thread_id": "4664", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432be00e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002188" } ], "repeated": 0, "id": 10487 }, { "timestamp": "2026-05-29 01:05:36,102", "thread_id": "4664", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432be00e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002174" } ], "repeated": 0, "id": 10488 }, { "timestamp": "2026-05-29 01:05:36,102", "thread_id": "4664", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432be00e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000217c" } ], "repeated": 0, "id": 10489 }, { "timestamp": "2026-05-29 01:05:36,102", "thread_id": "4664", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432c3396", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000229c" } ], "repeated": 0, "id": 10490 }, { "timestamp": "2026-05-29 01:05:36,102", "thread_id": "2440", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432be00e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022dc" } ], "repeated": 0, "id": 10491 }, { "timestamp": "2026-05-29 01:05:36,102", "thread_id": "2440", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432be00e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" } ], "repeated": 0, "id": 10492 }, { "timestamp": "2026-05-29 01:05:36,102", "thread_id": "2440", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432be00e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002348" } ], "repeated": 0, "id": 10493 }, { "timestamp": "2026-05-29 01:05:36,102", "thread_id": "2440", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432be00e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022b4" } ], "repeated": 0, "id": 10494 }, { "timestamp": "2026-05-29 01:05:36,102", "thread_id": "2440", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432be00e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022ac" } ], "repeated": 0, "id": 10495 }, { "timestamp": "2026-05-29 01:05:36,102", "thread_id": "2440", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432be00e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022b0" } ], "repeated": 0, "id": 10496 }, { "timestamp": "2026-05-29 01:05:36,102", "thread_id": "2440", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432be00e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000235c" } ], "repeated": 0, "id": 10497 }, { "timestamp": "2026-05-29 01:05:36,102", "thread_id": "4340", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432be00e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001170" } ], "repeated": 0, "id": 10498 }, { "timestamp": "2026-05-29 01:05:36,102", "thread_id": "4340", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432be00e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002144" } ], "repeated": 0, "id": 10499 }, { "timestamp": "2026-05-29 01:05:36,102", "thread_id": "4340", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432be00e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002368" } ], "repeated": 0, "id": 10500 }, { "timestamp": "2026-05-29 01:05:36,102", "thread_id": "4340", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432be00e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000021ac" } ], "repeated": 0, "id": 10501 }, { "timestamp": "2026-05-29 01:05:36,102", "thread_id": "4340", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432be00e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000470" } ], "repeated": 0, "id": 10502 }, { "timestamp": "2026-05-29 01:05:36,102", "thread_id": "4340", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432be00e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002354" } ], "repeated": 0, "id": 10503 }, { "timestamp": "2026-05-29 01:05:36,102", "thread_id": "4340", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432be00e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002374" } ], "repeated": 0, "id": 10504 }, { "timestamp": "2026-05-29 01:05:36,102", "thread_id": "4340", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432be00e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002308" } ], "repeated": 0, "id": 10505 }, { "timestamp": "2026-05-29 01:05:36,102", "thread_id": "4340", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432be00e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002318" } ], "repeated": 0, "id": 10506 }, { "timestamp": "2026-05-29 01:05:36,102", "thread_id": "4664", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff432c33a9", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x07eb0000" }, { "name": "RegionSize", "value": "0x0000f000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 10507 }, { "timestamp": "2026-05-29 01:05:36,102", "thread_id": "4664", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432c3c47", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002168" } ], "repeated": 0, "id": 10508 }, { "timestamp": "2026-05-29 01:05:36,102", "thread_id": "4664", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432c3c5c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002160" } ], "repeated": 0, "id": 10509 }, { "timestamp": "2026-05-29 01:05:36,102", "thread_id": "4664", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432c3d86", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002180" } ], "repeated": 0, "id": 10510 }, { "timestamp": "2026-05-29 01:05:36,102", "thread_id": "4664", "caller": "0x7fff5582a695", "parentcaller": "0x7fff5582a024", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000468" } ], "repeated": 0, "id": 10511 }, { "timestamp": "2026-05-29 01:05:36,102", "thread_id": "4664", "caller": "0x7fff577ce76a", "parentcaller": "0x7fff584cea0e", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "oleaut32.dll" }, { "name": "ModuleHandle", "value": "0x7fff58860000" } ], "repeated": 0, "id": 10512 }, { "timestamp": "2026-05-29 01:05:36,102", "thread_id": "4340", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432be00e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022a4" } ], "repeated": 0, "id": 10513 }, { "timestamp": "2026-05-29 01:05:36,102", "thread_id": "4340", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432be00e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022f8" } ], "repeated": 0, "id": 10514 }, { "timestamp": "2026-05-29 01:05:36,102", "thread_id": "4340", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432be00e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000236c" } ], "repeated": 0, "id": 10515 }, { "timestamp": "2026-05-29 01:05:36,102", "thread_id": "4340", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432be00e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000215c" } ], "repeated": 0, "id": 10516 }, { "timestamp": "2026-05-29 01:05:36,102", "thread_id": "4664", "caller": "0x7fff5809b283", "parentcaller": "0x7fff58088b47", "category": "windows", "api": "PostThreadMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessId", "value": "4484" }, { "name": "ThreadId", "value": "4488" }, { "name": "Message", "value": "0" } ], "repeated": 0, "id": 10517 }, { "timestamp": "2026-05-29 01:05:36,102", "thread_id": "4340", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432c3396", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022a0" } ], "repeated": 0, "id": 10518 }, { "timestamp": "2026-05-29 01:05:36,102", "thread_id": "2440", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432be00e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002304" } ], "repeated": 0, "id": 10519 }, { "timestamp": "2026-05-29 01:05:36,102", "thread_id": "2440", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432be00e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002284" } ], "repeated": 0, "id": 10520 }, { "timestamp": "2026-05-29 01:05:36,102", "thread_id": "2440", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432be00e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002108" } ], "repeated": 0, "id": 10521 }, { "timestamp": "2026-05-29 01:05:36,102", "thread_id": "2440", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432be00e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f80" } ], "repeated": 0, "id": 10522 }, { "timestamp": "2026-05-29 01:05:36,102", "thread_id": "2440", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432be00e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001080" } ], "repeated": 0, "id": 10523 }, { "timestamp": "2026-05-29 01:05:36,102", "thread_id": "2440", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432be00e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000020f4" } ], "repeated": 0, "id": 10524 }, { "timestamp": "2026-05-29 01:05:36,102", "thread_id": "2440", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432c3396", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000204c" } ], "repeated": 0, "id": 10525 }, { "timestamp": "2026-05-29 01:05:36,102", "thread_id": "4340", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff432c33a9", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09fe0000" }, { "name": "RegionSize", "value": "0x0000f000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 10526 }, { "timestamp": "2026-05-29 01:05:36,102", "thread_id": "4340", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432c3c47", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000021a4" } ], "repeated": 0, "id": 10527 }, { "timestamp": "2026-05-29 01:05:36,102", "thread_id": "4340", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432c3c5c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000020d4" } ], "repeated": 0, "id": 10528 }, { "timestamp": "2026-05-29 01:05:36,102", "thread_id": "4340", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432c3d86", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000228c" } ], "repeated": 0, "id": 10529 }, { "timestamp": "2026-05-29 01:05:36,102", "thread_id": "2440", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff432c33a9", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0fb30000" }, { "name": "RegionSize", "value": "0x0000f000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 10530 }, { "timestamp": "2026-05-29 01:05:36,102", "thread_id": "2440", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432c3c47", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" } ], "repeated": 0, "id": 10531 }, { "timestamp": "2026-05-29 01:05:36,102", "thread_id": "2440", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432c3c5c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002310" } ], "repeated": 0, "id": 10532 }, { "timestamp": "2026-05-29 01:05:36,102", "thread_id": "2440", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432c3d86", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f34" } ], "repeated": 0, "id": 10533 }, { "timestamp": "2026-05-29 01:05:36,102", "thread_id": "4340", "caller": "0x7fff5582a695", "parentcaller": "0x7fff5582a024", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002024" } ], "repeated": 0, "id": 10534 }, { "timestamp": "2026-05-29 01:05:36,102", "thread_id": "2440", "caller": "0x7fff577ce76a", "parentcaller": "0x7fff584cea0e", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "oleaut32.dll" }, { "name": "ModuleHandle", "value": "0x7fff58860000" } ], "repeated": 0, "id": 10535 }, { "timestamp": "2026-05-29 01:05:36,102", "thread_id": "2440", "caller": "0x7fff5809b283", "parentcaller": "0x7fff58088b47", "category": "windows", "api": "PostThreadMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessId", "value": "4484" }, { "name": "ThreadId", "value": "4488" }, { "name": "Message", "value": "0" } ], "repeated": 1, "id": 10536 }, { "timestamp": "2026-05-29 01:05:36,102", "thread_id": "2440", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5809da8f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000018f4" } ], "repeated": 0, "id": 10537 }, { "timestamp": "2026-05-29 01:05:36,102", "thread_id": "4340", "caller": "0x7fff577ce76a", "parentcaller": "0x7fff584cea0e", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "oleaut32.dll" }, { "name": "ModuleHandle", "value": "0x7fff58860000" } ], "repeated": 0, "id": 10538 }, { "timestamp": "2026-05-29 01:05:36,102", "thread_id": "4340", "caller": "0x7fff5809b283", "parentcaller": "0x7fff58088b47", "category": "windows", "api": "PostThreadMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessId", "value": "4484" }, { "name": "ThreadId", "value": "4488" }, { "name": "Message", "value": "0" } ], "repeated": 1, "id": 10539 }, { "timestamp": "2026-05-29 01:05:36,102", "thread_id": "4340", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5809da8f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f84" } ], "repeated": 0, "id": 10540 }, { "timestamp": "2026-05-29 01:05:37,649", "thread_id": "4340", "caller": "0x7fff577d6785", "parentcaller": "0x7fff59794159", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f00" } ], "repeated": 0, "id": 10541 }, { "timestamp": "2026-05-29 01:05:37,649", "thread_id": "4340", "caller": "0x7fff577d6785", "parentcaller": "0x7fff59798127", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000efc" } ], "repeated": 0, "id": 10542 }, { "timestamp": "2026-05-29 01:05:37,649", "thread_id": "4340", "caller": "0x7fff577d6785", "parentcaller": "0x7fff59794159", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000b10" } ], "repeated": 0, "id": 10543 }, { "timestamp": "2026-05-29 01:05:37,649", "thread_id": "4340", "caller": "0x7fff577d6785", "parentcaller": "0x7fff59798127", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000b14" } ], "repeated": 0, "id": 10544 }, { "timestamp": "2026-05-29 01:05:37,649", "thread_id": "4340", "caller": "0x7fff59767042", "parentcaller": "0x7fff59766fa4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 10545 }, { "timestamp": "2026-05-29 01:05:37,649", "thread_id": "4340", "caller": "0x7fff59767042", "parentcaller": "0x7fff59766fa4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000410" } ], "repeated": 0, "id": 10546 }, { "timestamp": "2026-05-29 01:05:38,618", "thread_id": "4956", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff557c3b23", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4956" } ], "repeated": 0, "id": 10547 }, { "timestamp": "2026-05-29 01:05:38,618", "thread_id": "4956", "caller": "0x7fff577ce76a", "parentcaller": "0x7fff584cea0e", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "oleaut32.dll" }, { "name": "ModuleHandle", "value": "0x7fff58860000" } ], "repeated": 0, "id": 10548 }, { "timestamp": "2026-05-29 01:05:41,008", "thread_id": "4572", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5978ef53", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000f34" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 10549 }, { "timestamp": "2026-05-29 01:05:45,680", "thread_id": "4696", "caller": "0x7ff79bcbc401", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "Handle", "value": "0x00002024" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 10550 }, { "timestamp": "2026-05-29 01:05:45,680", "thread_id": "4696", "caller": "0x7ff79bcbc434", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002024" }, { "name": "ValueName", "value": "IsFeedsAvailable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\IsFeedsAvailable" } ], "repeated": 0, "id": 10551 }, { "timestamp": "2026-05-29 01:05:45,680", "thread_id": "4696", "caller": "0x7ff79bcbc458", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002024" } ], "repeated": 0, "id": 10552 }, { "timestamp": "2026-05-29 01:05:45,680", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 10553 }, { "timestamp": "2026-05-29 01:05:45,680", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 10554 }, { "timestamp": "2026-05-29 01:05:45,680", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002024" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 10555 }, { "timestamp": "2026-05-29 01:05:45,680", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002024" }, { "name": "ValueName", "value": "HeadlinesOnboardingComplete" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\HeadlinesOnboardingComplete" } ], "repeated": 0, "id": 10556 }, { "timestamp": "2026-05-29 01:05:45,680", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002024" } ], "repeated": 0, "id": 10557 }, { "timestamp": "2026-05-29 01:05:45,680", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 10558 }, { "timestamp": "2026-05-29 01:05:45,680", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 10559 }, { "timestamp": "2026-05-29 01:05:45,680", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002024" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 10560 }, { "timestamp": "2026-05-29 01:05:45,680", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002024" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 10561 }, { "timestamp": "2026-05-29 01:05:45,680", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002024" } ], "repeated": 0, "id": 10562 }, { "timestamp": "2026-05-29 01:05:45,680", "thread_id": "4696", "caller": "0x7ff79bcd76b5", "parentcaller": "0x7ff79bce3037", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds\\DSB" }, { "name": "Handle", "value": "0x00000f84" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds\\DSB" } ], "repeated": 0, "id": 10563 }, { "timestamp": "2026-05-29 01:05:45,680", "thread_id": "4696", "caller": "0x7ff79bcd76e8", "parentcaller": "0x7ff79bce3037", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f84" }, { "name": "ValueName", "value": "IsDynamicContentAvailable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\DSB\\IsDynamicContentAvailable" } ], "repeated": 0, "id": 10564 }, { "timestamp": "2026-05-29 01:05:45,680", "thread_id": "4696", "caller": "0x7ff79bcd770c", "parentcaller": "0x7ff79bce3037", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f84" } ], "repeated": 0, "id": 10565 }, { "timestamp": "2026-05-29 01:05:45,680", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bce30c1", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 10566 }, { "timestamp": "2026-05-29 01:05:45,680", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bce30c1", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 10567 }, { "timestamp": "2026-05-29 01:05:45,680", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bce30c1", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000f84" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds\\DSB" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds\\DSB" } ], "repeated": 0, "id": 10568 }, { "timestamp": "2026-05-29 01:05:45,680", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bce30c1", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f84" }, { "name": "ValueName", "value": "IsEnabledByServer" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\DSB\\IsEnabledByServer" } ], "repeated": 0, "id": 10569 }, { "timestamp": "2026-05-29 01:05:45,680", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bce30c1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f84" } ], "repeated": 0, "id": 10570 }, { "timestamp": "2026-05-29 01:05:45,680", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bce30f7", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 10571 }, { "timestamp": "2026-05-29 01:05:45,680", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bce30f7", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 10572 }, { "timestamp": "2026-05-29 01:05:45,680", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bce30f7", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000f84" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds\\DSB" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds\\DSB" } ], "repeated": 0, "id": 10573 }, { "timestamp": "2026-05-29 01:05:45,680", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bce30f7", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000f84" }, { "name": "ValueName", "value": "ShowDynamicContent" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\DSB\\ShowDynamicContent" } ], "repeated": 0, "id": 10574 }, { "timestamp": "2026-05-29 01:05:45,680", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bce30f7", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f84" } ], "repeated": 0, "id": 10575 }, { "timestamp": "2026-05-29 01:05:45,680", "thread_id": "4696", "caller": "0x7ff79bce3258", "parentcaller": "0x7ff79bd23c75", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Accessibility" }, { "name": "Handle", "value": "0x00000f84" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Accessibility" } ], "repeated": 0, "id": 10576 }, { "timestamp": "2026-05-29 01:05:45,680", "thread_id": "4696", "caller": "0x7ff79bce3258", "parentcaller": "0x7ff79bd23c75", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000f84" }, { "name": "ValueName", "value": "TextScaleFactor" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Accessibility\\TextScaleFactor" } ], "repeated": 0, "id": 10577 }, { "timestamp": "2026-05-29 01:05:45,680", "thread_id": "4696", "caller": "0x7ff79bce3258", "parentcaller": "0x7ff79bd23c75", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f84" } ], "repeated": 0, "id": 10578 }, { "timestamp": "2026-05-29 01:05:45,680", "thread_id": "4696", "caller": "0x7ff79bc700a1", "parentcaller": "0x7ff79bc6fefd", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 10579 }, { "timestamp": "2026-05-29 01:05:45,680", "thread_id": "4696", "caller": "0x7ff79bc700a1", "parentcaller": "0x7ff79bc6fefd", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 10580 }, { "timestamp": "2026-05-29 01:05:45,680", "thread_id": "4696", "caller": "0x7ff79bc700a1", "parentcaller": "0x7ff79bc6fefd", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" } ], "repeated": 0, "id": 10581 }, { "timestamp": "2026-05-29 01:05:45,680", "thread_id": "4696", "caller": "0x7ff79bc6ffe2", "parentcaller": "0x7ff79bc6ff23", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 10582 }, { "timestamp": "2026-05-29 01:05:45,680", "thread_id": "4696", "caller": "0x7ff79bc6ffe2", "parentcaller": "0x7ff79bc6ff23", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 10583 }, { "timestamp": "2026-05-29 01:05:45,680", "thread_id": "4696", "caller": "0x7ff79bc6ffe2", "parentcaller": "0x7ff79bc6ff23", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000f84" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" } ], "repeated": 0, "id": 10584 }, { "timestamp": "2026-05-29 01:05:45,680", "thread_id": "4696", "caller": "0x7ff79bc6ffe2", "parentcaller": "0x7ff79bc6ff23", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000f84" }, { "name": "ValueName", "value": "Current" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Current" } ], "repeated": 0, "id": 10585 }, { "timestamp": "2026-05-29 01:05:45,680", "thread_id": "4696", "caller": "0x7ff79bc6ffe2", "parentcaller": "0x7ff79bc6ff23", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f84" } ], "repeated": 0, "id": 10586 }, { "timestamp": "2026-05-29 01:05:45,680", "thread_id": "4696", "caller": "0x7ff79bc700a1", "parentcaller": "0x7ff79bc6fefd", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 10587 }, { "timestamp": "2026-05-29 01:05:45,680", "thread_id": "4696", "caller": "0x7ff79bc700a1", "parentcaller": "0x7ff79bc6fefd", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 10588 }, { "timestamp": "2026-05-29 01:05:45,680", "thread_id": "4696", "caller": "0x7ff79bc700a1", "parentcaller": "0x7ff79bc6fefd", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" } ], "repeated": 0, "id": 10589 }, { "timestamp": "2026-05-29 01:05:45,680", "thread_id": "4696", "caller": "0x7ff79bc6ffe2", "parentcaller": "0x7ff79bc6ff23", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 10590 }, { "timestamp": "2026-05-29 01:05:45,680", "thread_id": "4696", "caller": "0x7ff79bc6ffe2", "parentcaller": "0x7ff79bc6ff23", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 10591 }, { "timestamp": "2026-05-29 01:05:45,680", "thread_id": "4696", "caller": "0x7ff79bc6ffe2", "parentcaller": "0x7ff79bc6ff23", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000f84" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" } ], "repeated": 0, "id": 10592 }, { "timestamp": "2026-05-29 01:05:45,680", "thread_id": "4696", "caller": "0x7ff79bc6ffe2", "parentcaller": "0x7ff79bc6ff23", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000f84" }, { "name": "ValueName", "value": "Current" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Current" } ], "repeated": 0, "id": 10593 }, { "timestamp": "2026-05-29 01:05:45,680", "thread_id": "4696", "caller": "0x7ff79bc6ffe2", "parentcaller": "0x7ff79bc6ff23", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f84" } ], "repeated": 0, "id": 10594 }, { "timestamp": "2026-05-29 01:05:45,680", "thread_id": "4696", "caller": "0x7ff79bc8a9d0", "parentcaller": "0x7ff79bd243bc", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 10595 }, { "timestamp": "2026-05-29 01:05:45,680", "thread_id": "4696", "caller": "0x7ff79bc8a9d0", "parentcaller": "0x7ff79bd243bc", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 10596 }, { "timestamp": "2026-05-29 01:05:45,680", "thread_id": "4696", "caller": "0x7ff79bc8a9d0", "parentcaller": "0x7ff79bd243bc", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000f84" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds\\DSB" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds\\DSB" } ], "repeated": 0, "id": 10597 }, { "timestamp": "2026-05-29 01:05:45,680", "thread_id": "4696", "caller": "0x7ff79bc8a9d0", "parentcaller": "0x7ff79bd243bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f84" }, { "name": "ValueName", "value": "UseDefaultGleam" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\DSB\\UseDefaultGleam" } ], "repeated": 0, "id": 10598 }, { "timestamp": "2026-05-29 01:05:45,680", "thread_id": "4696", "caller": "0x7ff79bc8a9d0", "parentcaller": "0x7ff79bd243bc", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f84" } ], "repeated": 0, "id": 10599 }, { "timestamp": "2026-05-29 01:05:45,680", "thread_id": "4696", "caller": "0x7ff79bd23060", "parentcaller": "0x7ff79bd23c7e", "category": "filesystem", "api": "NtQueryAttributesFile", "status": false, "return": "0xffffffffc000003a", "pretty_return": "OBJECT_PATH_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\%localappdata%\\Packages\\Microsoft.Search_8wekyb3d8bbwe\\LocalState\\ShellFeeds" } ], "repeated": 0, "id": 10600 }, { "timestamp": "2026-05-29 01:05:45,680", "thread_id": "4696", "caller": "0x7ff79bd23165", "parentcaller": "0x7ff79bd23c7e", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Packages\\Microsoft.Windows.Search_cw5n1h2txyewy\\LocalState\\ShellFeeds\\GLEAM-LIGHT.svg" } ], "repeated": 0, "id": 10601 }, { "timestamp": "2026-05-29 01:05:45,680", "thread_id": "4696", "caller": "0x7ff79bd23186", "parentcaller": "0x7ff79bd23c7e", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Packages\\Microsoft.Windows.Search_cw5n1h2txyewy\\LocalState\\ShellFeeds\\GLEAM-DARK.svg" } ], "repeated": 0, "id": 10602 }, { "timestamp": "2026-05-29 01:05:45,680", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd17693", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 10603 }, { "timestamp": "2026-05-29 01:05:45,680", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd17693", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 10604 }, { "timestamp": "2026-05-29 01:05:45,680", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd17693", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000f84" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds\\DSB" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds\\DSB" } ], "repeated": 0, "id": 10605 }, { "timestamp": "2026-05-29 01:05:45,680", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd17693", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000f84" }, { "name": "ValueName", "value": "GleamSizeEnum" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\DSB\\GleamSizeEnum" } ], "repeated": 0, "id": 10606 }, { "timestamp": "2026-05-29 01:05:45,680", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd17693", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f84" } ], "repeated": 0, "id": 10607 }, { "timestamp": "2026-05-29 01:05:45,680", "thread_id": "4696", "caller": "0x7ff79bc8a9d0", "parentcaller": "0x7ff79bd243bc", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 10608 }, { "timestamp": "2026-05-29 01:05:45,680", "thread_id": "4696", "caller": "0x7ff79bc8a9d0", "parentcaller": "0x7ff79bd243bc", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 10609 }, { "timestamp": "2026-05-29 01:05:45,680", "thread_id": "4696", "caller": "0x7ff79bc8a9d0", "parentcaller": "0x7ff79bd243bc", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000f84" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds\\DSB" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds\\DSB" } ], "repeated": 0, "id": 10610 }, { "timestamp": "2026-05-29 01:05:45,680", "thread_id": "4696", "caller": "0x7ff79bc8a9d0", "parentcaller": "0x7ff79bd243bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f84" }, { "name": "ValueName", "value": "UseDefaultGleam" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\DSB\\UseDefaultGleam" } ], "repeated": 0, "id": 10611 }, { "timestamp": "2026-05-29 01:05:45,680", "thread_id": "4696", "caller": "0x7ff79bc8a9d0", "parentcaller": "0x7ff79bd243bc", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f84" } ], "repeated": 0, "id": 10612 }, { "timestamp": "2026-05-29 01:05:45,680", "thread_id": "4696", "caller": "0x7ff79bd278e4", "parentcaller": "0x7ff79bd24fa0", "category": "filesystem", "api": "NtQueryAttributesFile", "status": false, "return": "0xffffffffc000003a", "pretty_return": "OBJECT_PATH_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\%localappdata%\\Packages\\Microsoft.Search_8wekyb3d8bbwe\\LocalState\\ShellFeeds" } ], "repeated": 0, "id": 10613 }, { "timestamp": "2026-05-29 01:05:45,680", "thread_id": "4696", "caller": "0x7ff79bd27a68", "parentcaller": "0x7ff79bd24fa0", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Packages\\Microsoft.Windows.Search_cw5n1h2txyewy\\LocalState\\ShellFeeds\\GLEAM-LIGHT.svg" } ], "repeated": 0, "id": 10614 }, { "timestamp": "2026-05-29 01:05:45,680", "thread_id": "4696", "caller": "0x7ff79bd27be7", "parentcaller": "0x7ff79bd24fa0", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f84" }, { "name": "MutexName", "value": "" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 10615 }, { "timestamp": "2026-05-29 01:05:45,680", "thread_id": "4696", "caller": "0x7ff79bd27be7", "parentcaller": "0x7ff79bd24fa0", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000020f4" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Packages\\Microsoft.Windows.Search_cw5n1h2txyewy\\LocalState\\ShellFeeds\\GLEAM-LIGHT.svg" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 10616 }, { "timestamp": "2026-05-29 01:05:45,680", "thread_id": "4696", "caller": "0x7ff79bd2c53a", "parentcaller": "0x7ff79bd27dd7", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f84" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 10617 }, { "timestamp": "2026-05-29 01:05:45,680", "thread_id": "4696", "caller": "0x7ff79bd2c53a", "parentcaller": "0x7ff79bd27dd7", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 10618 }, { "timestamp": "2026-05-29 01:05:45,680", "thread_id": "4696", "caller": "0x7ff79bd2c53a", "parentcaller": "0x7ff79bd27dd7", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f84" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 10619 }, { "timestamp": "2026-05-29 01:05:45,680", "thread_id": "4696", "caller": "0x7ff79bd2c53a", "parentcaller": "0x7ff79bd27dd7", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f84" } ], "repeated": 0, "id": 10620 }, { "timestamp": "2026-05-29 01:05:45,680", "thread_id": "4696", "caller": "0x7ff79bd2c53a", "parentcaller": "0x7ff79bd27dd7", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000020f4" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Packages\\Microsoft.Windows.Search_cw5n1h2txyewy\\LocalState\\ShellFeeds\\GLEAM-LIGHT.svg" }, { "name": "Buffer", "value": "\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\\x00 \\x00 \\x00\\x00\\x00\\x16\\x00\\x00\\x00\\x00\\x00\\x00\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00 \\x00E\\x00d\\x00g\\x00e\\x00.\\x00l\\x00n\\x00k\\x00>\\x00 \\x00|\\x00\\x00\\x00\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00G\\x00m\\x00a\\x00i\\x00l\\x00.\\x00u\\x00r\\x00l\\x00>\\x00 \\x00 \\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00W\\x00h\\x00a\\x00t\\x00s\\x00A\\x00p\\x00p\\x00 \\x00W\\x00e\\x00b\\x00.\\x00u\\x00r\\x00l\\x00>\\x00 \\x00 \\x00\\x00\\x00\\x15\\x00\\x00\\x00\\x00\\x00\\x00\\x00G\\x00o\\x00o\\x00g\\x00l\\x00e\\x00 \\x00C\\x00h\\x00r\\x00o\\x00m\\x00e\\x00.\\x00l\\x00n\\x00k\\x00>\\x00 \\x00|\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00D\\x00i\\x00s\\x00c\\x00o\\x00r\\x00d\\x00.\\x00l\\x00n\\x00k\\x00>\\x00 \\x00 \\x00\\x00\\x00\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00S\\x00t\\x00e\\x00a\\x00m\\x00.\\x00l\\x00n\\x00k\\x00>\\x00 \\x00|\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x19\\x00\\x00\\x00\n\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80@\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80?\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0@\\x06\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0@\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00@@" }, { "name": "BufferLength", "value": "514" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\Shell\\Bags\\1\\Desktop\\IconLayouts" } ], "repeated": 0, "id": 20555 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff48bc1b97", "parentcaller": "0x7fff48bbff1e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 20556 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000025c8" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 20557 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000026c8" } ], "repeated": 0, "id": 20558 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xc0\\xec:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00@\\xed:\\x03\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x83!,C\\xff\\x7f\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\xb3\\xf3\\x08\\x00\\x00\\x00\\x00p\\xed:\\x03\\x00\\x00\\x00\\x00f@5X\\xff\\x7f\\x00\\x00\\xca\n\\x055\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xca\n\\x055\\x00\\x00\\x00\\x00\\xc9\\x1f,C\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xff\\x7f\\x00\\x00" } ], "repeated": 0, "id": 20559 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "system", "api": "GetUserDefaultLCID", "status": true, "return": "0x00000c09", "arguments": [ { "name": "SystemDefaultLangID", "value": "0x00000c09" }, { "name": "LanguageName", "value": "English (Australia)" } ], "repeated": 0, "id": 20560 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000468" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 20561 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff48bc1d86", "parentcaller": "0x7fff48bbfe51", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 20562 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025f4" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 20563 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff48bc1b97", "parentcaller": "0x7fff48bbff1e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 20564 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026c8" } ], "repeated": 0, "id": 20565 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025c8" } ], "repeated": 0, "id": 20566 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000b08" }, { "name": "ValueName", "value": "IconNameVersion" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Buffer", "value": "1" }, { "name": "BufferLength", "value": "4" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\Shell\\Bags\\1\\Desktop\\IconNameVersion" } ], "repeated": 0, "id": 20567 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 20568 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000dcc" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 20569 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff41354f82", "parentcaller": "0x7fff41354da0", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000004c6" }, { "name": "SubKey", "value": "{000214A0-0000-0000-C000-000000000046}" }, { "name": "Handle", "value": "0x0000228e" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\\Instance\\PropertySetStorage\\{000214A0-0000-0000-C000-000000000046}" } ], "repeated": 0, "id": 20570 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4340", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000026a0" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 20571 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4340", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000268c" } ], "repeated": 0, "id": 20572 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff41355d10", "parentcaller": "0x7fff41355c77", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000228e" }, { "name": "SubKey", "value": "8" }, { "name": "Handle", "value": "0x0000236e" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\\Instance\\PropertySetStorage\\{000214A0-0000-0000-C000-000000000046}\\8" } ], "repeated": 0, "id": 20573 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4340", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001170" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 20574 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff41355e24", "parentcaller": "0x7fff41355d40", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000236e" }, { "name": "ValueName", "value": "Section" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\\Instance\\PropertySetStorage\\{000214A0-0000-0000-C000-000000000046}\\8\\Section" } ], "repeated": 0, "id": 20575 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4340", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" } ], "repeated": 0, "id": 20576 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff41355e24", "parentcaller": "0x7fff41355d56", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000228e" }, { "name": "ValueName", "value": "Section" }, { "name": "Data", "value": "InternetShortcut" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\\Instance\\PropertySetStorage\\{000214A0-0000-0000-C000-000000000046}\\Section" } ], "repeated": 0, "id": 20577 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4340", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026a0" } ], "repeated": 0, "id": 20578 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4340", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001170" } ], "repeated": 0, "id": 20579 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff41355e24", "parentcaller": "0x7fff41355d74", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000236e" }, { "name": "ValueName", "value": "Key" }, { "name": "Data", "value": "IconIndex" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\\Instance\\PropertySetStorage\\{000214A0-0000-0000-C000-000000000046}\\8\\Key" } ], "repeated": 0, "id": 20580 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff41355daf", "parentcaller": "0x7fff41355c77", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000236e" }, { "name": "ValueName", "value": "VarType" }, { "name": "Data", "value": "3" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\\Instance\\PropertySetStorage\\{000214A0-0000-0000-C000-000000000046}\\8\\VarType" } ], "repeated": 0, "id": 20581 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff41355dd0", "parentcaller": "0x7fff41355c77", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000236e" } ], "repeated": 0, "id": 20582 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff41354ea3", "parentcaller": "0x7fff41354e44", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000228e" } ], "repeated": 0, "id": 20583 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff41354f82", "parentcaller": "0x7fff41354da0", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000004c6" }, { "name": "SubKey", "value": "{000214A0-0000-0000-C000-000000000046}" }, { "name": "Handle", "value": "0x0000228e" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\\Instance\\PropertySetStorage\\{000214A0-0000-0000-C000-000000000046}" } ], "repeated": 0, "id": 20584 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff41355d10", "parentcaller": "0x7fff41355c77", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000228e" }, { "name": "SubKey", "value": "15" }, { "name": "Handle", "value": "0x0000236e" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\\Instance\\PropertySetStorage\\{000214A0-0000-0000-C000-000000000046}\\15" } ], "repeated": 0, "id": 20585 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d09f7", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000236e" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 20586 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x90\\xc0\\xfc\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00n#\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xc1\\xfc\\x07\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 20587 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d09f7", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\\Instance\\PropertySetStorage\\{000214A0-0000-0000-C000-000000000046}\\15" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\\Instance\\PropertySetStorage\\{000214A0-0000-0000-C000-000000000046}\\15" } ], "repeated": 0, "id": 20588 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff577d3e41", "parentcaller": "0x7fff578543b9", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000236e" }, { "name": "ValueName", "value": "Section" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\\Instance\\PropertySetStorage\\{000214A0-0000-0000-C000-000000000046}\\15\\Section" } ], "repeated": 0, "id": 20589 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff41355e24", "parentcaller": "0x7fff41355d56", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000228e" }, { "name": "ValueName", "value": "Section" }, { "name": "Data", "value": "InternetShortcut" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\\Instance\\PropertySetStorage\\{000214A0-0000-0000-C000-000000000046}\\Section" } ], "repeated": 0, "id": 20590 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4340", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000025bc" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\xf0\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xe3\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 20591 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff41355e24", "parentcaller": "0x7fff41355d74", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000236e" }, { "name": "ValueName", "value": "Key" }, { "name": "Data", "value": "Roamed" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\\Instance\\PropertySetStorage\\{000214A0-0000-0000-C000-000000000046}\\15\\Key" } ], "repeated": 0, "id": 20592 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4340", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002644" } ], "repeated": 0, "id": 20593 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000025f4" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 20594 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000025c8" } ], "repeated": 0, "id": 20595 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026c8" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 20596 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025c8" } ], "repeated": 0, "id": 20597 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025f4" } ], "repeated": 0, "id": 20598 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff41355daf", "parentcaller": "0x7fff41355c77", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000236e" }, { "name": "ValueName", "value": "VarType" }, { "name": "Data", "value": "11" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\\Instance\\PropertySetStorage\\{000214A0-0000-0000-C000-000000000046}\\15\\VarType" } ], "repeated": 0, "id": 20599 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000dcc" } ], "repeated": 0, "id": 20600 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000dcc" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 20601 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff41355dd0", "parentcaller": "0x7fff41355c77", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000236e" } ], "repeated": 0, "id": 20602 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff41354ea3", "parentcaller": "0x7fff41354e44", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000228e" } ], "repeated": 0, "id": 20603 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff48bc1d86", "parentcaller": "0x7fff48bbfe51", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 20604 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff41354f82", "parentcaller": "0x7fff41354da0", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000004c6" }, { "name": "SubKey", "value": "{000214A0-0000-0000-C000-000000000046}" }, { "name": "Handle", "value": "0x0000228e" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\\Instance\\PropertySetStorage\\{000214A0-0000-0000-C000-000000000046}" } ], "repeated": 0, "id": 20605 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff41355d10", "parentcaller": "0x7fff41355c77", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000228e" }, { "name": "SubKey", "value": "2" }, { "name": "Handle", "value": "0x0000236e" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\\Instance\\PropertySetStorage\\{000214A0-0000-0000-C000-000000000046}\\2" } ], "repeated": 0, "id": 20606 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4340", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002380" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_32.db" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 20607 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff41355e24", "parentcaller": "0x7fff41355d40", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000236e" }, { "name": "ValueName", "value": "Section" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\\Instance\\PropertySetStorage\\{000214A0-0000-0000-C000-000000000046}\\2\\Section" } ], "repeated": 0, "id": 20608 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff41355e24", "parentcaller": "0x7fff41355d56", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000228e" }, { "name": "ValueName", "value": "Section" }, { "name": "Data", "value": "InternetShortcut" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\\Instance\\PropertySetStorage\\{000214A0-0000-0000-C000-000000000046}\\Section" } ], "repeated": 0, "id": 20609 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff41355e24", "parentcaller": "0x7fff41355d74", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000236e" }, { "name": "ValueName", "value": "Key" }, { "name": "Data", "value": "URL" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\\Instance\\PropertySetStorage\\{000214A0-0000-0000-C000-000000000046}\\2\\Key" } ], "repeated": 0, "id": 20610 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff41355daf", "parentcaller": "0x7fff41355c77", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000236e" }, { "name": "ValueName", "value": "VarType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\\Instance\\PropertySetStorage\\{000214A0-0000-0000-C000-000000000046}\\2\\VarType" } ], "repeated": 0, "id": 20611 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff41355dd0", "parentcaller": "0x7fff41355c77", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000236e" } ], "repeated": 0, "id": 20612 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4340", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000264c" } ], "repeated": 0, "id": 20613 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff48bc1d86", "parentcaller": "0x7fff48bbfe51", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 20614 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "5100", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bc79b", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000025f4" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 20615 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff48bc1b97", "parentcaller": "0x7fff48bbff1e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 20616 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4340", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001170" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 20617 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "5100", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bc7ca", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000025c8" } ], "repeated": 0, "id": 20618 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff48bc1d86", "parentcaller": "0x7fff48bbfe51", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 20619 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "5100", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bc8d0", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x00002368" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 20620 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "5100", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8e4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025c8" } ], "repeated": 0, "id": 20621 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "5100", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025f4" } ], "repeated": 0, "id": 20622 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4340", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x90\\xe7\\xf6\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\xc8\\xe8\\xf6\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00C\\x10,C\\xff\\x7f\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb8\\xac,C\\xff\\x7f\\x00\\x00\\xb0\\x1a\\xc5\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xe9\\xf6\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\xb0\\x1a\\xc5\\x0b\\x00\\x00\\x00\\x00\\xe7\\xab,C\\xff\\x7f\\x00\\x00\\xb0\\x1a\\xc5\\x0b\\x00\\x00\\x00\\x00iq\\x82\\x06\\xea[\\x00\\x00" } ], "repeated": 0, "id": 20623 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026c8" } ], "repeated": 0, "id": 20624 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "5100", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bbd11", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000fd4" } ], "repeated": 0, "id": 20625 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4340", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "MutexName", "value": "" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 20626 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000026c8" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 20627 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002368" } ], "repeated": 0, "id": 20628 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "5100", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432c182f", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 20629 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "5100", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432c182f", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000ed8" }, { "name": "Milliseconds", "value": "5000" } ], "repeated": 0, "id": 20630 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xc0\\xec:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00@\\xed:\\x03\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x83!,C\\xff\\x7f\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\xb3\\xf3\\x08\\x00\\x00\\x00\\x00p\\xed:\\x03\\x00\\x00\\x00\\x00f@5X\\xff\\x7f\\x00\\x00\\xca\n\\x055\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xca\n\\x055\\x00\\x00\\x00\\x00\\xc9\\x1f,C\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xff\\x7f\\x00\\x00" } ], "repeated": 0, "id": 20631 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025f4" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 20632 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002368" } ], "repeated": 0, "id": 20633 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026c8" } ], "repeated": 0, "id": 20634 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4340", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026a0" } ], "repeated": 0, "id": 20635 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff48bc1d86", "parentcaller": "0x7fff48bbfe51", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 20636 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000dcc" } ], "repeated": 0, "id": 20637 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 20638 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000dcc" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 20639 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000026c8" } ], "repeated": 0, "id": 20640 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff48bc1d86", "parentcaller": "0x7fff48bbfe51", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 20641 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4340", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001170" } ], "repeated": 0, "id": 20642 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xec:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc7\\xb3\\xf7Y\\xff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\xff\\x7f\\x00\\x00i}N\\x0c\\xea[\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00(\\xef:\\x03\\x00\\x00\\x00\\x00\\x80ba\\x07\\x00\\x00\\x00\\x00\\xd0mm\\x07\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\xca\n\\x055\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 20643 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff48bc1b97", "parentcaller": "0x7fff48bbff1e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 20644 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026c8" } ], "repeated": 0, "id": 20645 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025f4" } ], "repeated": 0, "id": 20646 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4340", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" } ], "repeated": 0, "id": 20647 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000dcc" } ], "repeated": 0, "id": 20648 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002700" }, { "name": "DesiredAccess", "value": "0xc0100080", "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_32.db" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 20649 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000dcc" } ], "repeated": 0, "id": 20650 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 20651 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000dcc" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 20652 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000026c8" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 20653 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002368" } ], "repeated": 0, "id": 20654 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xec:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc7\\xb3\\xf7Y\\xff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\xff\\x7f\\x00\\x00i}N\\x0c\\xea[\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00(\\xef:\\x03\\x00\\x00\\x00\\x00\\x80ba\\x07\\x00\\x00\\x00\\x00\\xd0mm\\x07\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\xca\n\\x055\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 20655 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025f4" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 20656 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002368" } ], "repeated": 0, "id": 20657 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026c8" } ], "repeated": 0, "id": 20658 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000dcc" } ], "repeated": 0, "id": 20659 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff577d07f5", "parentcaller": "0x7fff577cc03b", "category": "filesystem", "api": "NtQueryAttributesFile", "status": false, "return": "0xffffffffc000003a", "pretty_return": "OBJECT_PATH_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Internet Explorer\\pin10470985910\\rawicon.png" } ], "repeated": 0, "id": 20660 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "5100", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" } ], "repeated": 0, "id": 20661 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "5100", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bbccd", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026f8" } ], "repeated": 0, "id": 20662 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "5100", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bbd11", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000fd4" } ], "repeated": 0, "id": 20663 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025f4" } ], "repeated": 0, "id": 20664 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000025f4" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 20665 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "5100", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432c182f", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 20666 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "5100", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432c182f", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000ed8" }, { "name": "Milliseconds", "value": "5000" } ], "repeated": 0, "id": 20667 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000026c8" } ], "repeated": 0, "id": 20668 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xc0\\xec:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00@\\xed:\\x03\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x83!,C\\xff\\x7f\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\xb3\\xf3\\x08\\x00\\x00\\x00\\x00p\\xed:\\x03\\x00\\x00\\x00\\x00f@5X\\xff\\x7f\\x00\\x00\\xca\n\\x055\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xca\n\\x055\\x00\\x00\\x00\\x00\\xc9\\x1f,C\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xff\\x7f\\x00\\x00" } ], "repeated": 0, "id": 20669 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002368" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 20670 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026c8" } ], "repeated": 0, "id": 20671 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002368" } ], "repeated": 0, "id": 20672 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000dcc" } ], "repeated": 0, "id": 20673 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 20674 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000dcc" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 20675 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002368" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 20676 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000025f4" } ], "repeated": 0, "id": 20677 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "5100", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bbc69", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000fd4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 20678 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xec:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc7\\xb3\\xf7Y\\xff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\xff\\x7f\\x00\\x00i}N\\x0c\\xea[\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00(\\xef:\\x03\\x00\\x00\\x00\\x00\\x80ba\\x07\\x00\\x00\\x00\\x00\\xd0mm\\x07\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\xca\n\\x055\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 20679 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026c8" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 20680 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025f4" } ], "repeated": 0, "id": 20681 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002700" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_32.db" }, { "name": "FileInformationClass", "value": "74" }, { "name": "FileInformation", "value": "\\x02\\x00\\x00\\x00" } ], "repeated": 0, "id": 20682 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002368" } ], "repeated": 0, "id": 20683 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000dcc" } ], "repeated": 0, "id": 20684 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000dcc" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 20685 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "5100", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bc79b", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002368" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 20686 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "5100", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bc7ca", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000026f8" } ], "repeated": 0, "id": 20687 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff41354f82", "parentcaller": "0x7fff41354da0", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000004c6" }, { "name": "SubKey", "value": "{000214A0-0000-0000-C000-000000000046}" }, { "name": "Handle", "value": "0x000025f6" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\\Instance\\PropertySetStorage\\{000214A0-0000-0000-C000-000000000046}" } ], "repeated": 0, "id": 20688 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "5100", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bc7fe", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xd0\\xe4\\x0f\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf8&\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 20689 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4340", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000100c4" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 20690 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff41355d10", "parentcaller": "0x7fff41355c77", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000025f6" }, { "name": "SubKey", "value": "3" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\\Instance\\PropertySetStorage\\{000214A0-0000-0000-C000-000000000046}\\3" } ], "repeated": 0, "id": 20691 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "5100", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bc8d0", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x000021a4" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 20692 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff41354ea3", "parentcaller": "0x7fff41354e44", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025f6" } ], "repeated": 0, "id": 20693 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "5100", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8e4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026f8" } ], "repeated": 0, "id": 20694 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "5100", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002368" } ], "repeated": 0, "id": 20695 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002700" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_32.db" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 20696 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "5100", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bbd11", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000fd4" } ], "repeated": 0, "id": 20697 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "5100", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432c182f", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 20698 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "5100", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432c182f", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000ed8" }, { "name": "Milliseconds", "value": "5000" } ], "repeated": 0, "id": 20699 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026c8" } ], "repeated": 0, "id": 20700 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000026c8" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 20701 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000025b4" }, { "name": "DesiredAccess", "value": "0x000f0007", "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_WRITE" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x00002700" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_32.db" } ], "repeated": 0, "id": 20702 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5585211d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" } ], "repeated": 0, "id": 20703 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000026c8" } ], "repeated": 0, "id": 20704 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xec:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc7\\xb3\\xf7Y\\xff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\xff\\x7f\\x00\\x00i}N\\x0c\\xea[\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00(\\xef:\\x03\\x00\\x00\\x00\\x00\\x80ba\\x07\\x00\\x00\\x00\\x00\\xd0mm\\x07\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\xca\n\\x055\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 20705 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025f4" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 20706 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026c8" } ], "repeated": 0, "id": 20707 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000dcc" } ], "repeated": 0, "id": 20708 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000dcc" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 20709 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025f4" } ], "repeated": 0, "id": 20710 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000025f4" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 20711 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff5808af28", "parentcaller": "0x7fff558b5c98", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "https" }, { "name": "Handle", "value": "0x0000268e" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\https" } ], "repeated": 0, "id": 20712 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000025c8" } ], "repeated": 0, "id": 20713 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xc0\\xec:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00@\\xed:\\x03\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x83!,C\\xff\\x7f\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\xb3\\xf3\\x08\\x00\\x00\\x00\\x00p\\xed:\\x03\\x00\\x00\\x00\\x00f@5X\\xff\\x7f\\x00\\x00\\xca\n\\x055\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xca\n\\x055\\x00\\x00\\x00\\x00\\xc9\\x1f,C\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xff\\x7f\\x00\\x00" } ], "repeated": 0, "id": 20714 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026c8" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 20715 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 20716 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000dcc" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 20717 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000026c8" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 20718 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff5808af81", "parentcaller": "0x7fff558b5c98", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268e" }, { "name": "ValueName", "value": "URL Protocol" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\https\\URL Protocol" } ], "repeated": 0, "id": 20719 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025f4" } ], "repeated": 0, "id": 20720 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff5808afd1", "parentcaller": "0x7fff558b5c98", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268e" } ], "repeated": 0, "id": 20721 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000dcc" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 20722 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025c8" } ], "repeated": 0, "id": 20723 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000025c8" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 20724 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000026c8" } ], "repeated": 0, "id": 20725 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xc0\\xec:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00@\\xed:\\x03\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x83!,C\\xff\\x7f\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\xb3\\xf3\\x08\\x00\\x00\\x00\\x00p\\xed:\\x03\\x00\\x00\\x00\\x00f@5X\\xff\\x7f\\x00\\x00\\xca\n\\x055\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xca\n\\x055\\x00\\x00\\x00\\x00\\xc9\\x1f,C\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xff\\x7f\\x00\\x00" } ], "repeated": 0, "id": 20726 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025f4" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 20727 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff58081596", "parentcaller": "0x7fff58ac668d", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\RegisteredApplications" }, { "name": "Handle", "value": "0x0000268c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\RegisteredApplications" } ], "repeated": 0, "id": 20728 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026c8" } ], "repeated": 0, "id": 20729 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025c8" } ], "repeated": 0, "id": 20730 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff580a4162", "parentcaller": "0x7fff5809ffae", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000268c" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "36" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 20731 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000dcc" } ], "repeated": 0, "id": 20732 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 20733 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000dcc" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 20734 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff5809dff7", "parentcaller": "0x7fff5809b764", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "Index", "value": "0" }, { "name": "ValueName", "value": "AppXen1zmpxj5y8hccxeamgss1pv44xm9s4c" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "DataLength", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppXen1zmpxj5y8hccxeamgss1pv44xm9s4c" } ], "repeated": 0, "id": 20735 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xec:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc7\\xb3\\xf7Y\\xff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\xff\\x7f\\x00\\x00i}N\\x0c\\xea[\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00(\\xef:\\x03\\x00\\x00\\x00\\x00\\x80ba\\x07\\x00\\x00\\x00\\x00\\xd0mm\\x07\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\xca\n\\x055\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 20736 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026c8" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 20737 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff577d3e41", "parentcaller": "0x7fff578543b9", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x0000268c" }, { "name": "ValueName", "value": "AppXen1zmpxj5y8hccxeamgss1pv44xm9s4c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppXen1zmpxj5y8hccxeamgss1pv44xm9s4c" } ], "repeated": 0, "id": 20738 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025c8" } ], "repeated": 0, "id": 20739 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025f4" } ], "repeated": 0, "id": 20740 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000dcc" } ], "repeated": 0, "id": 20741 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000dcc" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 20742 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002700" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_32.db" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 20743 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff5808b02d", "parentcaller": "0x7fff5808ad08", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "ValueName", "value": "AppXen1zmpxj5y8hccxeamgss1pv44xm9s4c" }, { "name": "Data", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.Windows.CloudExperienceHost_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\App\\Capabilities" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppXen1zmpxj5y8hccxeamgss1pv44xm9s4c" } ], "repeated": 0, "id": 20744 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026c8" } ], "repeated": 0, "id": 20745 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000025f4" } ], "repeated": 0, "id": 20746 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xc0\\xec:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00@\\xed:\\x03\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x83!,C\\xff\\x7f\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\xb3\\xf3\\x08\\x00\\x00\\x00\\x00p\\xed:\\x03\\x00\\x00\\x00\\x00f@5X\\xff\\x7f\\x00\\x00\\xca\n\\x055\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xca\n\\x055\\x00\\x00\\x00\\x00\\xc9\\x1f,C\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xff\\x7f\\x00\\x00" } ], "repeated": 0, "id": 20747 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff558118a7", "parentcaller": "0x7fff558117bd", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.Windows.CloudExperienceHost_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\App\\Capabilities\\UrlAssociations" }, { "name": "Handle", "value": "0x00001170" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.Windows.CloudExperienceHost_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\App\\Capabilities\\UrlAssociations" } ], "repeated": 0, "id": 20748 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025f4" } ], "repeated": 0, "id": 20749 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 20750 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f80" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 20751 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026c8" } ], "repeated": 0, "id": 20752 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "5100", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bbc69", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000fd4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 20753 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025c8" } ], "repeated": 0, "id": 20754 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4340", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\xfe\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xf4\\x10\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4340" } ], "repeated": 0, "id": 20755 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000dcc" } ], "repeated": 0, "id": 20756 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 20757 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000dcc" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 20758 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000020d4" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 20759 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff577d3e41", "parentcaller": "0x7fff578543b9", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00001170" }, { "name": "ValueName", "value": "https" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.Windows.CloudExperienceHost_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\App\\Capabilities\\URLAssociations\\https" } ], "repeated": 0, "id": 20760 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002704" } ], "repeated": 0, "id": 20761 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4956", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bc7fe", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xa0\\xe4\t\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00`\\xda\\xd9\\xff\\xff\\xff\\xff\\xff\\x00\\x1a;K\\x07\\xef\\xdc\\x01\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00`\\xda\\xd9\\xff\\xff\\xff\\xff\\xffH\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd8_\\xf0\\x08\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 20762 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff55811832", "parentcaller": "0x7fff55811659", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001170" } ], "repeated": 0, "id": 20763 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4956", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bc8d0", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002708" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 20764 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff5809dff7", "parentcaller": "0x7fff5809b764", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "Index", "value": "1" }, { "name": "ValueName", "value": "AppXkm0p48j6vxa6sy1kzptp6c0skbrxk2xn" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "DataLength", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppXkm0p48j6vxa6sy1kzptp6c0skbrxk2xn" } ], "repeated": 0, "id": 20765 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002704" } ], "repeated": 0, "id": 20766 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff5808ab55", "parentcaller": "0x7fff5581161c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x000000ea", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "ValueName", "value": "AppXkm0p48j6vxa6sy1kzptp6c0skbrxk2xn" }, { "name": "Type", "value": "0x00000001", "pretty_value": "REG_SZ" }, { "name": "DataLength", "value": "406" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppXkm0p48j6vxa6sy1kzptp6c0skbrxk2xn" } ], "repeated": 0, "id": 20767 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f80" } ], "repeated": 0, "id": 20768 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff5808b02d", "parentcaller": "0x7fff5808ad08", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "ValueName", "value": "AppXkm0p48j6vxa6sy1kzptp6c0skbrxk2xn" }, { "name": "Data", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.Windows.OOBENetworkConnectionFlow_10.0.19041.3636_neutral__cw5n1h2txyewy\\App\\Capabilities" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppXkm0p48j6vxa6sy1kzptp6c0skbrxk2xn" } ], "repeated": 0, "id": 20769 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f80" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 20770 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "5100", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bc79b", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000020d4" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 20771 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "5100", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bc7ca", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002704" } ], "repeated": 0, "id": 20772 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "5100", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bc7fe", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xd0\\xe4\\x0f\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf8&\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 20773 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff558118a7", "parentcaller": "0x7fff558117bd", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.Windows.OOBENetworkConnectionFlow_10.0.19041.3636_neutral__cw5n1h2txyewy\\App\\Capabilities\\UrlAssociations" }, { "name": "Handle", "value": "0x00001170" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.Windows.OOBENetworkConnectionFlow_10.0.19041.3636_neutral__cw5n1h2txyewy\\App\\Capabilities\\UrlAssociations" } ], "repeated": 0, "id": 20774 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "5100", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000270c" } ], "repeated": 0, "id": 20775 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff55811806", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001170" }, { "name": "ValueName", "value": "https" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.Windows.OOBENetworkConnectionFlow_10.0.19041.3636_neutral__cw5n1h2txyewy\\App\\Capabilities\\URLAssociations\\https" } ], "repeated": 0, "id": 20776 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000025c8" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 20777 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xec:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc7\\xb3\\xf7Y\\xff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\xff\\x7f\\x00\\x00i}N\\x0c\\xea[\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00(\\xef:\\x03\\x00\\x00\\x00\\x00\\x80ba\\x07\\x00\\x00\\x00\\x00\\xd0mm\\x07\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\xca\n\\x055\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 20778 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff55811832", "parentcaller": "0x7fff55811659", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001170" } ], "repeated": 0, "id": 20779 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x000025f4" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 20780 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026c8" } ], "repeated": 0, "id": 20781 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff5809dff7", "parentcaller": "0x7fff5809b764", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "Index", "value": "2" }, { "name": "ValueName", "value": "AppX9p17f69fv477faczm440keb1b6qmf2d7" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "DataLength", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppX9p17f69fv477faczm440keb1b6qmf2d7" } ], "repeated": 0, "id": 20782 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000dcc" } ], "repeated": 0, "id": 20783 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4956", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b953e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002708" } ], "repeated": 0, "id": 20784 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff577d3e41", "parentcaller": "0x7fff578543b9", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x0000268c" }, { "name": "ValueName", "value": "AppX9p17f69fv477faczm440keb1b6qmf2d7" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppX9p17f69fv477faczm440keb1b6qmf2d7" } ], "repeated": 0, "id": 20785 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002708" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 20786 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff5808b02d", "parentcaller": "0x7fff5808ad08", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "ValueName", "value": "AppX9p17f69fv477faczm440keb1b6qmf2d7" }, { "name": "Data", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.AAD.BrokerPlugin_1000.19041.3636.0_neutral_neutral_cw5n1h2txyewy\\App\\Capabilities" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppX9p17f69fv477faczm440keb1b6qmf2d7" } ], "repeated": 0, "id": 20787 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000270c" } ], "repeated": 0, "id": 20788 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff558118a7", "parentcaller": "0x7fff558117bd", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.AAD.BrokerPlugin_1000.19041.3636.0_neutral_neutral_cw5n1h2txyewy\\App\\Capabilities\\UrlAssociations" }, { "name": "Handle", "value": "0x00001170" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.AAD.BrokerPlugin_1000.19041.3636.0_neutral_neutral_cw5n1h2txyewy\\App\\Capabilities\\UrlAssociations" } ], "repeated": 0, "id": 20789 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe4\t\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00@\\xe5\t\\x08\\x00\\x00\\x00\\x00\\x80\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\xe4\t\\x08\\x00\\x00\\x00\\x00\\x88\\xe3\t\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9d|}\\x1a\\xff\\x7f\\x00\\x00(\\x8b}\\x1a\\xff\\x7f\\x00\\x00\\x80\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\\x06b\\x07\\x00\\x00\\x00\\x00]\\xdd|W\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd8_\\xf0\\x08\\x00\\x00\\x00\\x00Yu}\\x07\\xea[\\x00\\x00\\xf8\\x06b\\x07\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 20790 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff55811806", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001170" }, { "name": "ValueName", "value": "https" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.AAD.BrokerPlugin_1000.19041.3636.0_neutral_neutral_cw5n1h2txyewy\\App\\Capabilities\\URLAssociations\\https" } ], "repeated": 0, "id": 20791 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff55811832", "parentcaller": "0x7fff55811659", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001170" } ], "repeated": 0, "id": 20792 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000270c" } ], "repeated": 0, "id": 20793 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff5809dff7", "parentcaller": "0x7fff5809b764", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "Index", "value": "3" }, { "name": "ValueName", "value": "AppX3302e372sk11smx9tbq60y86ggqfxvy1" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "DataLength", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppX3302e372sk11smx9tbq60y86ggqfxvy1" } ], "repeated": 0, "id": 20794 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002708" } ], "repeated": 0, "id": 20795 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff5808ab55", "parentcaller": "0x7fff5581161c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x000000ea", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "ValueName", "value": "AppX3302e372sk11smx9tbq60y86ggqfxvy1" }, { "name": "Type", "value": "0x00000001", "pretty_value": "REG_SZ" }, { "name": "DataLength", "value": "404" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppX3302e372sk11smx9tbq60y86ggqfxvy1" } ], "repeated": 0, "id": 20796 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000020d4" } ], "repeated": 0, "id": 20797 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff5808b02d", "parentcaller": "0x7fff5808ad08", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "ValueName", "value": "AppX3302e372sk11smx9tbq60y86ggqfxvy1" }, { "name": "Data", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.Windows.OOBENetworkCaptivePortal_10.0.19041.3636_neutral__cw5n1h2txyewy\\App\\Capabilities" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppX3302e372sk11smx9tbq60y86ggqfxvy1" } ], "repeated": 0, "id": 20798 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f80" } ], "repeated": 0, "id": 20799 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000025f4" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 20800 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000025c8" } ], "repeated": 0, "id": 20801 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff558118a7", "parentcaller": "0x7fff558117bd", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.Windows.OOBENetworkCaptivePortal_10.0.19041.3636_neutral__cw5n1h2txyewy\\App\\Capabilities\\UrlAssociations" }, { "name": "Handle", "value": "0x00001170" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.Windows.OOBENetworkCaptivePortal_10.0.19041.3636_neutral__cw5n1h2txyewy\\App\\Capabilities\\UrlAssociations" } ], "repeated": 0, "id": 20802 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000025b4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x13260000" }, { "name": "SectionOffset", "value": "0x0809e4b0" }, { "name": "ViewSize", "value": "0x00100000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 20803 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026c8" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 20804 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff55811806", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001170" }, { "name": "ValueName", "value": "https" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.Windows.OOBENetworkCaptivePortal_10.0.19041.3636_neutral__cw5n1h2txyewy\\App\\Capabilities\\URLAssociations\\https" } ], "repeated": 0, "id": 20805 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025f4" } ], "repeated": 0, "id": 20806 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002700" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000020d4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 20807 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026c8" } ], "repeated": 0, "id": 20808 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000dcc" } ], "repeated": 0, "id": 20809 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" } ], "repeated": 0, "id": 20810 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 20811 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000dcc" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 20812 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff5809dff7", "parentcaller": "0x7fff5809b764", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "Index", "value": "4" }, { "name": "ValueName", "value": "AppXm3ssa619v4xrhhddxj7maks7afa875sn" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "DataLength", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppXm3ssa619v4xrhhddxj7maks7afa875sn" } ], "repeated": 0, "id": 20813 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000026c8" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 20814 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000025f4" } ], "repeated": 0, "id": 20815 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f80" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 20816 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xec:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc7\\xb3\\xf7Y\\xff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\xff\\x7f\\x00\\x00i}N\\x0c\\xea[\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00(\\xef:\\x03\\x00\\x00\\x00\\x00\\x80ba\\x07\\x00\\x00\\x00\\x00\\xd0mm\\x07\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\xca\n\\x055\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 20817 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff5808ab55", "parentcaller": "0x7fff5581161c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x000000ea", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "ValueName", "value": "AppXm3ssa619v4xrhhddxj7maks7afa875sn" }, { "name": "Type", "value": "0x00000001", "pretty_value": "REG_SZ" }, { "name": "DataLength", "value": "356" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppXm3ssa619v4xrhhddxj7maks7afa875sn" } ], "repeated": 0, "id": 20818 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025c8" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 20819 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025f4" } ], "repeated": 0, "id": 20820 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026c8" } ], "repeated": 0, "id": 20821 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000dcc" } ], "repeated": 0, "id": 20822 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "ValueName", "value": "AppXm3ssa619v4xrhhddxj7maks7afa875sn" }, { "name": "Data", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\\App\\Capabilities" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppXm3ssa619v4xrhhddxj7maks7afa875sn" } ], "repeated": 0, "id": 20823 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000dcc" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 20824 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000024b4" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 20825 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff558118a7", "parentcaller": "0x7fff558117bd", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\\App\\Capabilities\\UrlAssociations" }, { "name": "Handle", "value": "0x00001170" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\\App\\Capabilities\\UrlAssociations" } ], "repeated": 0, "id": 20826 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff55811806", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001170" }, { "name": "ValueName", "value": "https" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\\App\\Capabilities\\URLAssociations\\https" } ], "repeated": 0, "id": 20827 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff55811832", "parentcaller": "0x7fff55811659", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001170" } ], "repeated": 0, "id": 20828 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xd0\\xe7\t\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0094}W\\xff\\x7f\\x00\\x00" } ], "repeated": 0, "id": 20829 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff5809dff7", "parentcaller": "0x7fff5809b764", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "Index", "value": "5" }, { "name": "ValueName", "value": "AppX5vch6tap2vdqjatpmmze527d6gbw9snf" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "DataLength", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppX5vch6tap2vdqjatpmmze527d6gbw9snf" } ], "repeated": 0, "id": 20830 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x0000270c" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 20831 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff5808ab55", "parentcaller": "0x7fff5581161c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x000000ea", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "ValueName", "value": "AppX5vch6tap2vdqjatpmmze527d6gbw9snf" }, { "name": "Type", "value": "0x00000001", "pretty_value": "REG_SZ" }, { "name": "DataLength", "value": "362" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppX5vch6tap2vdqjatpmmze527d6gbw9snf" } ], "repeated": 0, "id": 20832 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002708" } ], "repeated": 0, "id": 20833 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff5808b02d", "parentcaller": "0x7fff5808ad08", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "ValueName", "value": "AppX5vch6tap2vdqjatpmmze527d6gbw9snf" }, { "name": "Data", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\\App\\Capabilities" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppX5vch6tap2vdqjatpmmze527d6gbw9snf" } ], "repeated": 0, "id": 20834 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" } ], "repeated": 0, "id": 20835 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff558118a7", "parentcaller": "0x7fff558117bd", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\\App\\Capabilities\\UrlAssociations" }, { "name": "Handle", "value": "0x00001170" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\\App\\Capabilities\\UrlAssociations" } ], "repeated": 0, "id": 20836 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff55811806", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001170" }, { "name": "ValueName", "value": "https" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\\App\\Capabilities\\URLAssociations\\https" } ], "repeated": 0, "id": 20837 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000025c8" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 20838 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xc0\\xec:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00@\\xed:\\x03\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x83!,C\\xff\\x7f\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\xb3\\xf3\\x08\\x00\\x00\\x00\\x00p\\xed:\\x03\\x00\\x00\\x00\\x00f@5X\\xff\\x7f\\x00\\x00\\xca\n\\x055\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xca\n\\x055\\x00\\x00\\x00\\x00\\xc9\\x1f,C\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xff\\x7f\\x00\\x00" } ], "repeated": 0, "id": 20839 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff55811832", "parentcaller": "0x7fff55811659", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001170" } ], "repeated": 0, "id": 20840 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x000025f4" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 20841 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025c8" } ], "repeated": 0, "id": 20842 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff5809dff7", "parentcaller": "0x7fff5809b764", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "Index", "value": "6" }, { "name": "ValueName", "value": "AppXgtd8h4tnyrbh96yaxwt6z3pgwz63tg4e" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "DataLength", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppXgtd8h4tnyrbh96yaxwt6z3pgwz63tg4e" } ], "repeated": 0, "id": 20843 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 20844 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000dcc" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 20845 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000025c8" } ], "repeated": 0, "id": 20846 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff5808ab55", "parentcaller": "0x7fff5581161c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x000000ea", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "ValueName", "value": "AppXgtd8h4tnyrbh96yaxwt6z3pgwz63tg4e" }, { "name": "Type", "value": "0x00000001", "pretty_value": "REG_SZ" }, { "name": "DataLength", "value": "456" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppXgtd8h4tnyrbh96yaxwt6z3pgwz63tg4e" } ], "repeated": 0, "id": 20847 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000dcc" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 20848 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026c8" } ], "repeated": 0, "id": 20849 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000026c8" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 20850 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000025f4" } ], "repeated": 0, "id": 20851 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff5808b02d", "parentcaller": "0x7fff5808ad08", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "ValueName", "value": "AppXgtd8h4tnyrbh96yaxwt6z3pgwz63tg4e" }, { "name": "Data", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\\microsoft.windowslive.manageaccounts\\Capabilities" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppXgtd8h4tnyrbh96yaxwt6z3pgwz63tg4e" } ], "repeated": 0, "id": 20852 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xc0\\xec:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00@\\xed:\\x03\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x83!,C\\xff\\x7f\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\xb3\\xf3\\x08\\x00\\x00\\x00\\x00p\\xed:\\x03\\x00\\x00\\x00\\x00f@5X\\xff\\x7f\\x00\\x00\\xca\n\\x055\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xca\n\\x055\\x00\\x00\\x00\\x00\\xc9\\x1f,C\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xff\\x7f\\x00\\x00" } ], "repeated": 0, "id": 20853 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025f4" } ], "repeated": 0, "id": 20854 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026c8" } ], "repeated": 0, "id": 20855 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025c8" } ], "repeated": 0, "id": 20856 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000dcc" } ], "repeated": 0, "id": 20857 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff55811832", "parentcaller": "0x7fff55811659", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001170" } ], "repeated": 0, "id": 20858 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000025c8" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 20859 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000026c8" } ], "repeated": 0, "id": 20860 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xec:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc7\\xb3\\xf7Y\\xff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\xff\\x7f\\x00\\x00i}N\\x0c\\xea[\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00(\\xef:\\x03\\x00\\x00\\x00\\x00\\x80ba\\x07\\x00\\x00\\x00\\x00\\xd0mm\\x07\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\xca\n\\x055\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 20861 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff5809dff7", "parentcaller": "0x7fff5809b764", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "Index", "value": "7" }, { "name": "ValueName", "value": "AppXxygf2kzevwed6xtc0tnvag57321m0gf7" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "DataLength", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppXxygf2kzevwed6xtc0tnvag57321m0gf7" } ], "repeated": 0, "id": 20862 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x000025f4" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 20863 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026c8" } ], "repeated": 0, "id": 20864 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025c8" } ], "repeated": 0, "id": 20865 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff5808ab55", "parentcaller": "0x7fff5581161c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x000000ea", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "ValueName", "value": "AppXxygf2kzevwed6xtc0tnvag57321m0gf7" }, { "name": "Type", "value": "0x00000001", "pretty_value": "REG_SZ" }, { "name": "DataLength", "value": "444" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppXxygf2kzevwed6xtc0tnvag57321m0gf7" } ], "repeated": 0, "id": 20866 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000025f4" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 20867 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000025c8" } ], "repeated": 0, "id": 20868 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f80" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 20869 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xc0\\xec:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00@\\xed:\\x03\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x83!,C\\xff\\x7f\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\xb3\\xf3\\x08\\x00\\x00\\x00\\x00p\\xed:\\x03\\x00\\x00\\x00\\x00f@5X\\xff\\x7f\\x00\\x00\\xca\n\\x055\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xca\n\\x055\\x00\\x00\\x00\\x00\\xc9\\x1f,C\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xff\\x7f\\x00\\x00" } ], "repeated": 0, "id": 20870 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x000026c8" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 20871 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025c8" } ], "repeated": 0, "id": 20872 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025f4" } ], "repeated": 0, "id": 20873 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026c8" } ], "repeated": 0, "id": 20874 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "ValueName", "value": "AppXxygf2kzevwed6xtc0tnvag57321m0gf7" }, { "name": "Data", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\\microsoft.windowslive.calendar\\Capabilities" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppXxygf2kzevwed6xtc0tnvag57321m0gf7" } ], "repeated": 0, "id": 20875 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000dcc" } ], "repeated": 0, "id": 20876 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 20877 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000dcc" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 20878 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000270c" } ], "repeated": 0, "id": 20879 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff558118a7", "parentcaller": "0x7fff558117bd", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\\microsoft.windowslive.calendar\\Capabilities\\UrlAssociations" }, { "name": "Handle", "value": "0x00001170" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\\microsoft.windowslive.calendar\\Capabilities\\UrlAssociations" } ], "repeated": 0, "id": 20880 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff55811806", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001170" }, { "name": "ValueName", "value": "https" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\\microsoft.windowslive.calendar\\Capabilities\\URLAssociations\\https" } ], "repeated": 0, "id": 20881 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff55811832", "parentcaller": "0x7fff55811659", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001170" } ], "repeated": 0, "id": 20882 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000024b4" } ], "repeated": 0, "id": 20883 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff5809dff7", "parentcaller": "0x7fff5809b764", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "Index", "value": "8" }, { "name": "ValueName", "value": "AppXqbwwf452mex80ks5a1qcgdbx4q1q68ps" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "DataLength", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppXqbwwf452mex80ks5a1qcgdbx4q1q68ps" } ], "repeated": 0, "id": 20884 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xe0\\xe7\t\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9c|}\\x1a\\xff\\x7f\\x00\\x00(\\x8b}\\x1a\\xff\\x7f\\x00\\x00\\x80\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\\x06b\\x07\\x00\\x00\\x00\\x00]\\xdd|W\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0094}W\\xff\\x7f\\x00\\x00ip}\\x07\\xea[\\x00\\x00\\xf8\\x06b\\x07\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 20885 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x000000ea", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "ValueName", "value": "AppXqbwwf452mex80ks5a1qcgdbx4q1q68ps" }, { "name": "Type", "value": "0x00000001", "pretty_value": "REG_SZ" }, { "name": "DataLength", "value": "436" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppXqbwwf452mex80ks5a1qcgdbx4q1q68ps" } ], "repeated": 0, "id": 20886 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002708" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 20887 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff5808b02d", "parentcaller": "0x7fff5808ad08", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "ValueName", "value": "AppXqbwwf452mex80ks5a1qcgdbx4q1q68ps" }, { "name": "Data", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\\microsoft.windowslive.mail\\Capabilities" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppXqbwwf452mex80ks5a1qcgdbx4q1q68ps" } ], "repeated": 0, "id": 20888 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" } ], "repeated": 0, "id": 20889 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000270c" } ], "repeated": 0, "id": 20890 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff558118a7", "parentcaller": "0x7fff558117bd", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\\microsoft.windowslive.mail\\Capabilities\\UrlAssociations" }, { "name": "Handle", "value": "0x00001170" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\\microsoft.windowslive.mail\\Capabilities\\UrlAssociations" } ], "repeated": 0, "id": 20891 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002708" } ], "repeated": 0, "id": 20892 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4956", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432b9779", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f80" } ], "repeated": 0, "id": 20893 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff55811806", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001170" }, { "name": "ValueName", "value": "https" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\\microsoft.windowslive.mail\\Capabilities\\URLAssociations\\https" } ], "repeated": 0, "id": 20894 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000228c" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 20895 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b8" } ], "repeated": 0, "id": 20896 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000236c" } ], "repeated": 0, "id": 20897 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff55811832", "parentcaller": "0x7fff55811659", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001170" } ], "repeated": 0, "id": 20898 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xec:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc7\\xb3\\xf7Y\\xff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\xff\\x7f\\x00\\x00i}N\\x0c\\xea[\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00(\\xef:\\x03\\x00\\x00\\x00\\x00\\x80ba\\x07\\x00\\x00\\x00\\x00\\xd0mm\\x07\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\xca\n\\x055\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 20899 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f80" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 20900 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025f8" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 20901 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000236c" } ], "repeated": 0, "id": 20902 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff5808ab55", "parentcaller": "0x7fff5581161c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x000000ea", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "ValueName", "value": "AppX9a5b64vqrc7t295d0avsvkqjbcdcasb7" }, { "name": "Type", "value": "0x00000001", "pretty_value": "REG_SZ" }, { "name": "DataLength", "value": "354" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppX9a5b64vqrc7t295d0avsvkqjbcdcasb7" } ], "repeated": 0, "id": 20903 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000dcc" } ], "repeated": 0, "id": 20904 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ThumbnailCache" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ThumbnailCache" } ], "repeated": 0, "id": 20905 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff5808b02d", "parentcaller": "0x7fff5808ad08", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "ValueName", "value": "AppX9a5b64vqrc7t295d0avsvkqjbcdcasb7" }, { "name": "Data", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\\App\\Capabilities" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppX9a5b64vqrc7t295d0avsvkqjbcdcasb7" } ], "repeated": 0, "id": 20906 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff558118a7", "parentcaller": "0x7fff558117bd", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\\App\\Capabilities\\UrlAssociations" }, { "name": "Handle", "value": "0x00001170" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\\App\\Capabilities\\UrlAssociations" } ], "repeated": 0, "id": 20907 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff55811806", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001170" }, { "name": "ValueName", "value": "https" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\\App\\Capabilities\\URLAssociations\\https" } ], "repeated": 0, "id": 20908 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff55811832", "parentcaller": "0x7fff55811659", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001170" } ], "repeated": 0, "id": 20909 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff5809dff7", "parentcaller": "0x7fff5809b764", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "Index", "value": "10" }, { "name": "ValueName", "value": "AppXbpvt3ybb9z170k77w6aygrkk3dpbx7mb" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "DataLength", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppXbpvt3ybb9z170k77w6aygrkk3dpbx7mb" } ], "repeated": 0, "id": 20910 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff5808ab55", "parentcaller": "0x7fff5581161c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x000000ea", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "ValueName", "value": "AppXbpvt3ybb9z170k77w6aygrkk3dpbx7mb" }, { "name": "Type", "value": "0x00000001", "pretty_value": "REG_SZ" }, { "name": "DataLength", "value": "366" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppXbpvt3ybb9z170k77w6aygrkk3dpbx7mb" } ], "repeated": 0, "id": 20911 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff5808b02d", "parentcaller": "0x7fff5808ad08", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "ValueName", "value": "AppXbpvt3ybb9z170k77w6aygrkk3dpbx7mb" }, { "name": "Data", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\\App\\Capabilities" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppXbpvt3ybb9z170k77w6aygrkk3dpbx7mb" } ], "repeated": 0, "id": 20912 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "5100", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bc79b", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000228c" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 20913 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "5100", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bc7ca", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000236c" } ], "repeated": 0, "id": 20914 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "5100", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bc7fe", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xd0\\xe4\\x0f\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c'\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 20915 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000026ec" }, { "name": "DesiredAccess", "value": "0xc0100080", "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 20916 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xa0\\xe9\t\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\xab/C\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 20917 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 20918 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff5808b02d", "parentcaller": "0x7fff5808ad08", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "ValueName", "value": "AppXm09rke5hc4nvhb8wjwhv1zafzzstx1y2" }, { "name": "Data", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.Windows.SecHealthUI_10.0.19041.3636_neutral__cw5n1h2txyewy\\SecHealthUI\\Capabilities" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppXm09rke5hc4nvhb8wjwhv1zafzzstx1y2" } ], "repeated": 0, "id": 20919 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000270c" } ], "repeated": 0, "id": 20920 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff558118a7", "parentcaller": "0x7fff558117bd", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.Windows.SecHealthUI_10.0.19041.3636_neutral__cw5n1h2txyewy\\SecHealthUI\\Capabilities\\UrlAssociations" }, { "name": "Handle", "value": "0x00001170" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.Windows.SecHealthUI_10.0.19041.3636_neutral__cw5n1h2txyewy\\SecHealthUI\\Capabilities\\UrlAssociations" } ], "repeated": 0, "id": 20921 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025f8" } ], "repeated": 0, "id": 20922 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff55811806", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001170" }, { "name": "ValueName", "value": "https" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.Windows.SecHealthUI_10.0.19041.3636_neutral__cw5n1h2txyewy\\SecHealthUI\\Capabilities\\URLAssociations\\https" } ], "repeated": 0, "id": 20923 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xc0\\xec:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00@\\xed:\\x03\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x83!,C\\xff\\x7f\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\xb3\\xf3\\x08\\x00\\x00\\x00\\x00p\\xed:\\x03\\x00\\x00\\x00\\x00f@5X\\xff\\x7f\\x00\\x00\\xca\n\\x055\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xca\n\\x055\\x00\\x00\\x00\\x00\\xc9\\x1f,C\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xff\\x7f\\x00\\x00" } ], "repeated": 0, "id": 20924 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x0000228c" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 20925 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff55811832", "parentcaller": "0x7fff55811659", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001170" } ], "repeated": 0, "id": 20926 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002378" } ], "repeated": 0, "id": 20927 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000228c" } ], "repeated": 0, "id": 20928 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff5809dff7", "parentcaller": "0x7fff5809b764", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "Index", "value": "12" }, { "name": "ValueName", "value": "AppXh02wydnwxxfzrncb6xbx9y365rwsqrj0" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "DataLength", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppXh02wydnwxxfzrncb6xbx9y365rwsqrj0" } ], "repeated": 0, "id": 20929 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000dcc" } ], "repeated": 0, "id": 20930 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff5808ab55", "parentcaller": "0x7fff5581161c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x000000ea", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "ValueName", "value": "AppXh02wydnwxxfzrncb6xbx9y365rwsqrj0" }, { "name": "Type", "value": "0x00000001", "pretty_value": "REG_SZ" }, { "name": "DataLength", "value": "394" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppXh02wydnwxxfzrncb6xbx9y365rwsqrj0" } ], "repeated": 0, "id": 20931 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4840", "caller": "0x7fff5808b02d", "parentcaller": "0x7fff5808ad08", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "ValueName", "value": "AppXh02wydnwxxfzrncb6xbx9y365rwsqrj0" }, { "name": "Data", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\PythonSoftwareFoundation.PythonManager_26.2.240.0_x64__3847v3x7pw1km\\Pythonw.Exe\\Capabilities" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppXh02wydnwxxfzrncb6xbx9y365rwsqrj0" } ], "repeated": 0, "id": 20932 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022b0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\xf0\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xe3\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 20933 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f80" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 20934 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" } ], "repeated": 0, "id": 20935 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000024b4" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 20936 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002708" } ], "repeated": 0, "id": 20937 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe9\t\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9c|}\\x1a\\xff\\x7f\\x00\\x00(\\x8b}\\x1a\\xff\\x7f\\x00\\x00\\x80\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\\x06b\\x07\\x00\\x00\\x00\\x00]\\xdd|W\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00Y~}\\x07\\xea[\\x00\\x00\\xf8\\x06b\\x07\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 20938 }, { "timestamp": "2026-05-29 01:05:52,024", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000270c" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 20939 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002708" } ], "repeated": 0, "id": 20940 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000026ec" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" }, { "name": "FileInformationClass", "value": "74" }, { "name": "FileInformation", "value": "\\x02\\x00\\x00\\x00" } ], "repeated": 0, "id": 20941 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" } ], "repeated": 0, "id": 20942 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000270c" } ], "repeated": 0, "id": 20943 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 20944 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f80" } ], "repeated": 0, "id": 20945 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002318" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 20946 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\program files (x86)\\Steam\\bin\\cef\\cef.win64\\steamwebhelper.exe" } ], "repeated": 0, "id": 20947 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026fc" } ], "repeated": 0, "id": 20948 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002318" } ], "repeated": 0, "id": 20949 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\program files (x86)\\Steam\\bin\\cef\\cef.win64\\steamwebhelper.exe" } ], "repeated": 0, "id": 20950 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x13360002", "arguments": [ { "name": "lpLibFileName", "value": "c:\\program files (x86)\\steam\\bin\\cef\\cef.win64\\steamwebhelper.exe" }, { "name": "dwFlags", "value": "0x00000022" } ], "repeated": 0, "id": 20951 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000026ec" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\xf0\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xe3\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 20952 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "3424", "caller": "0x7fff577cf0e1", "parentcaller": "0x7fff577cef40", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002318" }, { "name": "DesiredAccess", "value": "0x000f0007", "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_WRITE" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x000026ec" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" } ], "repeated": 0, "id": 20953 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "misc", "api": "LoadResource", "status": true, "return": "0x13c484ec", "arguments": [ { "name": "Module", "value": "0x13360002" }, { "name": "ResourceInfo", "value": "0x13b7bd10" } ], "repeated": 0, "id": 20954 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "misc", "api": "FindResourceExW", "status": true, "return": "0x13b7b9d0", "arguments": [ { "name": "Module", "value": "0x13360002" }, { "name": "Type", "value": "#3" }, { "name": "Name", "value": "#10" }, { "name": "Language", "value": "0x00000000" } ], "repeated": 0, "id": 20955 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002318" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09fe0000" }, { "name": "SectionOffset", "value": "0x0114e480" }, { "name": "ViewSize", "value": "0x0000f000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 20956 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "misc", "api": "SizeofResource", "status": true, "return": "0x000010a8", "arguments": [ { "name": "ModuleHandle", "value": "0x13360002" }, { "name": "ResourceInfo", "value": "0x13b7b9d0" } ], "repeated": 0, "id": 20957 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002318" } ], "repeated": 0, "id": 20958 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "misc", "api": "LoadResource", "status": true, "return": "0x13b8a990", "arguments": [ { "name": "Module", "value": "0x13360002" }, { "name": "ResourceInfo", "value": "0x13b7b9d0" } ], "repeated": 0, "id": 20959 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 20960 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026c4" } ], "repeated": 0, "id": 20961 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000026c4" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 20962 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002318" } ], "repeated": 0, "id": 20963 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "0\\xe7\\x14\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9c|}\\x1a\\xff\\x7f\\x00\\x00(\\x8b}\\x1a\\xff\\x7f\\x00\\x00<&\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\xe6\\xa5\\x0c\\x00\\x00\\x00\\x00]\\xdd|W\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xedi\\x07\\x00\\x00\\x00\\x00\\xd9p`\\x0e\\xea[\\x00\\x00\\x88\\xe6\\xa5\\x0c\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 20964 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026fc" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 20965 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x13360000" }, { "name": "RegionSize", "value": "0x008f9000" } ], "repeated": 0, "id": 20966 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002318" } ], "repeated": 0, "id": 20967 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026c4" } ], "repeated": 0, "id": 20968 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026fc" } ], "repeated": 0, "id": 20969 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\default\\DataProtection\\EDPShowIcons" }, { "name": "Handle", "value": "0x0000270c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\DataProtection\\EDPShowIcons" } ], "repeated": 0, "id": 20970 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 20971 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000026ec" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000026fc" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 20972 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000270c" }, { "name": "ValueName", "value": "PolicyType" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\DataProtection\\EDPShowIcons\\PolicyType" } ], "repeated": 0, "id": 20973 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002374" } ], "repeated": 0, "id": 20974 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000270c" }, { "name": "ValueName", "value": "Behavior" }, { "name": "Data", "value": "298" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\DataProtection\\EDPShowIcons\\Behavior" } ], "repeated": 0, "id": 20975 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000270c" }, { "name": "ValueName", "value": "MergeAlgorithm" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\DataProtection\\EDPShowIcons\\MergeAlgorithm" } ], "repeated": 0, "id": 20976 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000270c" }, { "name": "ValueName", "value": "RegKeyPathRedirectMapped" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\DataProtection\\EDPShowIcons\\RegKeyPathRedirectMapped" } ], "repeated": 0, "id": 20977 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000270c" }, { "name": "ValueName", "value": "RegKeyPathRedirect" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\DataProtection\\EDPShowIcons\\RegKeyPathRedirect" } ], "repeated": 0, "id": 20978 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000270c" }, { "name": "ValueName", "value": "ADMXMetadataDevice" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\DataProtection\\EDPShowIcons\\ADMXMetadataDevice" } ], "repeated": 0, "id": 20979 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff558118a7", "parentcaller": "0x7fff558117bd", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\PythonSoftwareFoundation.PythonManager_26.2.240.0_x64__3847v3x7pw1km\\Pythonw.Exe\\Capabilities\\UrlAssociations" }, { "name": "Handle", "value": "0x000021a4" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\PythonSoftwareFoundation.PythonManager_26.2.240.0_x64__3847v3x7pw1km\\Pythonw.Exe\\Capabilities\\UrlAssociations" } ], "repeated": 0, "id": 20980 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4668", "caller": "0x7fff5780d897", "parentcaller": "0x7fff432b949c", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000d00" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\xf0\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xe3\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 20981 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff55811806", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000021a4" }, { "name": "ValueName", "value": "https" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\PythonSoftwareFoundation.PythonManager_26.2.240.0_x64__3847v3x7pw1km\\Pythonw.Exe\\Capabilities\\URLAssociations\\https" } ], "repeated": 0, "id": 20982 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff55811832", "parentcaller": "0x7fff55811659", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000021a4" } ], "repeated": 0, "id": 20983 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff5809dff7", "parentcaller": "0x7fff5809b764", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "Index", "value": "13" }, { "name": "ValueName", "value": "AppX17g64qt4xqrmcgsbg0rt0r5pz91807cc" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "DataLength", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppX17g64qt4xqrmcgsbg0rt0r5pz91807cc" } ], "repeated": 0, "id": 20984 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff5808ab55", "parentcaller": "0x7fff5581161c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x000000ea", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "ValueName", "value": "AppX17g64qt4xqrmcgsbg0rt0r5pz91807cc" }, { "name": "Type", "value": "0x00000001", "pretty_value": "REG_SZ" }, { "name": "DataLength", "value": "392" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppX17g64qt4xqrmcgsbg0rt0r5pz91807cc" } ], "repeated": 0, "id": 20985 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff5780d897", "parentcaller": "0x7fff432c3b2c", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001018" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_48.db" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 20986 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff5808b02d", "parentcaller": "0x7fff5808ad08", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "ValueName", "value": "AppX17g64qt4xqrmcgsbg0rt0r5pz91807cc" }, { "name": "Data", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\PythonSoftwareFoundation.PythonManager_26.2.240.0_x64__3847v3x7pw1km\\Python.Exe\\Capabilities" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppX17g64qt4xqrmcgsbg0rt0r5pz91807cc" } ], "repeated": 0, "id": 20987 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff558118a7", "parentcaller": "0x7fff558117bd", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\PythonSoftwareFoundation.PythonManager_26.2.240.0_x64__3847v3x7pw1km\\Python.Exe\\Capabilities\\UrlAssociations" }, { "name": "Handle", "value": "0x000021a4" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\PythonSoftwareFoundation.PythonManager_26.2.240.0_x64__3847v3x7pw1km\\Python.Exe\\Capabilities\\UrlAssociations" } ], "repeated": 0, "id": 20988 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff55811806", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000021a4" }, { "name": "ValueName", "value": "https" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\PythonSoftwareFoundation.PythonManager_26.2.240.0_x64__3847v3x7pw1km\\Python.Exe\\Capabilities\\URLAssociations\\https" } ], "repeated": 0, "id": 20989 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff55811832", "parentcaller": "0x7fff55811659", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000021a4" } ], "repeated": 0, "id": 20990 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff5809dff7", "parentcaller": "0x7fff5809b764", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "Index", "value": "14" }, { "name": "ValueName", "value": "AppXezhx1g574qt7ved4c6n8xc7dv69hp5b9" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "DataLength", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppXezhx1g574qt7ved4c6n8xc7dv69hp5b9" } ], "repeated": 0, "id": 20991 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff5808ab55", "parentcaller": "0x7fff5581161c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x000000ea", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "ValueName", "value": "AppXezhx1g574qt7ved4c6n8xc7dv69hp5b9" }, { "name": "Type", "value": "0x00000001", "pretty_value": "REG_SZ" }, { "name": "DataLength", "value": "360" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppXezhx1g574qt7ved4c6n8xc7dv69hp5b9" } ], "repeated": 0, "id": 20992 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bc7ca", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000025f8" } ], "repeated": 0, "id": 20993 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bc7fe", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xa0\\xe7\\x0f\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\xd8\\xe8\\x0f\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00C\\x10,C\\xff\\x7f\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb8\\xac,C\\xff\\x7f\\x00\\x000\\x1ap\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\xe9\\x0f\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x000\\x1ap\\x0c\\x00\\x00\\x00\\x00\\xe7\\xab,C\\xff\\x7f\\x00\\x000\\x1ap\\x0c\\x00\\x00\\x00\\x00\\x99~{\\x06\\xea[\\x00\\x00" } ], "repeated": 0, "id": 20994 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bc8d0", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002378" }, { "name": "MutexName", "value": "" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 20995 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8e4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025f8" } ], "repeated": 0, "id": 20996 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff5808b02d", "parentcaller": "0x7fff5808ad08", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "ValueName", "value": "AppXezhx1g574qt7ved4c6n8xc7dv69hp5b9" }, { "name": "Data", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\\App\\Capabilities" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppXezhx1g574qt7ved4c6n8xc7dv69hp5b9" } ], "repeated": 0, "id": 20997 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000228c" } ], "repeated": 0, "id": 20998 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b9845", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002378" } ], "repeated": 0, "id": 20999 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff558118a7", "parentcaller": "0x7fff558117bd", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\\App\\Capabilities\\UrlAssociations" }, { "name": "Handle", "value": "0x000021a4" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\\App\\Capabilities\\UrlAssociations" } ], "repeated": 0, "id": 21000 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff55811806", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000021a4" }, { "name": "ValueName", "value": "https" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\\App\\Capabilities\\URLAssociations\\https" } ], "repeated": 0, "id": 21001 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff55811832", "parentcaller": "0x7fff55811659", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000021a4" } ], "repeated": 0, "id": 21002 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff5809dff7", "parentcaller": "0x7fff5809b764", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "Index", "value": "15" }, { "name": "ValueName", "value": "AppXtkxgtha8255pnxrsbkg89t4f1wpmvger" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "DataLength", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppXtkxgtha8255pnxrsbkg89t4f1wpmvger" } ], "repeated": 0, "id": 21003 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff5808ab55", "parentcaller": "0x7fff5581161c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x000000ea", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "ValueName", "value": "AppXtkxgtha8255pnxrsbkg89t4f1wpmvger" }, { "name": "Type", "value": "0x00000001", "pretty_value": "REG_SZ" }, { "name": "DataLength", "value": "460" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppXtkxgtha8255pnxrsbkg89t4f1wpmvger" } ], "repeated": 0, "id": 21004 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577d6785", "parentcaller": "0x7fff557c403a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025c0" } ], "repeated": 0, "id": 21005 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff557c3a98", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xec\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5100" } ], "repeated": 0, "id": 21006 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff5808b02d", "parentcaller": "0x7fff5808ad08", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "ValueName", "value": "AppXtkxgtha8255pnxrsbkg89t4f1wpmvger" }, { "name": "Data", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.Windows.XGpuEjectDialog_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\Microsoft.Windows.XGpuEjectDialog\\Capabilities" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppXtkxgtha8255pnxrsbkg89t4f1wpmvger" } ], "repeated": 0, "id": 21007 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff558118a7", "parentcaller": "0x7fff558117bd", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.Windows.XGpuEjectDialog_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\Microsoft.Windows.XGpuEjectDialog\\Capabilities\\UrlAssociations" }, { "name": "Handle", "value": "0x000021a4" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.Windows.XGpuEjectDialog_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\Microsoft.Windows.XGpuEjectDialog\\Capabilities\\UrlAssociations" } ], "repeated": 0, "id": 21008 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000021a4" }, { "name": "ValueName", "value": "https" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.Windows.XGpuEjectDialog_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\Microsoft.Windows.XGpuEjectDialog\\Capabilities\\URLAssociations\\https" } ], "repeated": 0, "id": 21009 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff55811832", "parentcaller": "0x7fff55811659", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000021a4" } ], "repeated": 0, "id": 21010 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff5584a889", "parentcaller": "0x7fff55843ac1", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "CLSID\\{645FF040-5081-101B-9F08-00AA002F954E}" }, { "name": "Handle", "value": "0x000025c2" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\CLSID\\{645FF040-5081-101B-9F08-00AA002F954E}" } ], "repeated": 0, "id": 21011 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff5808ab55", "parentcaller": "0x7fff5581161c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x000000ea", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "ValueName", "value": "AppXpvggj8wtagvqq1trs4afp513ydqb63tt" }, { "name": "Type", "value": "0x00000001", "pretty_value": "REG_SZ" }, { "name": "DataLength", "value": "408" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppXpvggj8wtagvqq1trs4afp513ydqb63tt" } ], "repeated": 0, "id": 21012 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff5808b02d", "parentcaller": "0x7fff55899299", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000025c2" }, { "name": "ValueName", "value": "{446D16B1-8DAD-4870-A748-402EA43D788C} 100" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{645FF040-5081-101B-9F08-00AA002F954E}\\{446D16B1-8DAD-4870-A748-402EA43D788C} 100" } ], "repeated": 0, "id": 21013 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff5808b02d", "parentcaller": "0x7fff5808ad08", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "ValueName", "value": "AppXpvggj8wtagvqq1trs4afp513ydqb63tt" }, { "name": "Data", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Windows.PrintDialog_6.2.1.0_neutral_neutral_cw5n1h2txyewy\\Microsoft.Windows.PrintDialog\\Capabilities" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppXpvggj8wtagvqq1trs4afp513ydqb63tt" } ], "repeated": 0, "id": 21014 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff5584a889", "parentcaller": "0x7fff55843ac1", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "CLSID\\{645FF040-5081-101B-9F08-00AA002F954E}" }, { "name": "Handle", "value": "0x000025c2" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\CLSID\\{645FF040-5081-101B-9F08-00AA002F954E}" } ], "repeated": 0, "id": 21015 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff558118a7", "parentcaller": "0x7fff558117bd", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Windows.PrintDialog_6.2.1.0_neutral_neutral_cw5n1h2txyewy\\Microsoft.Windows.PrintDialog\\Capabilities\\UrlAssociations" }, { "name": "Handle", "value": "0x000021a4" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Windows.PrintDialog_6.2.1.0_neutral_neutral_cw5n1h2txyewy\\Microsoft.Windows.PrintDialog\\Capabilities\\UrlAssociations" } ], "repeated": 0, "id": 21016 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff55811806", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000021a4" }, { "name": "ValueName", "value": "https" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Windows.PrintDialog_6.2.1.0_neutral_neutral_cw5n1h2txyewy\\Microsoft.Windows.PrintDialog\\Capabilities\\URLAssociations\\https" } ], "repeated": 0, "id": 21017 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff55811832", "parentcaller": "0x7fff55811659", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000021a4" } ], "repeated": 0, "id": 21018 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff5808b02d", "parentcaller": "0x7fff55899299", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000025c2" }, { "name": "ValueName", "value": "{B725F130-47EF-101A-A5F1-02608C9EEBAC} 14" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{645FF040-5081-101B-9F08-00AA002F954E}\\{B725F130-47EF-101A-A5F1-02608C9EEBAC} 14" } ], "repeated": 0, "id": 21019 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff55843b53", "parentcaller": "0x7fff52872b32", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025c2" } ], "repeated": 0, "id": 21020 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff5808ab55", "parentcaller": "0x7fff5581161c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x000000ea", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "ValueName", "value": "AppXkz68dp558dnjsc1ycr8f283vxqwzxstp" }, { "name": "Type", "value": "0x00000001", "pretty_value": "REG_SZ" }, { "name": "DataLength", "value": "416" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppXkz68dp558dnjsc1ycr8f283vxqwzxstp" } ], "repeated": 0, "id": 21021 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff5808b02d", "parentcaller": "0x7fff5808ad08", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "ValueName", "value": "AppXkz68dp558dnjsc1ycr8f283vxqwzxstp" }, { "name": "Data", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.Windows.SecureAssessmentBrowser_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\App\\Capabilities" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppXkz68dp558dnjsc1ycr8f283vxqwzxstp" } ], "repeated": 0, "id": 21022 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff5584a889", "parentcaller": "0x7fff55843ac1", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "CLSID\\{645FF040-5081-101B-9F08-00AA002F954E}" }, { "name": "Handle", "value": "0x000025c2" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\CLSID\\{645FF040-5081-101B-9F08-00AA002F954E}" } ], "repeated": 0, "id": 21023 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff5808b02d", "parentcaller": "0x7fff55899299", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000025c2" }, { "name": "ValueName", "value": "System.DateModified" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{645FF040-5081-101B-9F08-00AA002F954E}\\System.DateModified" } ], "repeated": 0, "id": 21024 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff5809dff7", "parentcaller": "0x7fff5809b764", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "Index", "value": "18" }, { "name": "ValueName", "value": "AppXt7wecsz30g50zd235hqdg6edj7bz373q" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "DataLength", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppXt7wecsz30g50zd235hqdg6edj7bz373q" } ], "repeated": 0, "id": 21025 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff55843b53", "parentcaller": "0x7fff432b62ed", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025c2" } ], "repeated": 0, "id": 21026 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff5808ab55", "parentcaller": "0x7fff5581161c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x000000ea", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "ValueName", "value": "AppXt7wecsz30g50zd235hqdg6edj7bz373q" }, { "name": "Type", "value": "0x00000001", "pretty_value": "REG_SZ" }, { "name": "DataLength", "value": "406" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppXt7wecsz30g50zd235hqdg6edj7bz373q" } ], "repeated": 0, "id": 21027 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bbd54", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000008e8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 21028 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000025c0" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 21029 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8e4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002378" } ], "repeated": 0, "id": 21030 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025c0" } ], "repeated": 0, "id": 21031 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff5808b02d", "parentcaller": "0x7fff5808ad08", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "ValueName", "value": "AppXt7wecsz30g50zd235hqdg6edj7bz373q" }, { "name": "Data", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.Windows.ParentalControls_1000.19041.3636.0_neutral_neutral_cw5n1h2txyewy\\App\\Capabilities" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppXt7wecsz30g50zd235hqdg6edj7bz373q" } ], "repeated": 0, "id": 21032 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bbd99", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000008e8" } ], "repeated": 0, "id": 21033 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff558118a7", "parentcaller": "0x7fff558117bd", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.Windows.ParentalControls_1000.19041.3636.0_neutral_neutral_cw5n1h2txyewy\\App\\Capabilities\\UrlAssociations" }, { "name": "Handle", "value": "0x000021a4" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.Windows.ParentalControls_1000.19041.3636.0_neutral_neutral_cw5n1h2txyewy\\App\\Capabilities\\UrlAssociations" } ], "repeated": 0, "id": 21034 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff55811806", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000021a4" }, { "name": "ValueName", "value": "https" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.Windows.ParentalControls_1000.19041.3636.0_neutral_neutral_cw5n1h2txyewy\\App\\Capabilities\\URLAssociations\\https" } ], "repeated": 0, "id": 21035 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff55811832", "parentcaller": "0x7fff55811659", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000021a4" } ], "repeated": 0, "id": 21036 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff5809dff7", "parentcaller": "0x7fff5809b764", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "Index", "value": "19" }, { "name": "ValueName", "value": "AppXgvfc47vdahvb6zamkja2gyckzmx6q5xs" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "DataLength", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppXgvfc47vdahvb6zamkja2gyckzmx6q5xs" } ], "repeated": 0, "id": 21037 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff5808ab55", "parentcaller": "0x7fff5581161c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x000000ea", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "ValueName", "value": "AppXgvfc47vdahvb6zamkja2gyckzmx6q5xs" }, { "name": "Type", "value": "0x00000001", "pretty_value": "REG_SZ" }, { "name": "DataLength", "value": "444" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppXgvfc47vdahvb6zamkja2gyckzmx6q5xs" } ], "repeated": 0, "id": 21038 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff5808b02d", "parentcaller": "0x7fff5808ad08", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "ValueName", "value": "AppXgvfc47vdahvb6zamkja2gyckzmx6q5xs" }, { "name": "Data", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.XboxGameCallableUI_1000.19041.3636.0_neutral_neutral_cw5n1h2txyewy\\Microsoft.XboxGameCallableUI\\Capabilities" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppXgvfc47vdahvb6zamkja2gyckzmx6q5xs" } ], "repeated": 0, "id": 21039 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.XboxGameCallableUI_1000.19041.3636.0_neutral_neutral_cw5n1h2txyewy\\Microsoft.XboxGameCallableUI\\Capabilities\\UrlAssociations" }, { "name": "Handle", "value": "0x000021a4" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.XboxGameCallableUI_1000.19041.3636.0_neutral_neutral_cw5n1h2txyewy\\Microsoft.XboxGameCallableUI\\Capabilities\\UrlAssociations" } ], "repeated": 0, "id": 21040 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff55811806", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000021a4" }, { "name": "ValueName", "value": "https" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.XboxGameCallableUI_1000.19041.3636.0_neutral_neutral_cw5n1h2txyewy\\Microsoft.XboxGameCallableUI\\Capabilities\\URLAssociations\\https" } ], "repeated": 0, "id": 21041 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff55811832", "parentcaller": "0x7fff55811659", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000021a4" } ], "repeated": 0, "id": 21042 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff5809dff7", "parentcaller": "0x7fff5809b764", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "Index", "value": "20" }, { "name": "ValueName", "value": "AppX6718mn68jej1kxz691e99c70v5b37pv0" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "DataLength", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppX6718mn68jej1kxz691e99c70v5b37pv0" } ], "repeated": 0, "id": 21043 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff5808ab55", "parentcaller": "0x7fff5581161c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x000000ea", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "ValueName", "value": "AppX6718mn68jej1kxz691e99c70v5b37pv0" }, { "name": "Type", "value": "0x00000001", "pretty_value": "REG_SZ" }, { "name": "DataLength", "value": "406" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppX6718mn68jej1kxz691e99c70v5b37pv0" } ], "repeated": 0, "id": 21044 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5096", "caller": "0x7fff5780d897", "parentcaller": "0x7fff432c0a96", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002280" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_48.db" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 21045 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5096", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bbc69", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000232c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 21046 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5096", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bc79b", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000026a0" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 21047 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5096", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bc7ca", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000025ac" } ], "repeated": 0, "id": 21048 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5096", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bc7fe", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x90\\xeaT\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xf7\\x8b\\x10\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\"\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 21049 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000021a4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 21050 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577d5cfb", "parentcaller": "0x7fff577d6bfa", "category": "device", "api": "DeviceIoControl", "status": false, "return": "0x00000000", "arguments": [ { "name": "DeviceHandle", "value": "0x000021a4" }, { "name": "IoControlCode", "value": "0x000900a8", "pretty_value": "FSCTL_GET_REPARSE_POINT" }, { "name": "InBuffer", "value": "" }, { "name": "OutBuffer", "value": "@\\xd1\\x0f\t\\x00\\x00\\x00\\x00p\\xd1\\x0f\t\\x00\\x00\\x00\\x00\\x80\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\xba\\x00\\x00\\xc0\\xff\\xff\\xff\\xffF\\x0e0\\xee\\x97\\x9c\\x00\\x00\\x08\\x82}\\x1a\\xff\\x7f\\x00\\x00\\xb0\\x86\\xb3\\x0c\\x00\\x00\\x00\\x00\\xba\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\xe6y\\x0c\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xd2\\x0f\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfak}W\\xff\\x7f\\x00\\x00C\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xd2\\x0f\t\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00&\\x00*\\x00\\x00\\x00\\x00\\x00\\xb0\\x86\\xb3\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\xd1\\x0f\t\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 21051 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577d6785", "parentcaller": "0x7fff577d5d22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000021a4" } ], "repeated": 0, "id": 21052 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000270c" } ], "repeated": 0, "id": 21053 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\DataProtection" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\DataProtection" } ], "repeated": 0, "id": 21054 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "ValueName", "value": "AppX6718mn68jej1kxz691e99c70v5b37pv0" }, { "name": "Data", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\App\\Capabilities" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppX6718mn68jej1kxz691e99c70v5b37pv0" } ], "repeated": 0, "id": 21055 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577d6c28", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000021a4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 21056 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577d6cc4", "parentcaller": "0x7fff577d6f7c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000021a4" } ], "repeated": 0, "id": 21057 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff5808b02d", "parentcaller": "0x7fff5808ad08", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "ValueName", "value": "AppXpk3ftb6c358840b76bevz745rj5p9nkd" }, { "name": "Data", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.ECApp_10.0.19041.3636_neutral__8wekyb3d8bbwe\\App\\Capabilities" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppXpk3ftb6c358840b76bevz745rj5p9nkd" } ], "repeated": 0, "id": 21058 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff558118a7", "parentcaller": "0x7fff558117bd", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.ECApp_10.0.19041.3636_neutral__8wekyb3d8bbwe\\App\\Capabilities\\UrlAssociations" }, { "name": "Handle", "value": "0x00002368" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.ECApp_10.0.19041.3636_neutral__8wekyb3d8bbwe\\App\\Capabilities\\UrlAssociations" } ], "repeated": 0, "id": 21059 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff55811806", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002368" }, { "name": "ValueName", "value": "https" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.ECApp_10.0.19041.3636_neutral__8wekyb3d8bbwe\\App\\Capabilities\\URLAssociations\\https" } ], "repeated": 0, "id": 21060 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577d4d82", "parentcaller": "0x7fff577d6fe6", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000021a4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 21061 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff5808ab55", "parentcaller": "0x7fff5581161c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x000000ea", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "ValueName", "value": "AppX965kgq2vdagyyvkr19xz1tznhv8zk22p" }, { "name": "Type", "value": "0x00000001", "pretty_value": "REG_SZ" }, { "name": "DataLength", "value": "356" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppX965kgq2vdagyyvkr19xz1tznhv8zk22p" } ], "repeated": 0, "id": 21062 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577d4dd4", "parentcaller": "0x7fff577d6fe6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000021a4" } ], "repeated": 0, "id": 21063 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff5808b02d", "parentcaller": "0x7fff5808ad08", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "ValueName", "value": "AppX965kgq2vdagyyvkr19xz1tznhv8zk22p" }, { "name": "Data", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\\App\\Capabilities" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppX965kgq2vdagyyvkr19xz1tznhv8zk22p" } ], "repeated": 0, "id": 21064 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff558118a7", "parentcaller": "0x7fff558117bd", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\\App\\Capabilities\\UrlAssociations" }, { "name": "Handle", "value": "0x00002368" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\\App\\Capabilities\\UrlAssociations" } ], "repeated": 0, "id": 21065 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000021a4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 21066 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff5809dff7", "parentcaller": "0x7fff5809b764", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "Index", "value": "23" }, { "name": "ValueName", "value": "AppXh7gch3awtd2ekrcke8ktgxdew9dpq4gg" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "DataLength", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppXh7gch3awtd2ekrcke8ktgxdew9dpq4gg" } ], "repeated": 0, "id": 21067 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577d5cfb", "parentcaller": "0x7fff577d7000", "category": "device", "api": "DeviceIoControl", "status": false, "return": "0x00000000", "arguments": [ { "name": "DeviceHandle", "value": "0x000021a4" }, { "name": "IoControlCode", "value": "0x000900a8", "pretty_value": "FSCTL_GET_REPARSE_POINT" }, { "name": "InBuffer", "value": "" }, { "name": "OutBuffer", "value": "\\x98D\\xd4U\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\xd6\\x0f\t\\x00\\x00\\x00\\x00.\\x000\\x00\\x00\\x00\\x00\\x00\\x16\\x0b0\\xee\\x97\\x9c\\x00\\x00D\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\xe6y\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\xd7\\x0f\t\\x00\\x00\\x00\\x00\\xc0_\\xbe\\x08\\x00\\x00\\x00\\x00\\xc0\\xe6y\\x0c\\x00\\x00\\x00\\x00\\xb9\\xd6\\x0f\t\\x00\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00p}W\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\xe6y\\x0c\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00D\\x00\\x00\\x00\\x04\\x01\\x00\\x00\\x00\\x00\\x00\\x00 \\x00\"\\x00\\x00\\x00\\x00\\x00\\xc0\\xe6y\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xe0\\xe6y\\x0c\\x00\\x00\\x00\\x00 \\x00\"\\x00\\x00\\x00\\x00\\x00\\xc0\\xe6y\\x0c\\x00\\x00\\x00\\x00\\xc6\\x0f0\\xee\\x97\\x9c\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 21068 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577d6785", "parentcaller": "0x7fff577d5d22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000021a4" } ], "repeated": 0, "id": 21069 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff5808ab55", "parentcaller": "0x7fff5581161c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x000000ea", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "ValueName", "value": "AppXh7gch3awtd2ekrcke8ktgxdew9dpq4gg" }, { "name": "Type", "value": "0x00000001", "pretty_value": "REG_SZ" }, { "name": "DataLength", "value": "338" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppXh7gch3awtd2ekrcke8ktgxdew9dpq4gg" } ], "repeated": 0, "id": 21070 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff5808b02d", "parentcaller": "0x7fff5808ad08", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "ValueName", "value": "AppXh7gch3awtd2ekrcke8ktgxdew9dpq4gg" }, { "name": "Data", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\\App\\Capabilities" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppXh7gch3awtd2ekrcke8ktgxdew9dpq4gg" } ], "repeated": 0, "id": 21071 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577d6bcf", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc00000ba", "pretty_return": "FILE_IS_A_DIRECTORY", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 21072 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff55811832", "parentcaller": "0x7fff55811659", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002368" } ], "repeated": 0, "id": 21073 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff5809dff7", "parentcaller": "0x7fff5809b764", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "Index", "value": "24" }, { "name": "ValueName", "value": "AppXpb2rprh78ppcr2kwetykjxfzjgj219r0" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "DataLength", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppXpb2rprh78ppcr2kwetykjxfzjgj219r0" } ], "repeated": 0, "id": 21074 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff5808ab55", "parentcaller": "0x7fff5581161c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x000000ea", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "ValueName", "value": "AppXpb2rprh78ppcr2kwetykjxfzjgj219r0" }, { "name": "Type", "value": "0x00000001", "pretty_value": "REG_SZ" }, { "name": "DataLength", "value": "384" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppXpb2rprh78ppcr2kwetykjxfzjgj219r0" } ], "repeated": 0, "id": 21075 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000021a4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 21076 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577d5cfb", "parentcaller": "0x7fff577d6bfa", "category": "device", "api": "DeviceIoControl", "status": false, "return": "0x00000000", "arguments": [ { "name": "DeviceHandle", "value": "0x000021a4" }, { "name": "IoControlCode", "value": "0x000900a8", "pretty_value": "FSCTL_GET_REPARSE_POINT" }, { "name": "InBuffer", "value": "" }, { "name": "OutBuffer", "value": "@\\xd1\\x0f\t\\x00\\x00\\x00\\x00p\\xd1\\x0f\t\\x00\\x00\\x00\\x00\\x80\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\xba\\x00\\x00\\xc0\\xff\\xff\\xff\\xffF\\x0e0\\xee\\x97\\x9c\\x00\\x00\\x08\\x82}\\x1a\\xff\\x7f\\x00\\x00\\xb0\\x05}\\x0c\\x00\\x00\\x00\\x00\\xba\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\xe6y\\x0c\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xd2\\x0f\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfak}W\\xff\\x7f\\x00\\x00C\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xd2\\x0f\t\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x1c\\x00\\x00\\x00\\x00\\x00\\xb0\\x05}\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\xd1\\x0f\t\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 21077 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577d6785", "parentcaller": "0x7fff577d5d22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000021a4" } ], "repeated": 0, "id": 21078 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff558118a7", "parentcaller": "0x7fff558117bd", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\\Microsoft.ZuneVideo\\Capabilities\\UrlAssociations" }, { "name": "Handle", "value": "0x00002368" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\\Microsoft.ZuneVideo\\Capabilities\\UrlAssociations" } ], "repeated": 0, "id": 21079 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff55811806", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002368" }, { "name": "ValueName", "value": "https" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\\Microsoft.ZuneVideo\\Capabilities\\URLAssociations\\https" } ], "repeated": 0, "id": 21080 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff55811832", "parentcaller": "0x7fff55811659", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002368" } ], "repeated": 0, "id": 21081 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577d6c28", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000021a4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 21082 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577d6cc4", "parentcaller": "0x7fff577d6f7c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000021a4" } ], "repeated": 0, "id": 21083 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff5808b02d", "parentcaller": "0x7fff5808ad08", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "ValueName", "value": "AppXg6bgebytw9271kpwkyxm8t8s3zar0kg4" }, { "name": "Data", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\\Microsoft.ZuneMusic\\Capabilities" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppXg6bgebytw9271kpwkyxm8t8s3zar0kg4" } ], "repeated": 0, "id": 21084 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff558118a7", "parentcaller": "0x7fff558117bd", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\\Microsoft.ZuneMusic\\Capabilities\\UrlAssociations" }, { "name": "Handle", "value": "0x00002368" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\\Microsoft.ZuneMusic\\Capabilities\\UrlAssociations" } ], "repeated": 0, "id": 21085 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577d4dc6", "parentcaller": "0x7fff577d6fe6", "category": "device", "api": "DeviceIoControl", "status": false, "return": "0x00000000", "arguments": [ { "name": "DeviceHandle", "value": "0x000021a4" }, { "name": "IoControlCode", "value": "0x004d0008", "pretty_value": "IOCTL_MOUNTDEV_QUERY_DEVICE_NAME" }, { "name": "InBuffer", "value": "" }, { "name": "OutBuffer", "value": "" } ], "repeated": 0, "id": 21086 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff55811806", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002368" }, { "name": "ValueName", "value": "https" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\\Microsoft.ZuneMusic\\Capabilities\\URLAssociations\\https" } ], "repeated": 0, "id": 21087 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff55811832", "parentcaller": "0x7fff55811659", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002368" } ], "repeated": 0, "id": 21088 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff5809dff7", "parentcaller": "0x7fff5809b764", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "Index", "value": "26" }, { "name": "ValueName", "value": "AppX16s5agjg9z17wcy7srnx53ggb3bg1kkk" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "DataLength", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppX16s5agjg9z17wcy7srnx53ggb3bg1kkk" } ], "repeated": 0, "id": 21089 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002708" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 21090 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff5808ab55", "parentcaller": "0x7fff5581161c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x000000ea", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "ValueName", "value": "AppX16s5agjg9z17wcy7srnx53ggb3bg1kkk" }, { "name": "Type", "value": "0x00000001", "pretty_value": "REG_SZ" }, { "name": "DataLength", "value": "342" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppX16s5agjg9z17wcy7srnx53ggb3bg1kkk" } ], "repeated": 0, "id": 21091 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xe3\t\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00`\\xda\\xd9\\xff\\xff\\xff\\xff\\xff\\x83|=K\\x07\\xef\\xdc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xda\\xd9\\xff\\xff\\xff\\xff\\xffH\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 21092 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff5808b02d", "parentcaller": "0x7fff5808ad08", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "ValueName", "value": "AppX16s5agjg9z17wcy7srnx53ggb3bg1kkk" }, { "name": "Data", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\\App\\Capabilities" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppX16s5agjg9z17wcy7srnx53ggb3bg1kkk" } ], "repeated": 0, "id": 21093 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002710" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 21094 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002704" } ], "repeated": 0, "id": 21095 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff558118a7", "parentcaller": "0x7fff558117bd", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\\App\\Capabilities\\UrlAssociations" }, { "name": "Handle", "value": "0x00002368" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\\App\\Capabilities\\UrlAssociations" } ], "repeated": 0, "id": 21096 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002708" } ], "repeated": 0, "id": 21097 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577d4d82", "parentcaller": "0x7fff577d70c7", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000021a4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 21098 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f80" } ], "repeated": 0, "id": 21099 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577d4dc6", "parentcaller": "0x7fff577d70c7", "category": "device", "api": "DeviceIoControl", "status": true, "return": "0x00000001", "arguments": [ { "name": "DeviceHandle", "value": "0x000021a4" }, { "name": "IoControlCode", "value": "0x004d0008", "pretty_value": "IOCTL_MOUNTDEV_QUERY_DEVICE_NAME" }, { "name": "InBuffer", "value": "" }, { "name": "OutBuffer", "value": ".\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00" } ], "repeated": 0, "id": 21100 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff5809dff7", "parentcaller": "0x7fff5809b764", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "Index", "value": "27" }, { "name": "ValueName", "value": "AppXgmcpn0gq19yzw2f9cqpg6saesfc0kybt" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "DataLength", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppXgmcpn0gq19yzw2f9cqpg6saesfc0kybt" } ], "repeated": 0, "id": 21101 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432b95a7", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002710" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 21102 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff5808ab55", "parentcaller": "0x7fff5581161c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x000000ea", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "ValueName", "value": "AppXgmcpn0gq19yzw2f9cqpg6saesfc0kybt" }, { "name": "Type", "value": "0x00000001", "pretty_value": "REG_SZ" }, { "name": "DataLength", "value": "372" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppXgmcpn0gq19yzw2f9cqpg6saesfc0kybt" } ], "repeated": 0, "id": 21103 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002708" } ], "repeated": 0, "id": 21104 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577d4fcf", "parentcaller": "0x7fff577d70c7", "category": "device", "api": "DeviceIoControl", "status": false, "return": "0x00000000", "arguments": [ { "name": "DeviceHandle", "value": "0x000021a4" }, { "name": "IoControlCode", "value": "0x006d0008", "pretty_value": "IOCTL_MOUNTMGR_QUERY_POINTS" }, { "name": "InBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00.\\x00\\x00\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00" }, { "name": "OutBuffer", "value": "\\xee\\x00\\x00\\x00\\x02\\x00\\x00\\x00" } ], "repeated": 0, "id": 21105 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff577d3e41", "parentcaller": "0x7fff578543b9", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x0000268c" }, { "name": "ValueName", "value": "AppXgmcpn0gq19yzw2f9cqpg6saesfc0kybt" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppXgmcpn0gq19yzw2f9cqpg6saesfc0kybt" } ], "repeated": 0, "id": 21106 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577d6785", "parentcaller": "0x7fff577d4fe3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000021a4" } ], "repeated": 0, "id": 21107 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002704" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 21108 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5096", "caller": "0x7fff5780d897", "parentcaller": "0x7fff432c3b2c", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002280" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_48.db" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 21109 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bbd54", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000008e8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 21110 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002708" } ], "repeated": 0, "id": 21111 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bc79b", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000021a4" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 21112 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bc7ca", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002378" } ], "repeated": 0, "id": 21113 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bc7fe", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xe6\\x0f\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 21114 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002710" } ], "repeated": 0, "id": 21115 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bc8d0", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000228c" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 21116 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8e4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002378" } ], "repeated": 0, "id": 21117 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002704" } ], "repeated": 0, "id": 21118 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000021a4" } ], "repeated": 0, "id": 21119 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bbd99", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000008e8" } ], "repeated": 0, "id": 21120 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f80" } ], "repeated": 0, "id": 21121 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "GetDiskFreeSpaceExW", "status": true, "return": "0x00000001", "arguments": [ { "name": "DirectoryName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" } ], "repeated": 0, "id": 21122 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 21123 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f80" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 21124 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002704" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 21125 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002710" } ], "repeated": 0, "id": 21126 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5096", "caller": "0x7fff5780d897", "parentcaller": "0x7fff432c3b51", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002280" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_48.db" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 21127 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x00\\xe6\t\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc7\\xb3\\xf7Y\\xff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\xff\\x7f\\x00\\x00Is}\\x07\\xea[\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\xe9\t\\x08\\x00\\x00\\x00\\x00\\x80ba\\x07\\x00\\x00\\x00\\x00P\\x87m\\x07\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\x95\n\\x05T\\x00\\x00\\x00\\x00`\\xe7\t\\x08\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 21128 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002708" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 21129 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff5780d897", "parentcaller": "0x7fff432bd729", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000008e0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00@\\x00\\x00\\x00\\x00\\x00\\x00`9\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 21130 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002710" } ], "repeated": 0, "id": 21131 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432b9503", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000008e8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 21132 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432b95a7", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000228c" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 21133 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432b95d8", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000021a4" } ], "repeated": 0, "id": 21134 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002704" } ], "repeated": 0, "id": 21135 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432b9610", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x90\\xe6\\x0f\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9d|}\\x1a\\xff\\x7f\\x00\\x00(\\x8b}\\x1a\\xff\\x7f\\x00\\x00\\xe8\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x0f_\\x07\\x00\\x00\\x00\\x00]\\xdd|W\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x009s{\\x06\\xea[\\x00\\x00\\x18\\x0f_\\x07\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 21136 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5096", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000233c" } ], "repeated": 0, "id": 21137 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432b96e3", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002378" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 21138 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000021a4" } ], "repeated": 0, "id": 21139 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f80" } ], "repeated": 0, "id": 21140 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5096", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bc79b", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001170" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 21141 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b9706", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000228c" } ], "repeated": 0, "id": 21142 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5096", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bc7ca", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000026c8" } ], "repeated": 0, "id": 21143 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b9732", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002378" } ], "repeated": 0, "id": 21144 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5096", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bc7fe", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "`\\xedT\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x98\\xeeT\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00C\\x10,C\\xff\\x7f\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb8\\xac,C\\xff\\x7f\\x00\\x00\\xa0t\\xad\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00(\\xefT\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\xa0t\\xad\\x0c\\x00\\x00\\x00\\x00\\xe7\\xab,C\\xff\\x7f\\x00\\x00\\xa0t\\xad\\x0c\\x00\\x00\\x00\\x00Y{ \\x0c\\xea[\\x00\\x00" } ], "repeated": 0, "id": 21145 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002708" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 21146 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5096", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bc8d0", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025f4" }, { "name": "MutexName", "value": "" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 21147 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8e4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026c8" } ], "repeated": 0, "id": 21148 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001170" } ], "repeated": 0, "id": 21149 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002704" } ], "repeated": 0, "id": 21150 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5096", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025f4" } ], "repeated": 0, "id": 21151 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4668", "caller": "0x7fff5780d897", "parentcaller": "0x7fff432c0a96", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000d60" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_48.db" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 21152 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bbc69", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000dcc" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 21153 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xa0\\xe6\t\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00 \\xe7\t\\x08\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x83!,C\\xff\\x7f\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\xaf\\xf3\\x08\\x00\\x00\\x00\\x00P\\xe7\t\\x08\\x00\\x00\\x00\\x00f@5X\\xff\\x7f\\x00\\x00\\x95\n\\x05T\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x95\n\\x05T\\x00\\x00\\x00\\x00\\xc9\\x1f,C\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xff\\x7f\\x00\\x00" } ], "repeated": 0, "id": 21154 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002710" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 21155 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002704" } ], "repeated": 0, "id": 21156 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002708" } ], "repeated": 0, "id": 21157 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff432b643e", "parentcaller": "0x7fff432b8101", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "DE77BA04-3C92-4D11-A1A5-42352A53E0E3" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "7A3BD1D9-35A9-4FB3-A467-F48CAC35E2D0" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 21158 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002710" } ], "repeated": 0, "id": 21159 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff557c403a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025c4" } ], "repeated": 0, "id": 21160 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff40f3155d", "parentcaller": "0x7fff432b645e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "System\\CurrentControlSet\\Services\\HomeGroupProvider\\ServiceData" }, { "name": "Handle", "value": "0x00002378" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\HomeGroupProvider\\ServiceData" } ], "repeated": 0, "id": 21161 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5096", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xe8\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5096" } ], "repeated": 0, "id": 21162 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff40f315b1", "parentcaller": "0x7fff432b645e", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002378" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 21163 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f80" } ], "repeated": 0, "id": 21164 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff40f315e2", "parentcaller": "0x7fff432b645e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002378" } ], "repeated": 0, "id": 21165 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bc79b", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002594" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 21166 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bc7ca", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000026a0" } ], "repeated": 0, "id": 21167 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bc7fe", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x90\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xf8\\x90\\x10\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\r\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 21168 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff558b2b5a", "parentcaller": "0x7fff558658f2", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001011c" }, { "name": "Message", "value": "0x000004b5" } ], "repeated": 0, "id": 21169 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bc8d0", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025ac" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 21170 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8e4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026a0" } ], "repeated": 0, "id": 21171 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002594" } ], "repeated": 0, "id": 21172 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5096", "caller": "0x7fff5587d014", "parentcaller": "0x7fff558252c1", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "CLSID\\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\\Instance" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\CLSID\\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\\Instance" } ], "repeated": 0, "id": 21173 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5096", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 21174 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5096", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff58be0000", "arguments": [ { "name": "lpLibFileName", "value": "shell32.dll" }, { "name": "dwFlags", "value": "0x00004000" } ], "repeated": 0, "id": 21175 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bc7ca", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000025f4" } ], "repeated": 0, "id": 21176 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bc8d0", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001170" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 21177 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5096", "caller": "0x7fff577dac31", "parentcaller": "0x7fff558258ff", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "SHELL32.dll" }, { "name": "ModuleHandle", "value": "0x7fff58be0000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff58c378f0" } ], "repeated": 0, "id": 21178 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8e4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025f4" } ], "repeated": 0, "id": 21179 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025c4" } ], "repeated": 0, "id": 21180 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bbd99", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000008e8" } ], "repeated": 0, "id": 21181 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5096", "caller": "0x7fff58c37b42", "parentcaller": "0x7fff5582592e", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "CLSID\\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\\Instance" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\CLSID\\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\\Instance" } ], "repeated": 0, "id": 21182 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5096", "caller": "0x7fff55863669", "parentcaller": "0x7fff55825399", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "18" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 21183 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5096", "caller": "0x7fff558636a1", "parentcaller": "0x7fff55825399", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "20" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 21184 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5096", "caller": "0x7fff558636e3", "parentcaller": "0x7fff55825399", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002368" } ], "repeated": 0, "id": 21185 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4668", "caller": "0x7fff5780d897", "parentcaller": "0x7fff432bd729", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000d00" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\xf0\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xe3\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 21186 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5096", "caller": "0x7fff558638e8", "parentcaller": "0x7fff55825399", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Classes\\CLSID\\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\\InProcServer32" }, { "name": "Handle", "value": "0x00002368" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\\InProcServer32" } ], "repeated": 0, "id": 21187 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432b9392", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000dcc" } ], "repeated": 0, "id": 21188 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5096", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002368" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "C:\\Windows\\System32\\ieframe.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 21189 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002710" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 21190 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff5780d897", "parentcaller": "0x7fff432bd729", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000008e0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00@\\x00\\x00\\x00\\x00\\x00\\x00`9\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 21191 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002708" } ], "repeated": 0, "id": 21192 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5096", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002368" }, { "name": "ValueName", "value": "LoadWithoutCOM" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\\InProcServer32\\LoadWithoutCOM" } ], "repeated": 0, "id": 21193 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x00\\xe6\t\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc7\\xb3\\xf7Y\\xff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\xff\\x7f\\x00\\x00Is}\\x07\\xea[\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\xe9\t\\x08\\x00\\x00\\x00\\x00\\x80ba\\x07\\x00\\x00\\x00\\x00P\\x87m\\x07\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\x95\n\\x05T\\x00\\x00\\x00\\x00`\\xe7\t\\x08\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 21194 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000025c4" } ], "repeated": 0, "id": 21195 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432b96e3", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025f4" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 21196 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b96f7", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025c4" } ], "repeated": 0, "id": 21197 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002704" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 21198 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4668", "caller": "0x7fff5780d897", "parentcaller": "0x7fff432c3b2c", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000d60" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_48.db" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 21199 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002708" } ], "repeated": 0, "id": 21200 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002710" } ], "repeated": 0, "id": 21201 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bbd54", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000008e8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 21202 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f80" } ], "repeated": 0, "id": 21203 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001170" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 21204 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bc7ca", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000025c4" } ], "repeated": 0, "id": 21205 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bc7fe", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xe6\\x0f\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 21206 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f80" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 21207 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bc8d0", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026c8" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 21208 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025c4" } ], "repeated": 0, "id": 21209 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001170" } ], "repeated": 0, "id": 21210 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002704" } ], "repeated": 0, "id": 21211 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bbd99", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000008e8" } ], "repeated": 0, "id": 21212 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432b9503", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000008e8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 21213 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b953e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026c8" } ], "repeated": 0, "id": 21214 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432b95a7", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000026c8" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 21215 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002704" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 21216 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432b9610", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x90\\xe6\\x0f\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9d|}\\x1a\\xff\\x7f\\x00\\x00(\\x8b}\\x1a\\xff\\x7f\\x00\\x00\\xe8\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x0f_\\x07\\x00\\x00\\x00\\x00]\\xdd|W\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x009s{\\x06\\xea[\\x00\\x00\\x18\\x0f_\\x07\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 21217 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432b96e3", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025c4" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 21218 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b96f7", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001170" } ], "repeated": 0, "id": 21219 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xa0\\xe6\t\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00 \\xe7\t\\x08\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x83!,C\\xff\\x7f\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\xaf\\xf3\\x08\\x00\\x00\\x00\\x00P\\xe7\t\\x08\\x00\\x00\\x00\\x00f@5X\\xff\\x7f\\x00\\x00\\x95\n\\x05T\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x95\n\\x05T\\x00\\x00\\x00\\x00\\xc9\\x1f,C\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xff\\x7f\\x00\\x00" } ], "repeated": 0, "id": 21220 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b9706", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026c8" } ], "repeated": 0, "id": 21221 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b9732", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025c4" } ], "repeated": 0, "id": 21222 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432b9779", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000008e8" } ], "repeated": 0, "id": 21223 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002708" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 21224 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002710" } ], "repeated": 0, "id": 21225 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002704" } ], "repeated": 0, "id": 21226 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002708" } ], "repeated": 0, "id": 21227 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f80" } ], "repeated": 0, "id": 21228 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 21229 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f80" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 21230 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002704" } ], "repeated": 0, "id": 21231 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x00\\xe6\t\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc7\\xb3\\xf7Y\\xff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\xff\\x7f\\x00\\x00Is}\\x07\\xea[\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\xe9\t\\x08\\x00\\x00\\x00\\x00\\x80ba\\x07\\x00\\x00\\x00\\x00P\\x87m\\x07\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\x95\n\\x05T\\x00\\x00\\x00\\x00`\\xe7\t\\x08\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 21232 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002710" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 21233 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577d6bcf", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc00000ba", "pretty_return": "FILE_IS_A_DIRECTORY", "arguments": [ { "name": "FileHandle", "value": "0x80028000" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Desktop" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 21234 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002710" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 21235 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xa0\\xe6\t\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00 \\xe7\t\\x08\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x83!,C\\xff\\x7f\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\xaf\\xf3\\x08\\x00\\x00\\x00\\x00P\\xe7\t\\x08\\x00\\x00\\x00\\x00f@5X\\xff\\x7f\\x00\\x00\\x95\n\\x05T\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x95\n\\x05T\\x00\\x00\\x00\\x00\\xc9\\x1f,C\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xff\\x7f\\x00\\x00" } ], "repeated": 0, "id": 21236 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002704" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 21237 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002708" } ], "repeated": 0, "id": 21238 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002710" } ], "repeated": 0, "id": 21239 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4668", "caller": "0x7fff5780d897", "parentcaller": "0x7fff432c3b51", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000d60" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_48.db" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 21240 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002704" } ], "repeated": 0, "id": 21241 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432c0a05", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000eb8" } ], "repeated": 0, "id": 21242 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f80" } ], "repeated": 0, "id": 21243 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bc79b", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000025ac" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 21244 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bc7ca", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002594" } ], "repeated": 0, "id": 21245 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bc7fe", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "`\\xed:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x98\\xee:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00C\\x10,C\\xff\\x7f\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb8\\xac,C\\xff\\x7f\\x00\\x00\\xb0\\xb3\\xf3\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00(\\xef:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\xb0\\xb3\\xf3\\x08\\x00\\x00\\x00\\x00\\xe7\\xab,C\\xff\\x7f\\x00\\x00\\xb0\\xb3\\xf3\\x08\\x00\\x00\\x00\\x00Y{N\\x0c\\xea[\\x00\\x00" } ], "repeated": 0, "id": 21246 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bc8d0", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026a0" }, { "name": "MutexName", "value": "" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 21247 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8e4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002594" } ], "repeated": 0, "id": 21248 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025ac" } ], "repeated": 0, "id": 21249 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 21250 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f80" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 21251 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b9845", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026a0" } ], "repeated": 0, "id": 21252 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002704" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 21253 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002710" } ], "repeated": 0, "id": 21254 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x00\\xe6\t\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc7\\xb3\\xf7Y\\xff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\xff\\x7f\\x00\\x00Is}\\x07\\xea[\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\xe9\t\\x08\\x00\\x00\\x00\\x00\\x80ba\\x07\\x00\\x00\\x00\\x00P\\x87m\\x07\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\x95\n\\x05T\\x00\\x00\\x00\\x00`\\xe7\t\\x08\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 21255 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002708" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 21256 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002710" } ], "repeated": 0, "id": 21257 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff557c403a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002398" } ], "repeated": 0, "id": 21258 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4668", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff557c3a98", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xf9\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00<\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4668" } ], "repeated": 0, "id": 21259 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002704" } ], "repeated": 0, "id": 21260 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4668", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 21261 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xa0\\xe6\t\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00 \\xe7\t\\x08\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x83!,C\\xff\\x7f\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\xaf\\xf3\\x08\\x00\\x00\\x00\\x00P\\xe7\t\\x08\\x00\\x00\\x00\\x00f@5X\\xff\\x7f\\x00\\x00\\x95\n\\x05T\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x95\n\\x05T\\x00\\x00\\x00\\x00\\xc9\\x1f,C\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xff\\x7f\\x00\\x00" } ], "repeated": 0, "id": 21262 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4668", "caller": "0x7fff577d3b20", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 21263 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 21264 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff577d3e41", "parentcaller": "0x7fff5785448f", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000268c" }, { "name": "ValueName", "value": "AppXgmcpn0gq19yzw2f9cqpg6saesfc0kybt" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\\App\\Capabilities" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppXgmcpn0gq19yzw2f9cqpg6saesfc0kybt" } ], "repeated": 0, "id": 21265 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002398" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 21266 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4668", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002398" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 21267 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4668", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002398" } ], "repeated": 0, "id": 21268 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff558118a7", "parentcaller": "0x7fff558117bd", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\\App\\Capabilities\\UrlAssociations" }, { "name": "Handle", "value": "0x000025c4" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\\App\\Capabilities\\UrlAssociations" } ], "repeated": 0, "id": 21269 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4668", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 21270 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 21271 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff55811806", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000025c4" }, { "name": "ValueName", "value": "https" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\\App\\Capabilities\\URLAssociations\\https" } ], "repeated": 0, "id": 21272 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4668", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002398" }, { "name": "ValueName", "value": "MonitorRegistry" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\MonitorRegistry" } ], "repeated": 0, "id": 21273 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff55811832", "parentcaller": "0x7fff55811659", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025c4" } ], "repeated": 0, "id": 21274 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4668", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002398" } ], "repeated": 0, "id": 21275 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 21276 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f80" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 21277 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x000000ea", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "ValueName", "value": "AppXk1xfdrxj0frfne472rb7b2khxycqzx5x" }, { "name": "Type", "value": "0x00000001", "pretty_value": "REG_SZ" }, { "name": "DataLength", "value": "356" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppXk1xfdrxj0frfne472rb7b2khxycqzx5x" } ], "repeated": 0, "id": 21278 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002710" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 21279 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4668", "caller": "0x7fff558480b3", "parentcaller": "0x7fff55848ae6", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002398" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 21280 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4668", "caller": "0x7fff558480df", "parentcaller": "0x7fff55848ae6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002398" } ], "repeated": 0, "id": 21281 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002708" } ], "repeated": 0, "id": 21282 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff5808b02d", "parentcaller": "0x7fff5808ad08", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "ValueName", "value": "AppXk1xfdrxj0frfne472rb7b2khxycqzx5x" }, { "name": "Data", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\\App\\Capabilities" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppXk1xfdrxj0frfne472rb7b2khxycqzx5x" } ], "repeated": 0, "id": 21283 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4668", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" }, { "name": "Handle", "value": "0x00002398" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" } ], "repeated": 0, "id": 21284 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x00\\xe6\t\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc7\\xb3\\xf7Y\\xff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\xff\\x7f\\x00\\x00Is}\\x07\\xea[\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\xe9\t\\x08\\x00\\x00\\x00\\x00\\x80ba\\x07\\x00\\x00\\x00\\x00P\\x87m\\x07\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\x95\n\\x05T\\x00\\x00\\x00\\x00`\\xe7\t\\x08\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 21285 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4668", "caller": "0x7fff558480b3", "parentcaller": "0x7fff55848ae6", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002398" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 21286 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4668", "caller": "0x7fff558480df", "parentcaller": "0x7fff55848ae6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002398" } ], "repeated": 0, "id": 21287 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002704" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 21288 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff55811806", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000025c4" }, { "name": "ValueName", "value": "https" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\\App\\Capabilities\\URLAssociations\\https" } ], "repeated": 0, "id": 21289 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001011c" }, { "name": "Message", "value": "0x000004b5" } ], "repeated": 0, "id": 21290 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff55811832", "parentcaller": "0x7fff55811659", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025c4" } ], "repeated": 0, "id": 21291 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002708" } ], "repeated": 0, "id": 21292 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "Index", "value": "29" }, { "name": "ValueName", "value": "AppXwbzyd2zvdcrg5n0kqs9656aedk69jvdn" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "DataLength", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppXwbzyd2zvdcrg5n0kqs9656aedk69jvdn" } ], "repeated": 0, "id": 21293 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4668", "caller": "0x7fff55848063", "parentcaller": "0x7fff55848ae6", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" }, { "name": "Handle", "value": "0x00002398" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" } ], "repeated": 0, "id": 21294 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff5808ab55", "parentcaller": "0x7fff5581161c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x000000ea", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "ValueName", "value": "AppXwbzyd2zvdcrg5n0kqs9656aedk69jvdn" }, { "name": "Type", "value": "0x00000001", "pretty_value": "REG_SZ" }, { "name": "DataLength", "value": "370" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppXwbzyd2zvdcrg5n0kqs9656aedk69jvdn" } ], "repeated": 0, "id": 21295 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4668", "caller": "0x7fff558480df", "parentcaller": "0x7fff55848ae6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002398" } ], "repeated": 0, "id": 21296 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002704" } ], "repeated": 0, "id": 21297 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff557c403a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002694" } ], "repeated": 0, "id": 21298 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "ValueName", "value": "AppXwbzyd2zvdcrg5n0kqs9656aedk69jvdn" }, { "name": "Data", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\\Microsoft.XboxApp\\Capabilities" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppXwbzyd2zvdcrg5n0kqs9656aedk69jvdn" } ], "repeated": 0, "id": 21299 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002704" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 21300 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001011c" }, { "name": "Message", "value": "0x000004b5" } ], "repeated": 0, "id": 21301 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff558118a7", "parentcaller": "0x7fff558117bd", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\\Microsoft.XboxApp\\Capabilities\\UrlAssociations" }, { "name": "Handle", "value": "0x000025c4" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\\Microsoft.XboxApp\\Capabilities\\UrlAssociations" } ], "repeated": 0, "id": 21302 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xa0\\xe6\t\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00 \\xe7\t\\x08\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x83!,C\\xff\\x7f\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\xaf\\xf3\\x08\\x00\\x00\\x00\\x00P\\xe7\t\\x08\\x00\\x00\\x00\\x00f@5X\\xff\\x7f\\x00\\x00\\x95\n\\x05T\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x95\n\\x05T\\x00\\x00\\x00\\x00\\xc9\\x1f,C\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xff\\x7f\\x00\\x00" } ], "repeated": 0, "id": 21303 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff55811806", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000025c4" }, { "name": "ValueName", "value": "https" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\\Microsoft.XboxApp\\Capabilities\\URLAssociations\\https" } ], "repeated": 0, "id": 21304 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577d5cfb", "parentcaller": "0x7fff577d6bfa", "category": "device", "api": "DeviceIoControl", "status": false, "return": "0x00000000", "arguments": [ { "name": "DeviceHandle", "value": "0x00002368" }, { "name": "IoControlCode", "value": "0x000900a8", "pretty_value": "FSCTL_GET_REPARSE_POINT" }, { "name": "InBuffer", "value": "" }, { "name": "OutBuffer", "value": "@\\xd1\\x0f\t\\x00\\x00\\x00\\x00p\\xd1\\x0f\t\\x00\\x00\\x00\\x00\\x80\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\xba\\x00\\x00\\xc0\\xff\\xff\\xff\\xffF\\x0e0\\xee\\x97\\x9c\\x00\\x00\\x08\\x82}\\x1a\\xff\\x7f\\x00\\x00\\x10\\xbf\\xc5\\x0b\\x00\\x00\\x00\\x00\\xba\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80u\\xb3\\x0c\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xd2\\x0f\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfak}W\\xff\\x7f\\x00\\x00C\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xd2\\x0f\t\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\xa0\\x1f\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x02\\x80\\x00\\x00\\x00\\x004\\x008\\x00\\xff\\x7f\\x00\\x00\\x10\\xbf\\xc5\\x0b\\x00\\x00\\x00\\x00 #\\xba\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\xc6\\xa7\\x0c\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\xd1\\x0f\t\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 21305 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002710" } ], "repeated": 0, "id": 21306 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff55811832", "parentcaller": "0x7fff55811659", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025c4" } ], "repeated": 0, "id": 21307 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002368" } ], "repeated": 0, "id": 21308 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff5809dff7", "parentcaller": "0x7fff5809b764", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "Index", "value": "30" }, { "name": "ValueName", "value": "AppX5xzkhwabag7tnvestq8sq2mr9aj8zar1" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "DataLength", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppX5xzkhwabag7tnvestq8sq2mr9aj8zar1" } ], "repeated": 0, "id": 21309 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f80" } ], "repeated": 0, "id": 21310 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff5808ab55", "parentcaller": "0x7fff5581161c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x000000ea", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "ValueName", "value": "AppX5xzkhwabag7tnvestq8sq2mr9aj8zar1" }, { "name": "Type", "value": "0x00000001", "pretty_value": "REG_SZ" }, { "name": "DataLength", "value": "376" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppX5xzkhwabag7tnvestq8sq2mr9aj8zar1" } ], "repeated": 0, "id": 21311 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff5808b02d", "parentcaller": "0x7fff5808ad08", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "ValueName", "value": "AppX5xzkhwabag7tnvestq8sq2mr9aj8zar1" }, { "name": "Data", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\\Microsoft.Xbox.TCUI\\Capabilities" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppX5xzkhwabag7tnvestq8sq2mr9aj8zar1" } ], "repeated": 0, "id": 21312 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 21313 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f80" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 21314 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff558118a7", "parentcaller": "0x7fff558117bd", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\\Microsoft.Xbox.TCUI\\Capabilities\\UrlAssociations" }, { "name": "Handle", "value": "0x000025c4" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\\Microsoft.Xbox.TCUI\\Capabilities\\UrlAssociations" } ], "repeated": 0, "id": 21315 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x00\\xe6\t\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc7\\xb3\\xf7Y\\xff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\xff\\x7f\\x00\\x00Is}\\x07\\xea[\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\xe9\t\\x08\\x00\\x00\\x00\\x00\\x80ba\\x07\\x00\\x00\\x00\\x00P\\x87m\\x07\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\x95\n\\x05T\\x00\\x00\\x00\\x00`\\xe7\t\\x08\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 21316 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff55811806", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000025c4" }, { "name": "ValueName", "value": "https" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\\Microsoft.Xbox.TCUI\\Capabilities\\URLAssociations\\https" } ], "repeated": 0, "id": 21317 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f80" } ], "repeated": 0, "id": 21318 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577d4d82", "parentcaller": "0x7fff577d6fe6", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002368" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Desktop" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 21319 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002704" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 21320 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577d4dc6", "parentcaller": "0x7fff577d6fe6", "category": "device", "api": "DeviceIoControl", "status": false, "return": "0x00000000", "arguments": [ { "name": "DeviceHandle", "value": "0x00002368" }, { "name": "IoControlCode", "value": "0x004d0008", "pretty_value": "IOCTL_MOUNTDEV_QUERY_DEVICE_NAME" }, { "name": "InBuffer", "value": "" }, { "name": "OutBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x05\\x80\\x00\\x00\\x00\\x00D\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xc6\\xa7\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xa4\\xaa\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa7\\x0c\\x00\\x00\\x00\\x00\\x00\\x80\\x05\\x80\\x00\\x00\\x00\\x00\\xa8i\\x82U\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x05\\x80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00k\\xb8\\xf7Y\\xff\\x7f\\x00\\x00\\x0f\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x8c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xc6j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00+\\x00S\\x00,\\x00.\\x00\\x00\\x00\\x00\\x00\\xd0\\xc0\\xc5\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x82%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\xa4\\x04%\\x01\\x00\\x00\\x00\\x00\\xf0}\\xb3\\x0c\\x00\\x00\\x00\\x00\\x10@\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\x0c%\\x01\\x00\\x00\\x00\\x00\\x16\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 21321 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff5808b02d", "parentcaller": "0x7fff5808ad08", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "ValueName", "value": "AppX62tmns3r7mfjj7zmt4812e41tngg8jjg" }, { "name": "Data", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\\App\\Capabilities" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppX62tmns3r7mfjj7zmt4812e41tngg8jjg" } ], "repeated": 0, "id": 21322 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577d4dd4", "parentcaller": "0x7fff577d6fe6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002368" } ], "repeated": 0, "id": 21323 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002708" } ], "repeated": 0, "id": 21324 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002710" } ], "repeated": 0, "id": 21325 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff558118a7", "parentcaller": "0x7fff558117bd", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\\App\\Capabilities\\UrlAssociations" }, { "name": "Handle", "value": "0x000025c4" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\\App\\Capabilities\\UrlAssociations" } ], "repeated": 0, "id": 21326 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f80" } ], "repeated": 0, "id": 21327 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f80" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 21328 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000025c4" }, { "name": "ValueName", "value": "https" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\\App\\Capabilities\\URLAssociations\\https" } ], "repeated": 0, "id": 21329 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577d6785", "parentcaller": "0x7fff577d5d22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002368" } ], "repeated": 0, "id": 21330 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025c4" } ], "repeated": 0, "id": 21331 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x00002718" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 21332 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff5809dff7", "parentcaller": "0x7fff5809b764", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "Index", "value": "32" }, { "name": "ValueName", "value": "AppX8ar856dxr16fbc5qq5wfv0wr3pbkbt6b" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "DataLength", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppX8ar856dxr16fbc5qq5wfv0wr3pbkbt6b" } ], "repeated": 0, "id": 21333 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" } ], "repeated": 0, "id": 21334 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff5808ab55", "parentcaller": "0x7fff5581161c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x000000ea", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "ValueName", "value": "AppX8ar856dxr16fbc5qq5wfv0wr3pbkbt6b" }, { "name": "Type", "value": "0x00000001", "pretty_value": "REG_SZ" }, { "name": "DataLength", "value": "350" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppX8ar856dxr16fbc5qq5wfv0wr3pbkbt6b" } ], "repeated": 0, "id": 21335 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 21336 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577d6bcf", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc00000ba", "pretty_return": "FILE_IS_A_DIRECTORY", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 21337 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002704" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 21338 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff5808b02d", "parentcaller": "0x7fff5808ad08", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "ValueName", "value": "AppX8ar856dxr16fbc5qq5wfv0wr3pbkbt6b" }, { "name": "Data", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\\App\\Capabilities" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppX8ar856dxr16fbc5qq5wfv0wr3pbkbt6b" } ], "repeated": 0, "id": 21339 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000025c4" } ], "repeated": 0, "id": 21340 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff558118a7", "parentcaller": "0x7fff558117bd", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\\App\\Capabilities\\UrlAssociations" }, { "name": "Handle", "value": "0x000024b4" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\\App\\Capabilities\\UrlAssociations" } ], "repeated": 0, "id": 21341 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025c4" } ], "repeated": 0, "id": 21342 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff55811806", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000024b4" }, { "name": "ValueName", "value": "https" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\\App\\Capabilities\\URLAssociations\\https" } ], "repeated": 0, "id": 21343 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002704" } ], "repeated": 0, "id": 21344 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577d5cfb", "parentcaller": "0x7fff577d6bfa", "category": "device", "api": "DeviceIoControl", "status": false, "return": "0x00000000", "arguments": [ { "name": "DeviceHandle", "value": "0x00002368" }, { "name": "IoControlCode", "value": "0x000900a8", "pretty_value": "FSCTL_GET_REPARSE_POINT" }, { "name": "InBuffer", "value": "" }, { "name": "OutBuffer", "value": "@\\xd1\\x0f\t\\x00\\x00\\x00\\x00p\\xd1\\x0f\t\\x00\\x00\\x00\\x00\\x80\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\xba\\x00\\x00\\xc0\\xff\\xff\\xff\\xffF\\x0e0\\xee\\x97\\x9c\\x00\\x00\\x08\\x82}\\x1a\\xff\\x7f\\x00\\x00`\\x13\\xa9\\x0c\\x00\\x00\\x00\\x00\\xba\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80u\\xb3\\x0c\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xd2\\x0f\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfak}W\\xff\\x7f\\x00\\x00C\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xd2\\x0f\t\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00$\\x00(\\x00\\x00\\x00\\x00\\x00`\\x13\\xa9\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\xd1\\x0f\t\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 21345 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff55811832", "parentcaller": "0x7fff55811659", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" } ], "repeated": 0, "id": 21346 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577d6785", "parentcaller": "0x7fff577d5d22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002368" } ], "repeated": 0, "id": 21347 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002710" } ], "repeated": 0, "id": 21348 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff5809dff7", "parentcaller": "0x7fff5809b764", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "Index", "value": "33" }, { "name": "ValueName", "value": "AppXnzea40qecbxvx5d82k30pzmnkk9x1yzc" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "DataLength", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppXnzea40qecbxvx5d82k30pzmnkk9x1yzc" } ], "repeated": 0, "id": 21349 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002718" } ], "repeated": 0, "id": 21350 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff5808ab55", "parentcaller": "0x7fff5581161c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x000000ea", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "ValueName", "value": "AppXnzea40qecbxvx5d82k30pzmnkk9x1yzc" }, { "name": "Type", "value": "0x00000001", "pretty_value": "REG_SZ" }, { "name": "DataLength", "value": "364" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppXnzea40qecbxvx5d82k30pzmnkk9x1yzc" } ], "repeated": 0, "id": 21351 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000024b4" } ], "repeated": 0, "id": 21352 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" } ], "repeated": 0, "id": 21353 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577d6c28", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002368" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 21354 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 21355 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002368" } ], "repeated": 0, "id": 21356 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff558118a7", "parentcaller": "0x7fff558117bd", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\\App\\Capabilities\\UrlAssociations" }, { "name": "Handle", "value": "0x00002710" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\\App\\Capabilities\\UrlAssociations" } ], "repeated": 0, "id": 21357 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff55811806", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002710" }, { "name": "ValueName", "value": "https" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\\App\\Capabilities\\URLAssociations\\https" } ], "repeated": 0, "id": 21358 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff55811832", "parentcaller": "0x7fff55811659", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002710" } ], "repeated": 0, "id": 21359 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002708" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 21360 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff5809dff7", "parentcaller": "0x7fff5809b764", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "Index", "value": "34" }, { "name": "ValueName", "value": "AppXmsxme3p13bxdhe981xm4mhe85549r803" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "DataLength", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppXmsxme3p13bxdhe981xm4mhe85549r803" } ], "repeated": 0, "id": 21361 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577d4d82", "parentcaller": "0x7fff577d6fe6", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002368" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 21362 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f80" } ], "repeated": 0, "id": 21363 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577d4dc6", "parentcaller": "0x7fff577d6fe6", "category": "device", "api": "DeviceIoControl", "status": false, "return": "0x00000000", "arguments": [ { "name": "DeviceHandle", "value": "0x00002368" }, { "name": "IoControlCode", "value": "0x004d0008", "pretty_value": "IOCTL_MOUNTDEV_QUERY_DEVICE_NAME" }, { "name": "InBuffer", "value": "" }, { "name": "OutBuffer", "value": "" } ], "repeated": 0, "id": 21364 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577d4dd4", "parentcaller": "0x7fff577d6fe6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002368" } ], "repeated": 0, "id": 21365 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f80" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 21366 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff5808b02d", "parentcaller": "0x7fff5808ad08", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "ValueName", "value": "AppXmsxme3p13bxdhe981xm4mhe85549r803" }, { "name": "Data", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\\App\\Capabilities" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppXmsxme3p13bxdhe981xm4mhe85549r803" } ], "repeated": 0, "id": 21367 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002710" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 21368 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff558118a7", "parentcaller": "0x7fff558117bd", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\\App\\Capabilities\\UrlAssociations" }, { "name": "Handle", "value": "0x00002704" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\\App\\Capabilities\\UrlAssociations" } ], "repeated": 0, "id": 21369 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002714" } ], "repeated": 0, "id": 21370 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "3424", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432ba400", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xc0\\xe5\\x14\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x97\\x9c\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\x8dm\\x07\\x00\\x00\\x00\\x00\\x18\\xe6\\x14\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9d|}\\x1a\\xff\\x7f\\x00\\x00C\\x00:\\x00\\\\x00U\\x00s\\x00e\\x00r\\x00s\\x00\\\\x00a\\x00d\\x00m\\x00i\\x00n\\x00\\\\x00A\\x00p\\x00p\\x00D\\x00a\\x00t\\x00a\\x00\\\\x00L\\x00o\\x00c\\x00a\\x00l\\x00\\\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00\\\\x00W\\x00" } ], "repeated": 0, "id": 21371 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002704" }, { "name": "ValueName", "value": "https" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\\App\\Capabilities\\URLAssociations\\https" } ], "repeated": 0, "id": 21372 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 21373 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff55811832", "parentcaller": "0x7fff55811659", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002704" } ], "repeated": 0, "id": 21374 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff5785593c", "parentcaller": "0x7fff577d2930", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x0000268c" }, { "name": "Index", "value": "35" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 21375 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 21376 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff578559e7", "parentcaller": "0x7fff577d2930", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000268c" }, { "name": "Index", "value": "35" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 21377 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002708" } ], "repeated": 0, "id": 21378 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff5808ab55", "parentcaller": "0x7fff5581161c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x000000ea", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "ValueName", "value": "AppX4ztg00pywtgkv3d1109g9bfffry8qgc4" }, { "name": "Type", "value": "0x00000001", "pretty_value": "REG_SZ" }, { "name": "DataLength", "value": "354" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppX4ztg00pywtgkv3d1109g9bfffry8qgc4" } ], "repeated": 0, "id": 21379 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002368" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 21380 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff577d3e41", "parentcaller": "0x7fff5785448f", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000268c" }, { "name": "ValueName", "value": "AppX4ztg00pywtgkv3d1109g9bfffry8qgc4" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\\App\\Capabilities" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppX4ztg00pywtgkv3d1109g9bfffry8qgc4" } ], "repeated": 0, "id": 21381 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577d5cfb", "parentcaller": "0x7fff577d6bfa", "category": "device", "api": "DeviceIoControl", "status": false, "return": "0x00000000", "arguments": [ { "name": "DeviceHandle", "value": "0x00002368" }, { "name": "IoControlCode", "value": "0x000900a8", "pretty_value": "FSCTL_GET_REPARSE_POINT" }, { "name": "InBuffer", "value": "" }, { "name": "OutBuffer", "value": "\\xb9\\x00\\x10\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xd2\\x0f\t\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00F\\x0e0\\xee\\x97\\x9c\\x00\\x00\\\\x00?\\x00?\\x00\\\\x00\\xc0\\x13\\xa9\\x0c\\x00\\x00\\x00\\x00\\xba\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80u\\xb3\\x0c\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xd2\\x0f\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfak}W\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x1c\\x00\\x00\\x00\\x00\\x00\\xc0\\x13\\xa9\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\xd1\\x0f\t\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 21382 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x0000270c" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 21383 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\\App\\Capabilities\\UrlAssociations" }, { "name": "Handle", "value": "0x00002704" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\\App\\Capabilities\\UrlAssociations" } ], "repeated": 0, "id": 21384 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002708" } ], "repeated": 0, "id": 21385 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002704" }, { "name": "ValueName", "value": "https" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\\App\\Capabilities\\URLAssociations\\https" } ], "repeated": 0, "id": 21386 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000270c" } ], "repeated": 0, "id": 21387 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002368" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 21388 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff5808ab55", "parentcaller": "0x7fff5581161c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x000000ea", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "ValueName", "value": "AppXxevv7w4echwe3sagycz14jet3p1yv42y" }, { "name": "Type", "value": "0x00000001", "pretty_value": "REG_SZ" }, { "name": "DataLength", "value": "410" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppXxevv7w4echwe3sagycz14jet3p1yv42y" } ], "repeated": 0, "id": 21389 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002718" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 21390 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "3424", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432ba605", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002710" } ], "repeated": 0, "id": 21391 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "`\\xe6\\x14\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\\\x00E\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00c\\x00h\\x00e\\x00_\\x001\\x006\\x00.\\x00d\\x00b\\x00\\x00\\x00\\xa8\\xe6\\x14\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00,\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xe6\\x14\\x01\\x00\\x00\\x00\\x00\\x02\\x00P\\x00\\x01\\x00\\x00\\x00\\x00\\x00$\\x00\\x00\\x00\\x00\\x10\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec" } ], "repeated": 0, "id": 21392 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "3424", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432ba71a", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002714" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 21393 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577d4d82", "parentcaller": "0x7fff577d6fe6", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002368" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 21394 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff55811806", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002704" }, { "name": "ValueName", "value": "https" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\\x4c7a3b7dy2188y46d4ya362y19ac5a5805e5x\\Capabilities\\URLAssociations\\https" } ], "repeated": 0, "id": 21395 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002718" } ], "repeated": 0, "id": 21396 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577d4dc6", "parentcaller": "0x7fff577d6fe6", "category": "device", "api": "DeviceIoControl", "status": false, "return": "0x00000000", "arguments": [ { "name": "DeviceHandle", "value": "0x00002368" }, { "name": "IoControlCode", "value": "0x004d0008", "pretty_value": "IOCTL_MOUNTDEV_QUERY_DEVICE_NAME" }, { "name": "InBuffer", "value": "" }, { "name": "OutBuffer", "value": "" } ], "repeated": 0, "id": 21397 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577d4dd4", "parentcaller": "0x7fff577d6fe6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002368" } ], "repeated": 0, "id": 21398 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002714" } ], "repeated": 0, "id": 21399 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "3424", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432ba799", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 21400 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff5809dff7", "parentcaller": "0x7fff5809b764", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "Index", "value": "37" }, { "name": "ValueName", "value": "AppXrzncjcz58hgp52t1bcacmj7qj4p7fgy4" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "DataLength", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppXrzncjcz58hgp52t1bcacmj7qj4p7fgy4" } ], "repeated": 0, "id": 21401 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff5808ab55", "parentcaller": "0x7fff5581161c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x000000ea", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "ValueName", "value": "AppXrzncjcz58hgp52t1bcacmj7qj4p7fgy4" }, { "name": "Type", "value": "0x00000001", "pretty_value": "REG_SZ" }, { "name": "DataLength", "value": "400" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppXrzncjcz58hgp52t1bcacmj7qj4p7fgy4" } ], "repeated": 0, "id": 21402 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002368" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 21403 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "device", "api": "DeviceIoControl", "status": false, "return": "0x00000000", "arguments": [ { "name": "DeviceHandle", "value": "0x00002368" }, { "name": "IoControlCode", "value": "0x000900a8", "pretty_value": "FSCTL_GET_REPARSE_POINT" }, { "name": "InBuffer", "value": "" }, { "name": "OutBuffer", "value": "\\x98D\\xd4U\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\xd6\\x0f\t\\x00\\x00\\x00\\x00,\\x00.\\x00\\x00\\x00\\x00\\x00\\x16\\x0b0\\xee\\x97\\x9c\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80u\\xb3\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\xd7\\x0f\t\\x00\\x00\\x00\\x00\\xc0_\\xbe\\x08\\x00\\x00\\x00\\x00\\x80u\\xb3\\x0c\\x00\\x00\\x00\\x00\\xb9\\xd6\\x0f\t\\x00\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00p}W\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x80u\\xb3\\x0c\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00a\\x00\\x00\\x00\\x04\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x12\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x80u\\xb3\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x92u\\xb3\\x0c\\x00\\x00\\x00\\x00\\x12\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x80u\\xb3\\x0c\\x00\\x00\\x00\\x00\\xc6\\x0f0\\xee\\x97\\x9c\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 21404 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025c4" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 21405 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577d6785", "parentcaller": "0x7fff577d5d22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002368" } ], "repeated": 0, "id": 21406 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff558118a7", "parentcaller": "0x7fff558117bd", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\\microsoft.onenoteim\\Capabilities\\UrlAssociations" }, { "name": "Handle", "value": "0x00002704" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\\microsoft.onenoteim\\Capabilities\\UrlAssociations" } ], "repeated": 0, "id": 21407 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002708" } ], "repeated": 0, "id": 21408 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002704" }, { "name": "ValueName", "value": "https" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\\microsoft.onenoteim\\Capabilities\\URLAssociations\\https" } ], "repeated": 0, "id": 21409 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000270c" } ], "repeated": 0, "id": 21410 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff55811832", "parentcaller": "0x7fff55811659", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002704" } ], "repeated": 0, "id": 21411 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff5809dff7", "parentcaller": "0x7fff5809b764", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "Index", "value": "38" }, { "name": "ValueName", "value": "AppX4eeje680ymkh4aq4e16r99mv706ssk59" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "DataLength", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppX4eeje680ymkh4aq4e16r99mv706ssk59" } ], "repeated": 0, "id": 21412 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f80" } ], "repeated": 0, "id": 21413 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577d4d82", "parentcaller": "0x7fff577d70c7", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002368" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 21414 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002714" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 21415 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577d4dc6", "parentcaller": "0x7fff577d70c7", "category": "device", "api": "DeviceIoControl", "status": true, "return": "0x00000001", "arguments": [ { "name": "DeviceHandle", "value": "0x00002368" }, { "name": "IoControlCode", "value": "0x004d0008", "pretty_value": "IOCTL_MOUNTDEV_QUERY_DEVICE_NAME" }, { "name": "InBuffer", "value": "" }, { "name": "OutBuffer", "value": ".\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00" } ], "repeated": 0, "id": 21416 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff5808b02d", "parentcaller": "0x7fff5808ad08", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "ValueName", "value": "AppX4eeje680ymkh4aq4e16r99mv706ssk59" }, { "name": "Data", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\\Microsoft.MSPaint\\Capabilities" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppX4eeje680ymkh4aq4e16r99mv706ssk59" } ], "repeated": 0, "id": 21417 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577d4dd4", "parentcaller": "0x7fff577d70c7", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002368" } ], "repeated": 0, "id": 21418 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xc0\\xe5\\x14\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x97\\x9c\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\x8dm\\x07\\x00\\x00\\x00\\x00\\x18\\xe6\\x14\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9d|}\\x1a\\xff\\x7f\\x00\\x00C\\x00:\\x00\\\\x00U\\x00s\\x00e\\x00r\\x00s\\x00\\\\x00a\\x00d\\x00m\\x00i\\x00n\\x00\\\\x00A\\x00p\\x00p\\x00D\\x00a\\x00t\\x00a\\x00\\\\x00L\\x00o\\x00c\\x00a\\x00l\\x00\\\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00\\\\x00W\\x00" } ], "repeated": 0, "id": 21419 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d4f8e", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002368" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\MountPointManager" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 21420 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff558118a7", "parentcaller": "0x7fff558117bd", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\\Microsoft.MSPaint\\Capabilities\\UrlAssociations" }, { "name": "Handle", "value": "0x00002704" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\\Microsoft.MSPaint\\Capabilities\\UrlAssociations" } ], "repeated": 0, "id": 21421 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002718" } ], "repeated": 0, "id": 21422 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "3424", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432ba4ee", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002714" } ], "repeated": 0, "id": 21423 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff577d3e41", "parentcaller": "0x7fff578543b9", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00002704" }, { "name": "ValueName", "value": "https" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\\Microsoft.MSPaint\\Capabilities\\URLAssociations\\https" } ], "repeated": 0, "id": 21424 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577d4fcf", "parentcaller": "0x7fff577d70c7", "category": "device", "api": "DeviceIoControl", "status": true, "return": "0x00000001", "arguments": [ { "name": "DeviceHandle", "value": "0x00002368" }, { "name": "IoControlCode", "value": "0x006d0008", "pretty_value": "IOCTL_MOUNTMGR_QUERY_POINTS" }, { "name": "InBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00.\\x00\\x00\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00" }, { "name": "OutBuffer", "value": "\\xee\\x00\\x00\\x00\\x02\\x00\\x00\\x00r\\x00\\x00\\x00\\x1c\\x00\\x00\\x008\\x00\\x00\\x00\\x0c\\x00\\x00\\x00D\\x00\\x00\\x00.\\x00\\x00\\x00\\x8e\\x00\\x00\\x00`\\x00\\x00\\x008\\x00\\x00\\x00\\x0c\\x00\\x00\\x00D\\x00\\x00\\x00.\\x00\\x00\\x00/\\x10\\x8cR\\x00\\x000\\x03\\x00\\x00\\x00\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00\\\\x00D\\x00o\\x00s\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00s\\x00\\\\x00C\\x00:\\x00\\\\x00?\\x00?\\x00\\\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00{\\x005\\x002\\x008\\x00c\\x001\\x000\\x002\\x00f\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x003\\x000\\x000\\x003\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x00}\\x00" } ], "repeated": 0, "id": 21425 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025c4" } ], "repeated": 0, "id": 21426 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 21427 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577d6785", "parentcaller": "0x7fff577d4fe3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002368" } ], "repeated": 0, "id": 21428 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff5809dff7", "parentcaller": "0x7fff5809b764", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "Index", "value": "39" }, { "name": "ValueName", "value": "AppX0ckx7rcw2py1jn1dhe11tgddg9cz4f8q" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "DataLength", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppX0ckx7rcw2py1jn1dhe11tgddg9cz4f8q" } ], "repeated": 0, "id": 21429 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000270c" } ], "repeated": 0, "id": 21430 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff5808ab55", "parentcaller": "0x7fff5581161c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x000000ea", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "ValueName", "value": "AppX0ckx7rcw2py1jn1dhe11tgddg9cz4f8q" }, { "name": "Type", "value": "0x00000001", "pretty_value": "REG_SZ" }, { "name": "DataLength", "value": "374" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppX0ckx7rcw2py1jn1dhe11tgddg9cz4f8q" } ], "repeated": 0, "id": 21431 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bc7fe", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xe6\\x0f\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90zm\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x9a}W\\xff\\x7f\\x00\\x00" } ], "repeated": 0, "id": 21432 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bc8d0", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 21433 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025c4" } ], "repeated": 0, "id": 21434 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff5808b02d", "parentcaller": "0x7fff5808ad08", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "ValueName", "value": "AppX0ckx7rcw2py1jn1dhe11tgddg9cz4f8q" }, { "name": "Data", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\\App\\Capabilities" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppX0ckx7rcw2py1jn1dhe11tgddg9cz4f8q" } ], "repeated": 0, "id": 21435 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8e4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026f8" } ], "repeated": 0, "id": 21436 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002368" } ], "repeated": 0, "id": 21437 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002708" } ], "repeated": 0, "id": 21438 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff558118a7", "parentcaller": "0x7fff558117bd", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\\App\\Capabilities\\UrlAssociations" }, { "name": "Handle", "value": "0x00002704" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\\App\\Capabilities\\UrlAssociations" } ], "repeated": 0, "id": 21439 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f80" } ], "repeated": 0, "id": 21440 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff55811806", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002704" }, { "name": "ValueName", "value": "https" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\\App\\Capabilities\\URLAssociations\\https" } ], "repeated": 0, "id": 21441 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 21442 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f80" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 21443 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff55811832", "parentcaller": "0x7fff55811659", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002704" } ], "repeated": 0, "id": 21444 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002710" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 21445 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff5809dff7", "parentcaller": "0x7fff5809b764", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "Index", "value": "40" }, { "name": "ValueName", "value": "AppX29xjyxk6s619ed3bxzny0w9dtw9j3bj7" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "DataLength", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppX29xjyxk6s619ed3bxzny0w9dtw9j3bj7" } ], "repeated": 0, "id": 21446 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "`\\xe6\\x14\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\\\x00E\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00c\\x00h\\x00e\\x00_\\x001\\x006\\x00.\\x00d\\x00b\\x00\\x00\\x00\\xa8\\xe6\\x14\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00,\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xe6\\x14\\x01\\x00\\x00\\x00\\x00\\x02\\x00P\\x00\\x01\\x00\\x00\\x00\\x00\\x00$\\x00\\x00\\x00\\x00\\x10\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec" } ], "repeated": 0, "id": 21447 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff5808ab55", "parentcaller": "0x7fff5581161c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x000000ea", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "ValueName", "value": "AppX29xjyxk6s619ed3bxzny0w9dtw9j3bj7" }, { "name": "Type", "value": "0x00000001", "pretty_value": "REG_SZ" }, { "name": "DataLength", "value": "378" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppX29xjyxk6s619ed3bxzny0w9dtw9j3bj7" } ], "repeated": 0, "id": 21448 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "3424", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432ba71a", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002718" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 21449 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "3424", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002714" } ], "repeated": 0, "id": 21450 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff5808b02d", "parentcaller": "0x7fff5808ad08", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "ValueName", "value": "AppX29xjyxk6s619ed3bxzny0w9dtw9j3bj7" }, { "name": "Data", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\\App\\Capabilities" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppX29xjyxk6s619ed3bxzny0w9dtw9j3bj7" } ], "repeated": 0, "id": 21451 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002710" } ], "repeated": 0, "id": 21452 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff558118a7", "parentcaller": "0x7fff558117bd", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\\App\\Capabilities\\UrlAssociations" }, { "name": "Handle", "value": "0x00002704" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\\App\\Capabilities\\UrlAssociations" } ], "repeated": 0, "id": 21453 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002718" } ], "repeated": 0, "id": 21454 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff577d3e41", "parentcaller": "0x7fff578543b9", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00002704" }, { "name": "ValueName", "value": "https" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\\App\\Capabilities\\URLAssociations\\https" } ], "repeated": 0, "id": 21455 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000008e0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00@\\x00\\x00\\x00\\x00\\x00\\x00`9\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 21456 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 21457 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432b9503", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000008e8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 21458 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff55811832", "parentcaller": "0x7fff55811659", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002704" } ], "repeated": 0, "id": 21459 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b953e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" } ], "repeated": 0, "id": 21460 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432b95a7", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000022e4" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 21461 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff5809dff7", "parentcaller": "0x7fff5809b764", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "Index", "value": "41" }, { "name": "ValueName", "value": "AppXsb1zgj7e45ja97qva5xv68rnf2mweyv6" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "DataLength", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppXsb1zgj7e45ja97qva5xv68rnf2mweyv6" } ], "repeated": 0, "id": 21462 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432b95d8", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002368" } ], "repeated": 0, "id": 21463 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x90\\xe6\\x0f\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9c|}\\x1a\\xff\\x7f\\x00\\x00(\\x8b}\\x1a\\xff\\x7f\\x00\\x00\\xe8\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x0f_\\x07\\x00\\x00\\x00\\x00]\\xdd|W\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x9a}W\\xff\\x7f\\x00\\x009s{\\x06\\xea[\\x00\\x00\\x18\\x0f_\\x07\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 21464 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 21465 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 21466 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff5808ab55", "parentcaller": "0x7fff5581161c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x000000ea", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "ValueName", "value": "AppXsb1zgj7e45ja97qva5xv68rnf2mweyv6" }, { "name": "Type", "value": "0x00000001", "pretty_value": "REG_SZ" }, { "name": "DataLength", "value": "382" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppXsb1zgj7e45ja97qva5xv68rnf2mweyv6" } ], "repeated": 0, "id": 21467 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b96f7", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002368" } ], "repeated": 0, "id": 21468 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b9706", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" } ], "repeated": 0, "id": 21469 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b9732", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026f8" } ], "repeated": 0, "id": 21470 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000270c" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 21471 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "5100", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432b9779", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000008e8" } ], "repeated": 0, "id": 21472 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025c4" } ], "repeated": 0, "id": 21473 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff5808b02d", "parentcaller": "0x7fff5808ad08", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "ValueName", "value": "AppXsb1zgj7e45ja97qva5xv68rnf2mweyv6" }, { "name": "Data", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\\LocalBridge\\Capabilities" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppXsb1zgj7e45ja97qva5xv68rnf2mweyv6" } ], "repeated": 0, "id": 21474 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 21475 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002708" } ], "repeated": 0, "id": 21476 }, { "timestamp": "2026-05-29 01:05:52,040", "thread_id": "4840", "caller": "0x7fff577d3b20", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 21477 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f80" } ], "repeated": 0, "id": 21478 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 21479 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f80" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 21480 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000026f8" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 21481 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 21482 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000270c" } ], "repeated": 0, "id": 21483 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002694" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\\LocalBridge\\Capabilities\\UrlAssociations" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\\LocalBridge\\Capabilities\\UrlAssociations" } ], "repeated": 0, "id": 21484 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000270c" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 21485 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff55811806", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002694" }, { "name": "ValueName", "value": "https" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\\LocalBridge\\Capabilities\\URLAssociations\\https" } ], "repeated": 0, "id": 21486 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xa0\\xe6\t\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00 \\xe7\t\\x08\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x83!,C\\xff\\x7f\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\xaf\\xf3\\x08\\x00\\x00\\x00\\x00P\\xe7\t\\x08\\x00\\x00\\x00\\x00f@5X\\xff\\x7f\\x00\\x00\\x95\n\\x05T\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x95\n\\x05T\\x00\\x00\\x00\\x00\\xc9\\x1f,C\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xff\\x7f\\x00\\x00" } ], "repeated": 0, "id": 21487 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff55811832", "parentcaller": "0x7fff55811659", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002694" } ], "repeated": 0, "id": 21488 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5100", "caller": "0x7fff40f3155d", "parentcaller": "0x7fff432b645e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "System\\CurrentControlSet\\Services\\HomeGroupProvider\\ServiceData" }, { "name": "Handle", "value": "0x000026f8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\HomeGroupProvider\\ServiceData" } ], "repeated": 0, "id": 21489 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x000025c4" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 21490 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5100", "caller": "0x7fff40f315b1", "parentcaller": "0x7fff432b645e", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000026f8" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 21491 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x000000ea", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "ValueName", "value": "AppX14sgk3n9en7k0bkktc9b16422015ebss" }, { "name": "Type", "value": "0x00000001", "pretty_value": "REG_SZ" }, { "name": "DataLength", "value": "416" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\AppX14sgk3n9en7k0bkktc9b16422015ebss" } ], "repeated": 0, "id": 21492 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000270c" } ], "repeated": 0, "id": 21493 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4956", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025c4" } ], "repeated": 0, "id": 21494 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432ba58b", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002368" } ], "repeated": 0, "id": 21495 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5100", "caller": "0x7fff558b2b5a", "parentcaller": "0x7fff558658f2", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001011c" }, { "name": "Message", "value": "0x000004b5" } ], "repeated": 0, "id": 21496 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002368" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 21497 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000026f8" } ], "repeated": 0, "id": 21498 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5100", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bbd54", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000008e8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 21499 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5100", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bc79b", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000025c4" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 21500 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5100", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bc7ca", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000270c" } ], "repeated": 0, "id": 21501 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5100", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bc7fe", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xe6\\x0f\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 21502 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5100", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bc8d0", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002708" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 21503 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5100", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000270c" } ], "repeated": 0, "id": 21504 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "`\\xe6\\x14\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\\\x00E\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00c\\x00h\\x00e\\x00_\\x001\\x006\\x00.\\x00d\\x00b\\x00\\x00\\x00\\xa8\\xe6\\x14\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00,\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xe6\\x14\\x01\\x00\\x00\\x00\\x00\\x02\\x00P\\x00\\x01\\x00\\x00\\x00\\x00\\x00$\\x00\\x00\\x00\\x00\\x10\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec" } ], "repeated": 0, "id": 21505 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5100", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025c4" } ], "repeated": 0, "id": 21506 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5100", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bbd99", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000008e8" } ], "repeated": 0, "id": 21507 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026f8" } ], "repeated": 0, "id": 21508 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "FBF23B40-E3F0-101B-8488-00AA003E56F8" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "000214FA-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "InternetShortcut" } ], "repeated": 0, "id": 21509 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002368" } ], "repeated": 0, "id": 21510 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff5808b3e7", "parentcaller": "0x7fff558258a5", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ShellCompatibility\\Objects\\{FBF23B40-E3F0-101B-8488-00AA003E56F8}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ShellCompatibility\\Objects\\{FBF23B40-E3F0-101B-8488-00AA003E56F8}" } ], "repeated": 0, "id": 21511 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff55811832", "parentcaller": "0x7fff55811659", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002704" } ], "repeated": 0, "id": 21512 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff5809dff7", "parentcaller": "0x7fff5809b764", "category": "registry", "api": "RegEnumValueW", "status": false, "return": "0x00000103", "pretty_return": "NO_MORE_ITEMS", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "Index", "value": "55" }, { "name": "ValueName", "value": "" }, { "name": "Type", "value": "0", "pretty_value": "REG_NONE" }, { "name": "DataLength", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\RegisteredApplications\\" } ], "repeated": 0, "id": 21513 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff55848063", "parentcaller": "0x7fff55848ae6", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" }, { "name": "Handle", "value": "0x00002694" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" } ], "repeated": 0, "id": 21514 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff58095eff", "parentcaller": "0x7fff580969fb", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" } ], "repeated": 0, "id": 21515 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff558480b3", "parentcaller": "0x7fff55848ae6", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002694" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 21516 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff558480df", "parentcaller": "0x7fff55848ae6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002694" } ], "repeated": 0, "id": 21517 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff58081596", "parentcaller": "0x7fff58ac668d", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\RegisteredApplications" }, { "name": "Handle", "value": "0x0000268c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\RegisteredApplications" } ], "repeated": 0, "id": 21518 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff577ced78", "parentcaller": "0x7fff413787e8", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002694" }, { "name": "MutexName", "value": "Local\\InternetShortcutMutex" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 21519 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff580a4162", "parentcaller": "0x7fff5809ffae", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000268c" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "25" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 21520 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff41378810", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 21521 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff41378810", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002694" }, { "name": "Milliseconds", "value": "10000" } ], "repeated": 0, "id": 21522 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff5809dff7", "parentcaller": "0x7fff5809b764", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "Index", "value": "0" }, { "name": "ValueName", "value": "File Explorer" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "DataLength", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\RegisteredApplications\\File Explorer" } ], "repeated": 0, "id": 21523 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "ValueName", "value": "File Explorer" }, { "name": "Data", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Capabilities" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\RegisteredApplications\\File Explorer" } ], "repeated": 0, "id": 21524 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 21525 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 21526 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000025f4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Capabilities\\UrlAssociations" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Capabilities\\UrlAssociations" } ], "repeated": 0, "id": 21527 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff577d3e41", "parentcaller": "0x7fff578543b9", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000025f4" }, { "name": "ValueName", "value": "https" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Capabilities\\UrlAssociations\\https" } ], "repeated": 0, "id": 21528 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff55811832", "parentcaller": "0x7fff55811659", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025f4" } ], "repeated": 0, "id": 21529 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff5809dff7", "parentcaller": "0x7fff5809b764", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "Index", "value": "1" }, { "name": "ValueName", "value": "Windows Address Book" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "DataLength", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\RegisteredApplications\\Windows Address Book" } ], "repeated": 0, "id": 21530 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff5808ab55", "parentcaller": "0x7fff5581161c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "ValueName", "value": "Windows Address Book" }, { "name": "Data", "value": "Software\\Clients\\Contacts\\Address Book\\Capabilities" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\RegisteredApplications\\Windows Address Book" } ], "repeated": 0, "id": 21531 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5100", "caller": "0x7fff5780d897", "parentcaller": "0x7fff432bd729", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000008e0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00@\\x00\\x00\\x00\\x00\\x00\\x00`9\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 21532 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5100", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432b9503", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000008e8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 21533 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5100", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b953e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002708" } ], "repeated": 0, "id": 21534 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5100", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432b95a7", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002708" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 21535 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff558118a7", "parentcaller": "0x7fff558117bd", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Clients\\Contacts\\Address Book\\Capabilities\\UrlAssociations" }, { "name": "Handle", "value": "0x000025f4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Clients\\Contacts\\Address Book\\Capabilities\\UrlAssociations" } ], "repeated": 0, "id": 21536 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5100", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432b9610", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x90\\xe6\\x0f\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9d|}\\x1a\\xff\\x7f\\x00\\x00(\\x8b}\\x1a\\xff\\x7f\\x00\\x00\\xe8\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x0f_\\x07\\x00\\x00\\x00\\x00]\\xdd|W\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x009s{\\x06\\xea[\\x00\\x00\\x18\\x0f_\\x07\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 21537 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff577d3e41", "parentcaller": "0x7fff578543b9", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000025f4" }, { "name": "ValueName", "value": "https" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Clients\\Contacts\\Address Book\\Capabilities\\URLAssociations\\https" } ], "repeated": 0, "id": 21538 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5100", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b9732", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026c8" } ], "repeated": 0, "id": 21539 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5100", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432b9779", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000008e8" } ], "repeated": 0, "id": 21540 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025f4" } ], "repeated": 0, "id": 21541 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff5809dff7", "parentcaller": "0x7fff5809b764", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "Index", "value": "2" }, { "name": "ValueName", "value": "Windows Disc Image Burner" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "DataLength", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\RegisteredApplications\\Windows Disc Image Burner" } ], "repeated": 0, "id": 21542 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5100", "caller": "0x7fff558b2b5a", "parentcaller": "0x7fff558658f2", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001011c" }, { "name": "Message", "value": "0x000004b5" } ], "repeated": 0, "id": 21543 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5100", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bc7ca", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002708" } ], "repeated": 0, "id": 21544 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5100", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bc7fe", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xe6\\x0f\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 21545 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff41396d8c", "parentcaller": "0x7fff41378e23", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "06EEE834-461C-42C2-8DCF-1502B527B1F9" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "0000010B-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 21546 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5100", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bc8d0", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002704" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 21547 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5100", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8e4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002708" } ], "repeated": 0, "id": 21548 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5100", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026c8" } ], "repeated": 0, "id": 21549 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5100", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bbd99", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000008e8" } ], "repeated": 0, "id": 21550 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff4136a287", "parentcaller": "0x7fff41378e41", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "4DFED3F9-B794-4D3C-973B-DDA1C28105A9" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "B7F02995-84DD-4F19-970A-1625E95C8BD0" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 21551 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff41761431", "parentcaller": "0x7fff4141a7ca", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 21552 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff413788ef", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002694" } ], "repeated": 0, "id": 21553 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff4137890a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002694" } ], "repeated": 0, "id": 21554 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff41354f82", "parentcaller": "0x7fff41354da0", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002596" }, { "name": "SubKey", "value": "{5CBF2787-48CF-4208-B90E-EE5E5D420294}" }, { "name": "Handle", "value": "0x00002696" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\\Instance\\PropertySetStorage\\{5CBF2787-48CF-4208-B90E-EE5E5D420294}" } ], "repeated": 0, "id": 21555 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5100", "caller": "0x7fff5780d897", "parentcaller": "0x7fff432bd729", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000008e0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00@\\x00\\x00\\x00\\x00\\x00\\x00`9\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 21556 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5100", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432b9503", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000008e8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 21557 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5100", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b953e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002704" } ], "repeated": 0, "id": 21558 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5100", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432b95d8", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000026c8" } ], "repeated": 0, "id": 21559 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5100", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432b9610", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x90\\xe6\\x0f\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9d|}\\x1a\\xff\\x7f\\x00\\x00(\\x8b}\\x1a\\xff\\x7f\\x00\\x00\\xe8\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x0f_\\x07\\x00\\x00\\x00\\x00]\\xdd|W\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x009s{\\x06\\xea[\\x00\\x00\\x18\\x0f_\\x07\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 21560 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff41355d10", "parentcaller": "0x7fff41355c77", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002696" }, { "name": "SubKey", "value": "2" }, { "name": "Handle", "value": "0x000026a2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\\Instance\\PropertySetStorage\\{5CBF2787-48CF-4208-B90E-EE5E5D420294}\\2" } ], "repeated": 0, "id": 21561 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5100", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432b96e3", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002708" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 21562 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5100", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b96f7", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026c8" } ], "repeated": 0, "id": 21563 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5100", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b9706", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002704" } ], "repeated": 0, "id": 21564 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff41355e24", "parentcaller": "0x7fff41355d40", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000026a2" }, { "name": "ValueName", "value": "Section" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\\Instance\\PropertySetStorage\\{5CBF2787-48CF-4208-B90E-EE5E5D420294}\\2\\Section" } ], "repeated": 0, "id": 21565 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5100", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432b9779", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000008e8" } ], "repeated": 0, "id": 21566 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5100", "caller": "0x7fff558b2b5a", "parentcaller": "0x7fff558658f2", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001011c" }, { "name": "Message", "value": "0x000004b5" } ], "repeated": 0, "id": 21567 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff41355e24", "parentcaller": "0x7fff41355d56", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002696" }, { "name": "ValueName", "value": "Section" }, { "name": "Data", "value": "InternetShortcut" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\\Instance\\PropertySetStorage\\{5CBF2787-48CF-4208-B90E-EE5E5D420294}\\Section" } ], "repeated": 0, "id": 21568 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5100", "caller": "0x7fff577d6785", "parentcaller": "0x7fff557c403a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025d4" } ], "repeated": 0, "id": 21569 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff41355e24", "parentcaller": "0x7fff41355d74", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026a2" }, { "name": "ValueName", "value": "Key" }, { "name": "Data", "value": "URL" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\\Instance\\PropertySetStorage\\{5CBF2787-48CF-4208-B90E-EE5E5D420294}\\2\\Key" } ], "repeated": 0, "id": 21570 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff5808ab55", "parentcaller": "0x7fff5581161c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "ValueName", "value": "Windows Disc Image Burner" }, { "name": "Data", "value": "Software\\Microsoft\\IsoBurn\\Capabilities" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\RegisteredApplications\\Windows Disc Image Burner" } ], "repeated": 0, "id": 21571 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 21572 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff41355daf", "parentcaller": "0x7fff41355c77", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000026a2" }, { "name": "ValueName", "value": "VarType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\\Instance\\PropertySetStorage\\{5CBF2787-48CF-4208-B90E-EE5E5D420294}\\2\\VarType" } ], "repeated": 0, "id": 21573 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 21574 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff41355dd0", "parentcaller": "0x7fff41355c77", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026a2" } ], "repeated": 0, "id": 21575 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff41354ea3", "parentcaller": "0x7fff41354e44", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002696" } ], "repeated": 0, "id": 21576 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff558119d6", "parentcaller": "0x7fff558117bd", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\IsoBurn\\Capabilities\\UrlAssociations" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\IsoBurn\\Capabilities\\UrlAssociations" } ], "repeated": 0, "id": 21577 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff48bc1d86", "parentcaller": "0x7fff48bbfe51", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 21578 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff5809dff7", "parentcaller": "0x7fff5809b764", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "Index", "value": "3" }, { "name": "ValueName", "value": "Windows Search" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "DataLength", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\RegisteredApplications\\Windows Search" } ], "repeated": 0, "id": 21579 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 21580 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff5808ab55", "parentcaller": "0x7fff5581161c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "ValueName", "value": "Windows Search" }, { "name": "Data", "value": "Software\\Microsoft\\Windows Search\\Capabilities" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\RegisteredApplications\\Windows Search" } ], "repeated": 0, "id": 21581 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff558118a7", "parentcaller": "0x7fff558117bd", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows Search\\Capabilities\\UrlAssociations" }, { "name": "Handle", "value": "0x000025d4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows Search\\Capabilities\\UrlAssociations" } ], "repeated": 0, "id": 21582 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff55811806", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000025d4" }, { "name": "ValueName", "value": "https" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows Search\\Capabilities\\UrlAssociations\\https" } ], "repeated": 0, "id": 21583 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff55811832", "parentcaller": "0x7fff55811659", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025d4" } ], "repeated": 0, "id": 21584 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff41355d10", "parentcaller": "0x7fff41355c77", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002696" }, { "name": "SubKey", "value": "8" }, { "name": "Handle", "value": "0x000026a2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\\Instance\\PropertySetStorage\\{000214A0-0000-0000-C000-000000000046}\\8" } ], "repeated": 0, "id": 21585 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff577d3e41", "parentcaller": "0x7fff578543b9", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000268c" }, { "name": "ValueName", "value": "Internet Explorer" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "SOFTWARE\\Microsoft\\Internet Explorer\\Capabilities" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\RegisteredApplications\\Internet Explorer" } ], "repeated": 0, "id": 21586 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff41355e24", "parentcaller": "0x7fff41355d40", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000026a2" }, { "name": "ValueName", "value": "Section" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\\Instance\\PropertySetStorage\\{000214A0-0000-0000-C000-000000000046}\\8\\Section" } ], "repeated": 0, "id": 21587 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff558118a7", "parentcaller": "0x7fff558117bd", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Internet Explorer\\Capabilities\\UrlAssociations" }, { "name": "Handle", "value": "0x000025d4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Internet Explorer\\Capabilities\\UrlAssociations" } ], "repeated": 0, "id": 21588 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025d4" }, { "name": "ValueName", "value": "https" }, { "name": "Data", "value": "IE.HTTPS" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Internet Explorer\\Capabilities\\UrlAssociations\\https" } ], "repeated": 0, "id": 21589 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff41355e24", "parentcaller": "0x7fff41355d56", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002696" }, { "name": "ValueName", "value": "Section" }, { "name": "Data", "value": "InternetShortcut" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\\Instance\\PropertySetStorage\\{000214A0-0000-0000-C000-000000000046}\\Section" } ], "repeated": 0, "id": 21590 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff55811832", "parentcaller": "0x7fff55811659", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025d4" } ], "repeated": 0, "id": 21591 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d09f7", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000026a2" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 21592 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xc1T\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\xa2&\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xc2T\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 21593 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d09f7", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\\Instance\\PropertySetStorage\\{000214A0-0000-0000-C000-000000000046}\\8" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\\Instance\\PropertySetStorage\\{000214A0-0000-0000-C000-000000000046}\\8" } ], "repeated": 0, "id": 21594 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000025d4" }, { "name": "ValueName", "value": "Hidden" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Internet Explorer\\Capabilities\\Hidden" } ], "repeated": 0, "id": 21595 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff55811a8d", "parentcaller": "0x7fff5581170d", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025d4" } ], "repeated": 0, "id": 21596 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff577d3e41", "parentcaller": "0x7fff578543b9", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000026a2" }, { "name": "ValueName", "value": "Key" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "IconIndex" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\\Instance\\PropertySetStorage\\{000214A0-0000-0000-C000-000000000046}\\8\\Key" } ], "repeated": 0, "id": 21597 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff5809dff7", "parentcaller": "0x7fff5809b764", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "Index", "value": "5" }, { "name": "ValueName", "value": "Paint" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "DataLength", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\RegisteredApplications\\Paint" } ], "repeated": 0, "id": 21598 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff41355daf", "parentcaller": "0x7fff41355c77", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026a2" }, { "name": "ValueName", "value": "VarType" }, { "name": "Data", "value": "3" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\\Instance\\PropertySetStorage\\{000214A0-0000-0000-C000-000000000046}\\8\\VarType" } ], "repeated": 0, "id": 21599 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff41355dd0", "parentcaller": "0x7fff41355c77", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026a2" } ], "repeated": 0, "id": 21600 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff577d43a6", "parentcaller": "0x7fff41354ea3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002696" } ], "repeated": 0, "id": 21601 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff5808ab55", "parentcaller": "0x7fff5581161c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "ValueName", "value": "Paint" }, { "name": "Data", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Applets\\Paint\\Capabilities" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\RegisteredApplications\\Paint" } ], "repeated": 0, "id": 21602 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff41354f82", "parentcaller": "0x7fff41354da0", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002596" }, { "name": "SubKey", "value": "{000214A0-0000-0000-C000-000000000046}" }, { "name": "Handle", "value": "0x00002696" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\\Instance\\PropertySetStorage\\{000214A0-0000-0000-C000-000000000046}" } ], "repeated": 0, "id": 21603 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff558118a7", "parentcaller": "0x7fff558117bd", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Applets\\Paint\\Capabilities\\UrlAssociations" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Applets\\Paint\\Capabilities\\UrlAssociations" } ], "repeated": 1, "id": 21604 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff5809dff7", "parentcaller": "0x7fff5809b764", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "Index", "value": "6" }, { "name": "ValueName", "value": "Notepad" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "DataLength", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\RegisteredApplications\\Notepad" } ], "repeated": 0, "id": 21605 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000026a2" }, { "name": "ValueName", "value": "Section" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\\Instance\\PropertySetStorage\\{000214A0-0000-0000-C000-000000000046}\\15\\Section" } ], "repeated": 0, "id": 21606 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff5808ab55", "parentcaller": "0x7fff5581161c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "ValueName", "value": "Notepad" }, { "name": "Data", "value": "Software\\Microsoft\\Windows\\Notepad\\Capabilities" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\RegisteredApplications\\Notepad" } ], "repeated": 0, "id": 21607 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff41355e24", "parentcaller": "0x7fff41355d56", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002696" }, { "name": "ValueName", "value": "Section" }, { "name": "Data", "value": "InternetShortcut" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\\Instance\\PropertySetStorage\\{000214A0-0000-0000-C000-000000000046}\\Section" } ], "repeated": 0, "id": 21608 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff558118a7", "parentcaller": "0x7fff558117bd", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\Notepad\\Capabilities\\UrlAssociations" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\Notepad\\Capabilities\\UrlAssociations" } ], "repeated": 1, "id": 21609 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff41355e24", "parentcaller": "0x7fff41355d74", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026a2" }, { "name": "ValueName", "value": "Key" }, { "name": "Data", "value": "Roamed" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\\Instance\\PropertySetStorage\\{000214A0-0000-0000-C000-000000000046}\\15\\Key" } ], "repeated": 0, "id": 21610 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff5809dff7", "parentcaller": "0x7fff5809b764", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "Index", "value": "7" }, { "name": "ValueName", "value": "Wordpad" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "DataLength", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\RegisteredApplications\\Wordpad" } ], "repeated": 0, "id": 21611 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff5808ab55", "parentcaller": "0x7fff5581161c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "ValueName", "value": "Wordpad" }, { "name": "Data", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Applets\\Wordpad\\Capabilities" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\RegisteredApplications\\Wordpad" } ], "repeated": 0, "id": 21612 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff41355daf", "parentcaller": "0x7fff41355c77", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026a2" }, { "name": "ValueName", "value": "VarType" }, { "name": "Data", "value": "11" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\\Instance\\PropertySetStorage\\{000214A0-0000-0000-C000-000000000046}\\15\\VarType" } ], "repeated": 0, "id": 21613 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff41355dd0", "parentcaller": "0x7fff41355c77", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026a2" } ], "repeated": 0, "id": 21614 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff558118a7", "parentcaller": "0x7fff558117bd", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Applets\\Wordpad\\Capabilities\\UrlAssociations" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Applets\\Wordpad\\Capabilities\\UrlAssociations" } ], "repeated": 0, "id": 21615 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff41354ea3", "parentcaller": "0x7fff41354e44", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002696" } ], "repeated": 0, "id": 21616 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff48bc1d86", "parentcaller": "0x7fff48bbfe51", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 21617 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff558119d6", "parentcaller": "0x7fff558117bd", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Applets\\Wordpad\\Capabilities\\UrlAssociations" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Applets\\Wordpad\\Capabilities\\UrlAssociations" } ], "repeated": 0, "id": 21618 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff5809dff7", "parentcaller": "0x7fff5809b764", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "Index", "value": "8" }, { "name": "ValueName", "value": "Windows Media Player" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "DataLength", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\RegisteredApplications\\Windows Media Player" } ], "repeated": 0, "id": 21619 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff41354f82", "parentcaller": "0x7fff41354da0", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002596" }, { "name": "SubKey", "value": "{000214A0-0000-0000-C000-000000000046}" }, { "name": "Handle", "value": "0x00002696" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\\Instance\\PropertySetStorage\\{000214A0-0000-0000-C000-000000000046}" } ], "repeated": 0, "id": 21620 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff5808ab55", "parentcaller": "0x7fff5581161c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "ValueName", "value": "Windows Media Player" }, { "name": "Data", "value": "Software\\Clients\\Media\\Windows Media Player\\Capabilities" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\RegisteredApplications\\Windows Media Player" } ], "repeated": 0, "id": 21621 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff558118a7", "parentcaller": "0x7fff558117bd", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Clients\\Media\\Windows Media Player\\Capabilities\\UrlAssociations" }, { "name": "Handle", "value": "0x000022e4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Clients\\Media\\Windows Media Player\\Capabilities\\UrlAssociations" } ], "repeated": 0, "id": 21622 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff41355d10", "parentcaller": "0x7fff41355c77", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002696" }, { "name": "SubKey", "value": "2" }, { "name": "Handle", "value": "0x000026a2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\\Instance\\PropertySetStorage\\{000214A0-0000-0000-C000-000000000046}\\2" } ], "repeated": 0, "id": 21623 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff55811832", "parentcaller": "0x7fff55811659", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" } ], "repeated": 0, "id": 21624 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "Index", "value": "9" }, { "name": "ValueName", "value": "Windows Photo Viewer" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "DataLength", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\RegisteredApplications\\Windows Photo Viewer" } ], "repeated": 0, "id": 21625 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff5808ab55", "parentcaller": "0x7fff5581161c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "ValueName", "value": "Windows Photo Viewer" }, { "name": "Data", "value": "Software\\Microsoft\\Windows Photo Viewer\\Capabilities" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\RegisteredApplications\\Windows Photo Viewer" } ], "repeated": 0, "id": 21626 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff41355e24", "parentcaller": "0x7fff41355d56", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002696" }, { "name": "ValueName", "value": "Section" }, { "name": "Data", "value": "InternetShortcut" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\\Instance\\PropertySetStorage\\{000214A0-0000-0000-C000-000000000046}\\Section" } ], "repeated": 0, "id": 21627 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff558118a7", "parentcaller": "0x7fff558117bd", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows Photo Viewer\\Capabilities\\UrlAssociations" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows Photo Viewer\\Capabilities\\UrlAssociations" } ], "repeated": 0, "id": 21628 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff41355e24", "parentcaller": "0x7fff41355d74", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026a2" }, { "name": "ValueName", "value": "Key" }, { "name": "Data", "value": "URL" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\\Instance\\PropertySetStorage\\{000214A0-0000-0000-C000-000000000046}\\2\\Key" } ], "repeated": 0, "id": 21629 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff558119d6", "parentcaller": "0x7fff558117bd", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows Photo Viewer\\Capabilities\\UrlAssociations" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows Photo Viewer\\Capabilities\\UrlAssociations" } ], "repeated": 0, "id": 21630 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff41355daf", "parentcaller": "0x7fff41355c77", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000026a2" }, { "name": "ValueName", "value": "VarType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\\Instance\\PropertySetStorage\\{000214A0-0000-0000-C000-000000000046}\\2\\VarType" } ], "repeated": 0, "id": 21631 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff41355dd0", "parentcaller": "0x7fff41355c77", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026a2" } ], "repeated": 0, "id": 21632 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff5808ab55", "parentcaller": "0x7fff5581161c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "ValueName", "value": "Microsoft Edge" }, { "name": "Data", "value": "Software\\Clients\\StartMenuInternet\\Microsoft Edge\\Capabilities" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\RegisteredApplications\\Microsoft Edge" } ], "repeated": 0, "id": 21633 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff41354ea3", "parentcaller": "0x7fff41354e44", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002696" } ], "repeated": 0, "id": 21634 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 21635 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff48bc1d86", "parentcaller": "0x7fff48bbfe51", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 21636 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff577d3b20", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 21637 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff48bc1b97", "parentcaller": "0x7fff48bbff1e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 21638 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 21639 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff48bc1d86", "parentcaller": "0x7fff48bbfe51", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 21640 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000022e4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Clients\\StartMenuInternet\\Microsoft Edge\\Capabilities\\UrlAssociations" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Clients\\StartMenuInternet\\Microsoft Edge\\Capabilities\\UrlAssociations" } ], "repeated": 0, "id": 21641 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff48bc1d86", "parentcaller": "0x7fff48bbfe51", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 2, "id": 21642 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff55811806", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "ValueName", "value": "https" }, { "name": "Data", "value": "MSEdgeHTM" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Clients\\StartMenuInternet\\Microsoft Edge\\Capabilities\\URLAssociations\\https" } ], "repeated": 0, "id": 21643 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff48bc1b97", "parentcaller": "0x7fff48bbff1e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 21644 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff55811832", "parentcaller": "0x7fff55811659", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" } ], "repeated": 0, "id": 21645 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 21646 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "filesystem", "api": "SHGetKnownFolderPath", "status": true, "return": "0x00000000", "arguments": [ { "name": "FolderID", "value": "F1B32785-6FBA-4FCF-9D55-7B8E7F157091" }, { "name": "Flags", "value": "0x00000000" }, { "name": "Path", "value": "C:\\Users\\admin\\AppData\\Local" } ], "repeated": 0, "id": 21647 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff558118a7", "parentcaller": "0x7fff55811a52", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Clients\\StartMenuInternet\\Microsoft Edge\\Capabilities" }, { "name": "Handle", "value": "0x000022e4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Clients\\StartMenuInternet\\Microsoft Edge\\Capabilities" } ], "repeated": 0, "id": 21648 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "ValueName", "value": "Hidden" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Clients\\StartMenuInternet\\Microsoft Edge\\Capabilities\\Hidden" } ], "repeated": 0, "id": 21649 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff55811a8d", "parentcaller": "0x7fff5581170d", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" } ], "repeated": 0, "id": 21650 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff5809dff7", "parentcaller": "0x7fff5809b764", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "Index", "value": "11" }, { "name": "ValueName", "value": "Google Chrome" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "DataLength", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\RegisteredApplications\\Google Chrome" } ], "repeated": 0, "id": 21651 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff577d3e41", "parentcaller": "0x7fff578543b9", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000268c" }, { "name": "ValueName", "value": "Google Chrome" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "Software\\Clients\\StartMenuInternet\\Google Chrome\\Capabilities" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\RegisteredApplications\\Google Chrome" } ], "repeated": 0, "id": 21652 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff41354f82", "parentcaller": "0x7fff41354da0", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002596" }, { "name": "SubKey", "value": "{000214A0-0000-0000-C000-000000000046}" }, { "name": "Handle", "value": "0x00002696" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\\Instance\\PropertySetStorage\\{000214A0-0000-0000-C000-000000000046}" } ], "repeated": 0, "id": 21653 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff558118a7", "parentcaller": "0x7fff558117bd", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Clients\\StartMenuInternet\\Google Chrome\\Capabilities\\UrlAssociations" }, { "name": "Handle", "value": "0x000022e4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Clients\\StartMenuInternet\\Google Chrome\\Capabilities\\UrlAssociations" } ], "repeated": 0, "id": 21654 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff41355d10", "parentcaller": "0x7fff41355c77", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00002696" }, { "name": "SubKey", "value": "3" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\\Instance\\PropertySetStorage\\{000214A0-0000-0000-C000-000000000046}\\3" } ], "repeated": 0, "id": 21655 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff41354ea3", "parentcaller": "0x7fff41354e44", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002696" } ], "repeated": 0, "id": 21656 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff55811806", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "ValueName", "value": "https" }, { "name": "Data", "value": "ChromeHTML" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Clients\\StartMenuInternet\\Google Chrome\\Capabilities\\URLAssociations\\https" } ], "repeated": 0, "id": 21657 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff55811832", "parentcaller": "0x7fff55811659", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" } ], "repeated": 0, "id": 21658 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff5781026b", "parentcaller": "0x7fff5585204d", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002694" } ], "repeated": 0, "id": 21659 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff558520a2", "parentcaller": "0x7fff55851f69", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "18" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 21660 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff558118a7", "parentcaller": "0x7fff55811a52", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Clients\\StartMenuInternet\\Google Chrome\\Capabilities" }, { "name": "Handle", "value": "0x000022e4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Clients\\StartMenuInternet\\Google Chrome\\Capabilities" } ], "repeated": 0, "id": 21661 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff55852301", "parentcaller": "0x7fff55851f69", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "20" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 21662 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "ValueName", "value": "Hidden" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Clients\\StartMenuInternet\\Google Chrome\\Capabilities\\Hidden" } ], "repeated": 0, "id": 21663 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff55811a8d", "parentcaller": "0x7fff5581170d", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" } ], "repeated": 0, "id": 21664 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff5809dff7", "parentcaller": "0x7fff5809b764", "category": "registry", "api": "RegEnumValueW", "status": false, "return": "0x00000103", "pretty_return": "NO_MORE_ITEMS", "arguments": [ { "name": "Handle", "value": "0x0000268c" }, { "name": "Index", "value": "12" }, { "name": "ValueName", "value": "" }, { "name": "Type", "value": "0", "pretty_value": "REG_NONE" }, { "name": "DataLength", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\RegisteredApplications\\" } ], "repeated": 0, "id": 21665 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff58095eff", "parentcaller": "0x7fff580969fb", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" } ], "repeated": 0, "id": 21666 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff5588fa25", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 21667 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff5588fa84", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xc6\\xc5\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00" } ], "repeated": 0, "id": 21668 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff5588fa25", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 21669 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 21670 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff5588fa84", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "`]\\xc3\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00" } ], "repeated": 0, "id": 21671 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff577d3b20", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 2, "id": 21672 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 1, "id": 21673 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Extensions\\windows.protocol\\https" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Extensions\\windows.protocol\\https" } ], "repeated": 0, "id": 21674 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff58081596", "parentcaller": "0x7fff58ac668d", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "https" }, { "name": "Handle", "value": "0x00002696" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\https" } ], "repeated": 0, "id": 21675 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff58081596", "parentcaller": "0x7fff58ac668d", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\Shell\\Associations\\UrlAssociations\\https" }, { "name": "Handle", "value": "0x00002708" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Shell\\Associations\\UrlAssociations\\https" } ], "repeated": 0, "id": 21676 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff58081596", "parentcaller": "0x7fff58ac668d", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\Shell\\Associations\\UrlAssociations\\https" }, { "name": "Handle", "value": "0x000025f4" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Shell\\Associations\\UrlAssociations\\https" } ], "repeated": 0, "id": 21677 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff5808ad48", "parentcaller": "0x7fff55854f0b", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002708" }, { "name": "SubKey", "value": "UserChoice" }, { "name": "Handle", "value": "0x00002704" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\Shell\\Associations\\UrlAssociations\\https\\UserChoice" } ], "repeated": 0, "id": 21678 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff5808ad48", "parentcaller": "0x7fff55854f0b", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000025f4" }, { "name": "SubKey", "value": "UserChoice" }, { "name": "Handle", "value": "0x00002378" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\Shell\\Associations\\UrlAssociations\\https\\UserChoice" } ], "repeated": 0, "id": 21679 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808ad83", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002704" }, { "name": "ValueName", "value": "ProgId" }, { "name": "Data", "value": "ChromeHTML" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\Shell\\Associations\\UrlAssociations\\https\\UserChoice\\ProgId" } ], "repeated": 0, "id": 21680 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff5808ad91", "parentcaller": "0x7fff55854f0b", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002378" } ], "repeated": 0, "id": 21681 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff5808ad91", "parentcaller": "0x7fff55854f0b", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002704" } ], "repeated": 0, "id": 21682 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff5808ad48", "parentcaller": "0x7fff55854f4c", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000025f4" }, { "name": "SubKey", "value": "UserChoice" }, { "name": "Handle", "value": "0x00002378" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\Shell\\Associations\\UrlAssociations\\https\\UserChoice" } ], "repeated": 0, "id": 21683 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff5808ad48", "parentcaller": "0x7fff55854f4c", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002708" }, { "name": "SubKey", "value": "UserChoice" }, { "name": "Handle", "value": "0x00002704" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\Shell\\Associations\\UrlAssociations\\https\\UserChoice" } ], "repeated": 0, "id": 21684 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff577d3e41", "parentcaller": "0x7fff578543b9", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002378" }, { "name": "ValueName", "value": "Hash" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "280v3B/15so=" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\Shell\\Associations\\UrlAssociations\\https\\UserChoice\\Hash" } ], "repeated": 0, "id": 21685 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff5808ad91", "parentcaller": "0x7fff55854f4c", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002378" } ], "repeated": 0, "id": 21686 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808ad83", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002704" }, { "name": "ValueName", "value": "Hash" }, { "name": "Data", "value": "280v3B/15so=" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\Shell\\Associations\\UrlAssociations\\https\\UserChoice\\Hash" } ], "repeated": 0, "id": 21687 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff5808ad91", "parentcaller": "0x7fff55854f4c", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002704" } ], "repeated": 0, "id": 21688 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff580a002a", "parentcaller": "0x7fff55854fb9", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000025f4" }, { "name": "SubKey", "value": "" }, { "name": "Handle", "value": "0x00002378" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\Shell\\Associations\\UrlAssociations\\https\\" } ], "repeated": 0, "id": 21689 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff580a002a", "parentcaller": "0x7fff55854fb9", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002708" }, { "name": "SubKey", "value": "" }, { "name": "Handle", "value": "0x00002704" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\Shell\\Associations\\UrlAssociations\\https\\" } ], "repeated": 0, "id": 21690 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000270c" } ], "repeated": 0, "id": 21691 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff55856271", "parentcaller": "0x7fff55854fd0", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002704" }, { "name": "SubKey", "value": "UserChoice" }, { "name": "Handle", "value": "0x000026c8" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\Shell\\Associations\\UrlAssociations\\https\\UserChoice" } ], "repeated": 0, "id": 21692 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff558562bf", "parentcaller": "0x7fff55854fd0", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000026c8" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 21693 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f80" } ], "repeated": 0, "id": 21694 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff5585631b", "parentcaller": "0x7fff55854fd0", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026c8" } ], "repeated": 0, "id": 21695 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff55856271", "parentcaller": "0x7fff55854fd0", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002378" }, { "name": "SubKey", "value": "UserChoice" }, { "name": "Handle", "value": "0x0000228c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\Shell\\Associations\\UrlAssociations\\https\\UserChoice" } ], "repeated": 0, "id": 21696 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff55856bfb", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "0\\xf7\\xa4\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 21697 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff55856c23", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026c8" } ], "repeated": 0, "id": 21698 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026f8" } ], "repeated": 0, "id": 21699 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff5585631b", "parentcaller": "0x7fff55854fd0", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000228c" } ], "repeated": 0, "id": 21700 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff558550f2", "parentcaller": "0x7fff558a966f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002704" } ], "repeated": 0, "id": 21701 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000228c" } ], "repeated": 0, "id": 21702 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000268c" } ], "repeated": 0, "id": 21703 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff55856bfb", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xe0O\\xa5\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 21704 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff55856c23", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000228c" } ], "repeated": 0, "id": 21705 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 21706 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432ba72d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" } ], "repeated": 0, "id": 21707 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff58095eff", "parentcaller": "0x7fff580969fb", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025f4" } ], "repeated": 0, "id": 21708 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff558561ac", "parentcaller": "0x7fff55852f1e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "ChromeHTML" }, { "name": "Handle", "value": "0x000026a2" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\ChromeHTML" } ], "repeated": 0, "id": 21709 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026f8" } ], "repeated": 0, "id": 21710 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff558561c9", "parentcaller": "0x7fff55852f1e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026a2" } ], "repeated": 0, "id": 21711 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff558561ac", "parentcaller": "0x7fff55852f1e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "ChromeHTML" }, { "name": "Handle", "value": "0x000025f6" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\ChromeHTML" } ], "repeated": 0, "id": 21712 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" } ], "repeated": 0, "id": 21713 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff558561c9", "parentcaller": "0x7fff55852f1e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025f6" } ], "repeated": 0, "id": 21714 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff55853405", "parentcaller": "0x7fff55852415", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "ChromeHTML" }, { "name": "Handle", "value": "0x000026a2" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\ChromeHTML" } ], "repeated": 0, "id": 21715 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 21716 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000026a2" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\ChromeHTML" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 21717 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff55853405", "parentcaller": "0x7fff55852415", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "ChromeHTML" }, { "name": "Handle", "value": "0x000025f6" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\ChromeHTML" } ], "repeated": 0, "id": 21718 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000025f6" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\ChromeHTML" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 21719 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000270c" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 21720 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000025f6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 21721 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\ChromeHTML\\CurVer" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\ChromeHTML\\CurVer" } ], "repeated": 0, "id": 21722 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd3T\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\xf6%\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\xd4T\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 21723 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000026a2" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 21724 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x00\\xe6\t\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc7\\xb3\\xf7Y\\xff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\xff\\x7f\\x00\\x00Is}\\x07\\xea[\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\xe9\t\\x08\\x00\\x00\\x00\\x00\\x80ba\\x07\\x00\\x00\\x00\\x00P\\x87m\\x07\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\x95\n\\x05T\\x00\\x00\\x00\\x00`\\xe7\t\\x08\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 21725 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\ChromeHTML\\CurVer" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\ChromeHTML\\CurVer" } ], "repeated": 0, "id": 21726 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000025f6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 21727 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002718" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 21728 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000025f6" }, { "name": "ObjectAttributesName", "value": "CurVer" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\ChromeHTML\\CurVer" } ], "repeated": 0, "id": 21729 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002374" } ], "repeated": 0, "id": 21730 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000270c" } ], "repeated": 0, "id": 21731 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000026a2" }, { "name": "SubKey", "value": "" }, { "name": "Handle", "value": "0x0000239a" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\ChromeHTML\\" } ], "repeated": 0, "id": 21732 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f80" } ], "repeated": 0, "id": 21733 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff55852456", "parentcaller": "0x7fff558580e8", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026a2" } ], "repeated": 0, "id": 21734 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000025f6" }, { "name": "SubKey", "value": "" }, { "name": "Handle", "value": "0x0000237a" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\ChromeHTML\\" } ], "repeated": 0, "id": 21735 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f80" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 21736 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff55852456", "parentcaller": "0x7fff558580e8", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025f6" } ], "repeated": 0, "id": 21737 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000025c4" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 21738 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000237a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 21739 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff5808ad48", "parentcaller": "0x7fff557c7493", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000239a" }, { "name": "SubKey", "value": "DefaultIcon" }, { "name": "Handle", "value": "0x000026a2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\ChromeHTML\\DefaultIcon" } ], "repeated": 0, "id": 21740 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xf0\\xcbT\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00z#\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xccT\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 21741 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000026c4" } ], "repeated": 0, "id": 21742 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\ChromeHTML\\DefaultIcon" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\ChromeHTML\\DefaultIcon" } ], "repeated": 0, "id": 21743 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000237a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 21744 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xc0\\xe5\\x14\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x97\\x9c\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\x8dm\\x07\\x00\\x00\\x00\\x00\\x18\\xe6\\x14\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9d|}\\x1a\\xff\\x7f\\x00\\x00C\\x00:\\x00\\\\x00U\\x00s\\x00e\\x00r\\x00s\\x00\\\\x00a\\x00d\\x00m\\x00i\\x00n\\x00\\\\x00A\\x00p\\x00p\\x00D\\x00a\\x00t\\x00a\\x00\\\\x00L\\x00o\\x00c\\x00a\\x00l\\x00\\\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00\\\\x00W\\x00" } ], "repeated": 0, "id": 21745 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808ad83", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026a2" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe,10" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\ChromeHTML\\DefaultIcon\\(Default)" } ], "repeated": 0, "id": 21746 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808ad83", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025f6" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe,10" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\ChromeHTML\\DefaultIcon\\(Default)" } ], "repeated": 0, "id": 21747 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x00002318" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 21748 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff5808ad91", "parentcaller": "0x7fff557c7493", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026a2" } ], "repeated": 0, "id": 21749 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432ba4df", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026c4" } ], "repeated": 0, "id": 21750 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff577d43a6", "parentcaller": "0x7fff5808ad91", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025f6" } ], "repeated": 0, "id": 21751 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff58095eff", "parentcaller": "0x7fff580969fb", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025d6" } ], "repeated": 0, "id": 21752 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff58095eff", "parentcaller": "0x7fff580969fb", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002696" } ], "repeated": 0, "id": 21753 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff58095eff", "parentcaller": "0x7fff580969fb", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000239a" } ], "repeated": 0, "id": 21754 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 21755 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff58095eff", "parentcaller": "0x7fff580969fb", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000237a" } ], "repeated": 0, "id": 21756 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4956", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002718" } ], "repeated": 0, "id": 21757 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff41354ccb", "parentcaller": "0x7fff41354c34", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c6" } ], "repeated": 0, "id": 21758 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff41354ccb", "parentcaller": "0x7fff41354c34", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002596" } ], "repeated": 0, "id": 21759 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 21760 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002718" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 21761 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bbd54", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000232c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 21762 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000270c" } ], "repeated": 0, "id": 21763 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xa0\\xe6\t\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00 \\xe7\t\\x08\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x83!,C\\xff\\x7f\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\xaf\\xf3\\x08\\x00\\x00\\x00\\x00P\\xe7\t\\x08\\x00\\x00\\x00\\x00f@5X\\xff\\x7f\\x00\\x00\\x95\n\\x05T\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x95\n\\x05T\\x00\\x00\\x00\\x00\\xc9\\x1f,C\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xff\\x7f\\x00\\x00" } ], "repeated": 0, "id": 21764 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x00002374" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 21765 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000270c" } ], "repeated": 0, "id": 21766 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002718" } ], "repeated": 0, "id": 21767 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002374" } ], "repeated": 0, "id": 21768 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f80" } ], "repeated": 0, "id": 21769 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002318" } ], "repeated": 0, "id": 21770 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002318" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 21771 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000004c4" } ], "repeated": 0, "id": 21772 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "`\\xe6\\x14\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\\\x00E\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00c\\x00h\\x00e\\x00_\\x001\\x006\\x00.\\x00d\\x00b\\x00\\x00\\x00\\xa8\\xe6\\x14\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00,\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xe6\\x14\\x01\\x00\\x00\\x00\\x00\\x02\\x00P\\x00\\x01\\x00\\x00\\x00\\x00\\x00$\\x00\\x00\\x00\\x00\\x10\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec" } ], "repeated": 0, "id": 21773 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002398" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 21774 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c4" } ], "repeated": 0, "id": 21775 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002318" } ], "repeated": 0, "id": 21776 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022b0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\xf0\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xe3\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 21777 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002398" } ], "repeated": 0, "id": 21778 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 21779 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f80" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 21780 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bc79b", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002708" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 21781 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bc7ca", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002704" } ], "repeated": 0, "id": 21782 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bc7fe", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xc0\\xee\\xfc\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 21783 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 21784 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 21785 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bc8d0", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026c8" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 21786 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8e4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002704" } ], "repeated": 0, "id": 21787 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002708" } ], "repeated": 0, "id": 21788 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bbd99", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d14" } ], "repeated": 0, "id": 21789 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bc79b", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002594" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 21790 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bc7ca", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002378" } ], "repeated": 0, "id": 21791 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bc7fe", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xc0\\xefT\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00V\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 21792 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bc8d0", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x00002694" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 21793 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002594" } ], "repeated": 0, "id": 21794 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bbd99", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000232c" } ], "repeated": 0, "id": 21795 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002374" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 21796 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002718" } ], "repeated": 0, "id": 21797 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "0\\xe3\t\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00`\\xda\\xd9\\xff\\xff\\xff\\xff\\xff\\x1d\\xe0?K\\x07\\xef\\xdc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xda\\xd9\\xff\\xff\\xff\\xff\\xffH\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x0f\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 21798 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff5780d897", "parentcaller": "0x7fff432bd729", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000d0c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\xf0\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xe3\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 21799 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x0000270c" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 21800 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002718" } ], "repeated": 0, "id": 21801 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432b9503", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d14" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 21802 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002374" } ], "repeated": 0, "id": 21803 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f80" } ], "repeated": 0, "id": 21804 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f80" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 21805 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000025c4" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 21806 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff5780d897", "parentcaller": "0x7fff432bd729", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002288" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\xf0\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xe3\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 21807 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000026c4" } ], "repeated": 0, "id": 21808 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432b9503", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000232c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 21809 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xc0\\xe5\\x14\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x97\\x9c\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\x8dm\\x07\\x00\\x00\\x00\\x00\\x18\\xe6\\x14\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9d|}\\x1a\\xff\\x7f\\x00\\x00C\\x00:\\x00\\\\x00U\\x00s\\x00e\\x00r\\x00s\\x00\\\\x00a\\x00d\\x00m\\x00i\\x00n\\x00\\\\x00A\\x00p\\x00p\\x00D\\x00a\\x00t\\x00a\\x00\\\\x00L\\x00o\\x00c\\x00a\\x00l\\x00\\\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00\\\\x00W\\x00" } ], "repeated": 0, "id": 21810 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x000023a0" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 21811 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026c4" } ], "repeated": 0, "id": 21812 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025c4" } ], "repeated": 0, "id": 21813 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 21814 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b953e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026c8" } ], "repeated": 0, "id": 21815 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 21816 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432b95d8", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002594" } ], "repeated": 0, "id": 21817 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432b9610", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xd0\\xee\\xfc\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9d|}\\x1a\\xff\\x7f\\x00\\x00(\\x8b}\\x1a\\xff\\x7f\\x00\\x00\\x14\r\\x00\\x00\\x00\\x00\\x00\\x00\\x98\\x00\\x1e\\x01\\x00\\x00\\x00\\x00]\\xdd|W\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00y{\\x88\\x08\\xea[\\x00\\x00\\x98\\x00\\x1e\\x01\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 21818 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432b96e3", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x00002378" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 21819 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b96f7", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002594" } ], "repeated": 0, "id": 21820 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b9706", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026c8" } ], "repeated": 0, "id": 21821 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b9732", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002378" } ], "repeated": 0, "id": 21822 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432b9779", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d14" } ], "repeated": 0, "id": 21823 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff59f6a28d", "parentcaller": "0x7fff59f69d71", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\program files\\Google\\Chrome\\application\\chrome.exe" } ], "repeated": 1, "id": 21824 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000270c" } ], "repeated": 0, "id": 21825 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026c4" } ], "repeated": 0, "id": 21826 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff581cbbc8", "parentcaller": "0x7fff58c816ae", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x13360002", "arguments": [ { "name": "lpLibFileName", "value": "c:\\program files\\google\\chrome\\application\\chrome.exe" }, { "name": "dwFlags", "value": "0x00000022" } ], "repeated": 0, "id": 21827 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f80" } ], "repeated": 0, "id": 21828 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b953e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002694" } ], "repeated": 0, "id": 21829 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432b95a7", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002694" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 21830 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432b95d8", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002398" } ], "repeated": 0, "id": 21831 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432b9610", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xd0\\xefT\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9d|}\\x1a\\xff\\x7f\\x00\\x00(\\x8b}\\x1a\\xff\\x7f\\x00\\x00,#\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\xf8\\xa5\\x0c\\x00\\x00\\x00\\x00]\\xdd|W\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00yx \\x0c\\xea[\\x00\\x00\\x08\\xf8\\xa5\\x0c\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 21832 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x00002318" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 21833 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b96f7", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002398" } ], "repeated": 0, "id": 21834 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b9706", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002694" } ], "repeated": 0, "id": 21835 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b9732", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002318" } ], "repeated": 0, "id": 21836 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432b9779", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000232c" } ], "repeated": 0, "id": 21837 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff59f9bb2a", "parentcaller": "0x7fff59f9b99e", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc000003a", "pretty_return": "OBJECT_PATH_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\program files\\Google\\Chrome\\SystemResources\\chrome.exe.mun" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 21838 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff581cbbc8", "parentcaller": "0x7fff58c816ae", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x13790002", "arguments": [ { "name": "lpLibFileName", "value": "c:\\program files\\google\\chrome\\application\\chrome.exe" }, { "name": "dwFlags", "value": "0x00000022" } ], "repeated": 0, "id": 21839 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002374" } ], "repeated": 0, "id": 21840 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "misc", "api": "LoadResource", "status": true, "return": "0x13760130", "arguments": [ { "name": "Module", "value": "0x13360002" }, { "name": "ResourceInfo", "value": "0x1370d7a0" } ], "repeated": 0, "id": 21841 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "`\\xe6\\x14\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\\\x00E\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00c\\x00h\\x00e\\x00_\\x001\\x006\\x00.\\x00d\\x00b\\x00\\x00\\x00\\xa8\\xe6\\x14\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00,\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xe6\\x14\\x01\\x00\\x00\\x00\\x00\\x02\\x00P\\x00\\x01\\x00\\x00\\x00\\x00\\x00$\\x00\\x00\\x00\\x00\\x10\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec" } ], "repeated": 0, "id": 21842 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000468" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 21843 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002718" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 21844 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002374" } ], "repeated": 0, "id": 21845 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000023a0" } ], "repeated": 0, "id": 21846 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002718" } ], "repeated": 0, "id": 21847 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 21848 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff59f9bb2a", "parentcaller": "0x7fff59f9b99e", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc000003a", "pretty_return": "OBJECT_PATH_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\program files\\Google\\Chrome\\SystemResources\\chrome.exe.mun" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 21849 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff581d579e", "parentcaller": "0x7fff577ec4fc", "category": "misc", "api": "FindResourceExW", "status": true, "return": "0x13b3d7a0", "arguments": [ { "name": "Module", "value": "0x13790002" }, { "name": "Type", "value": "#14" }, { "name": "Name", "value": "IDR_X006_HTML_DOC" }, { "name": "Language", "value": "0x00000000" } ], "repeated": 0, "id": 21850 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002374" } ], "repeated": 0, "id": 21851 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff581d57b9", "parentcaller": "0x7fff577ec4fc", "category": "misc", "api": "LoadResource", "status": true, "return": "0x13b90130", "arguments": [ { "name": "Module", "value": "0x13790002" }, { "name": "ResourceInfo", "value": "0x13b3d7a0" } ], "repeated": 0, "id": 21852 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff581d5824", "parentcaller": "0x7fff577ec4fc", "category": "misc", "api": "FindResourceExW", "status": true, "return": "0x13b3d520", "arguments": [ { "name": "Module", "value": "0x13790002" }, { "name": "Type", "value": "#3" }, { "name": "Name", "value": "#55" }, { "name": "Language", "value": "0x00000000" } ], "repeated": 0, "id": 21853 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff581d5842", "parentcaller": "0x7fff577ec4fc", "category": "misc", "api": "SizeofResource", "status": true, "return": "0x000025a8", "arguments": [ { "name": "ModuleHandle", "value": "0x13790002" }, { "name": "ResourceInfo", "value": "0x13b3d520" } ], "repeated": 0, "id": 21854 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff581d585f", "parentcaller": "0x7fff577ec4fc", "category": "misc", "api": "LoadResource", "status": true, "return": "0x13b85150", "arguments": [ { "name": "Module", "value": "0x13790002" }, { "name": "ResourceInfo", "value": "0x13b3d520" } ], "repeated": 0, "id": 21855 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002374" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 21856 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002718" } ], "repeated": 0, "id": 21857 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "`\\xe6\\x14\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\\\x00E\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00c\\x00h\\x00e\\x00_\\x001\\x006\\x00.\\x00d\\x00b\\x00\\x00\\x00\\xa8\\xe6\\x14\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00,\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xe6\\x14\\x01\\x00\\x00\\x00\\x00\\x02\\x00P\\x00\\x01\\x00\\x00\\x00\\x00\\x00$\\x00\\x00\\x00\\x00\\x10\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec" } ], "repeated": 0, "id": 21858 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000023a0" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 21859 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002718" } ], "repeated": 0, "id": 21860 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000023a0" } ], "repeated": 0, "id": 21861 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff577cad9e", "parentcaller": "0x7fff581cbc42", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x13360000" }, { "name": "RegionSize", "value": "0x00421000" } ], "repeated": 0, "id": 21862 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 21863 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff522d71e2", "parentcaller": "0x7fff522d6abb", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\default\\DataProtection\\EDPShowIcons" }, { "name": "Handle", "value": "0x00002708" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\DataProtection\\EDPShowIcons" } ], "repeated": 0, "id": 21864 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000026c4" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 21865 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 21866 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 21867 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff577d3e41", "parentcaller": "0x7fff578543b9", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002708" }, { "name": "ValueName", "value": "PolicyType" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\DataProtection\\EDPShowIcons\\PolicyType" } ], "repeated": 0, "id": 21868 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000270c" } ], "repeated": 0, "id": 21869 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff522d72a8", "parentcaller": "0x7fff522d6abb", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002708" }, { "name": "ValueName", "value": "Behavior" }, { "name": "Data", "value": "298" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\DataProtection\\EDPShowIcons\\Behavior" } ], "repeated": 0, "id": 21870 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "p\\xe4\t\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x06\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x06\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\\x8e\\x10\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 21871 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff577cad9e", "parentcaller": "0x7fff581cbc42", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x13790000" }, { "name": "RegionSize", "value": "0x00421000" } ], "repeated": 0, "id": 21872 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002708" }, { "name": "ValueName", "value": "MergeAlgorithm" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\DataProtection\\EDPShowIcons\\MergeAlgorithm" } ], "repeated": 0, "id": 21873 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff522d739f", "parentcaller": "0x7fff522d6abb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002708" }, { "name": "ValueName", "value": "RegKeyPathRedirectMapped" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\DataProtection\\EDPShowIcons\\RegKeyPathRedirectMapped" } ], "repeated": 0, "id": 21874 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025c4" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 21875 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff522d7402", "parentcaller": "0x7fff522d6abb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002708" }, { "name": "ValueName", "value": "RegKeyPathRedirect" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\DataProtection\\EDPShowIcons\\RegKeyPathRedirect" } ], "repeated": 0, "id": 21876 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff522d755e", "parentcaller": "0x7fff522d6abb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002708" }, { "name": "ValueName", "value": "grouppolicyname" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\DataProtection\\EDPShowIcons\\grouppolicyname" } ], "repeated": 0, "id": 21877 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff522d72a8", "parentcaller": "0x7fff522d6abb", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002318" }, { "name": "ValueName", "value": "Behavior" }, { "name": "Data", "value": "298" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\DataProtection\\EDPShowIcons\\Behavior" } ], "repeated": 0, "id": 21878 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026c4" } ], "repeated": 0, "id": 21879 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff522d79b1", "parentcaller": "0x7fff522d6abb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002708" }, { "name": "ValueName", "value": "ADMXMetadataDevice" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\DataProtection\\EDPShowIcons\\ADMXMetadataDevice" } ], "repeated": 0, "id": 21880 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff522d7a6c", "parentcaller": "0x7fff522d6abb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002708" }, { "name": "ValueName", "value": "ADMXMetadataBoth" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\DataProtection\\EDPShowIcons\\ADMXMetadataBoth" } ], "repeated": 0, "id": 21881 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025c4" } ], "repeated": 0, "id": 21882 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff522d739f", "parentcaller": "0x7fff522d6abb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002318" }, { "name": "ValueName", "value": "RegKeyPathRedirectMapped" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\DataProtection\\EDPShowIcons\\RegKeyPathRedirectMapped" } ], "repeated": 0, "id": 21883 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff522d7402", "parentcaller": "0x7fff522d6abb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002318" }, { "name": "ValueName", "value": "RegKeyPathRedirect" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\DataProtection\\EDPShowIcons\\RegKeyPathRedirect" } ], "repeated": 0, "id": 21884 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff522d76a9", "parentcaller": "0x7fff522d6abb", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002708" } ], "repeated": 0, "id": 21885 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff522d755e", "parentcaller": "0x7fff522d6abb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002318" }, { "name": "ValueName", "value": "grouppolicyname" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\DataProtection\\EDPShowIcons\\grouppolicyname" } ], "repeated": 0, "id": 21886 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff522d78f6", "parentcaller": "0x7fff522d6abb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002318" }, { "name": "ValueName", "value": "ADMXMetadataUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\DataProtection\\EDPShowIcons\\ADMXMetadataUser" } ], "repeated": 0, "id": 21887 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff522d79b1", "parentcaller": "0x7fff522d6abb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002318" }, { "name": "ValueName", "value": "ADMXMetadataDevice" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\DataProtection\\EDPShowIcons\\ADMXMetadataDevice" } ], "repeated": 0, "id": 21888 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff522d7a6c", "parentcaller": "0x7fff522d6abb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002318" }, { "name": "ValueName", "value": "ADMXMetadataBoth" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\DataProtection\\EDPShowIcons\\ADMXMetadataBoth" } ], "repeated": 0, "id": 21889 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432baa24", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 21890 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432baa24", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d14" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 21891 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002318" }, { "name": "ValueName", "value": "30Value" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\DataProtection\\EDPShowIcons\\30Value" } ], "repeated": 0, "id": 21892 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff522d7b73", "parentcaller": "0x7fff522d6abb", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002318" }, { "name": "ValueName", "value": "Value" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\DataProtection\\EDPShowIcons\\Value" } ], "repeated": 0, "id": 21893 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff522d76a9", "parentcaller": "0x7fff522d6abb", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002318" } ], "repeated": 0, "id": 21894 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff522d6d68", "parentcaller": "0x7fff522d6097", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\DataProtection" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\DataProtection" } ], "repeated": 0, "id": 21895 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f80" } ], "repeated": 0, "id": 21896 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002708" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 21897 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002704" } ], "repeated": 0, "id": 21898 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xc0\\xe5\\x14\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x97\\x9c\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\x8dm\\x07\\x00\\x00\\x00\\x00\\x18\\xe6\\x14\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9d|}\\x1a\\xff\\x7f\\x00\\x00C\\x00:\\x00\\\\x00U\\x00s\\x00e\\x00r\\x00s\\x00\\\\x00a\\x00d\\x00m\\x00i\\x00n\\x00\\\\x00A\\x00p\\x00p\\x00D\\x00a\\x00t\\x00a\\x00\\\\x00L\\x00o\\x00c\\x00a\\x00l\\x00\\\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00\\\\x00W\\x00" } ], "repeated": 0, "id": 21899 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432baa24", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 21900 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432baa24", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000232c" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 21901 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001170" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 21902 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002704" } ], "repeated": 0, "id": 21903 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002708" } ], "repeated": 0, "id": 21904 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 21905 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002700" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_32.db" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 21906 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 21907 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bc79b", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002318" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 21908 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bc7ca", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002694" } ], "repeated": 0, "id": 21909 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bc7fe", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xa0\\xe8\\xfc\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00`\\xda\\xd9\\xff\\xff\\xff\\xff\\xff\\x1d\\xe0?K\\x07\\xef\\xdc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xda\\xd9\\xff\\xff\\xff\\xff\\xffH\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 21910 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bc8d0", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x00002398" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 21911 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8e4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002694" } ], "repeated": 0, "id": 21912 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002318" } ], "repeated": 0, "id": 21913 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bc79b", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002318" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 21914 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432baa73", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d14" } ], "repeated": 0, "id": 21915 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bc7ca", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002694" } ], "repeated": 0, "id": 21916 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bc7fe", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xa0\\xe9T\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00`\\xda\\xd9\\xff\\xff\\xff\\xff\\xff\\x1d\\xe0?K\\x07\\xef\\xdc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xda\\xd9\\xff\\xff\\xff\\xff\\xffH\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 21917 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bc8d0", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x000004c4" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 21918 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8e4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002694" } ], "repeated": 0, "id": 21919 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002318" } ], "repeated": 0, "id": 21920 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000232c" } ], "repeated": 0, "id": 21921 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002700" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_32.db" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 21922 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432b9503", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000232c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 21923 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432b9503", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d14" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 21924 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001170" } ], "repeated": 0, "id": 21925 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000468" } ], "repeated": 0, "id": 21926 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001170" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 21927 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000023a0" } ], "repeated": 0, "id": 21928 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000025c4" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 21929 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "`\\xe6\\x14\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\\\x00E\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00c\\x00h\\x00e\\x00_\\x001\\x006\\x00.\\x00d\\x00b\\x00\\x00\\x00\\xa8\\xe6\\x14\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00,\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xe6\\x14\\x01\\x00\\x00\\x00\\x00\\x02\\x00P\\x00\\x01\\x00\\x00\\x00\\x00\\x00$\\x00\\x00\\x00\\x00\\x10\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec" } ], "repeated": 0, "id": 21930 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000026c4" } ], "repeated": 0, "id": 21931 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "@\\xe7\t\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00x\\xe8\t\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00C\\x10,C\\xff\\x7f\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb8\\xac,C\\xff\\x7f\\x00\\x00\\xc0\\xaf\\xf3\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\xe9\t\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\xc0\\xaf\\xf3\\x08\\x00\\x00\\x00\\x00\\xe7\\xab,C\\xff\\x7f\\x00\\x00\\xc0\\xaf\\xf3\\x08\\x00\\x00\\x00\\x009q}\\x07\\xea[\\x00\\x00" } ], "repeated": 0, "id": 21932 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x00002374" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 21933 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000270c" }, { "name": "MutexName", "value": "" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 21934 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000023a0" } ], "repeated": 0, "id": 21935 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026c4" } ], "repeated": 0, "id": 21936 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001170" } ], "repeated": 0, "id": 21937 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025c4" } ], "repeated": 0, "id": 21938 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002374" } ], "repeated": 0, "id": 21939 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4956", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000270c" } ], "repeated": 0, "id": 21940 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 21941 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b953e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c4" } ], "repeated": 0, "id": 21942 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432b95a7", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000004c4" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 21943 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432b95d8", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002318" } ], "repeated": 0, "id": 21944 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432b9610", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xe9T\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00,#\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00i\\xd5[\\x1a\\xff\\x7f\\x00\\x00@\\xeaT\\x03\\x00\\x00\\x00\\x00,#\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0fP\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9d|}\\x1a\\xff\\x7f\\x00\\x00(\\x8b}\\x1a\\xff\\x7f\\x00\\x00,#\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 21945 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 21946 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 21947 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432b96e3", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x00002694" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 21948 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b96f7", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002318" } ], "repeated": 0, "id": 21949 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b9706", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c4" } ], "repeated": 0, "id": 21950 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b9732", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002694" } ], "repeated": 0, "id": 21951 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432b9779", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000232c" } ], "repeated": 0, "id": 21952 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff432b9455", "parentcaller": "0x7fff432baae3", "category": "filesystem", "api": "GetDiskFreeSpaceExW", "status": true, "return": "0x00000001", "arguments": [ { "name": "DirectoryName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" } ], "repeated": 0, "id": 21953 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 21954 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000232c" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 21955 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b953e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002398" } ], "repeated": 0, "id": 21956 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432b95a7", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002398" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 21957 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432b95d8", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002708" } ], "repeated": 0, "id": 21958 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432b9610", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xe8\\xfc\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00i\\xd5[\\x1a\\xff\\x7f\\x00\\x00@\\xe9\\xfc\\x07\\x00\\x00\\x00\\x00\\x14\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0fP\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9d|}\\x1a\\xff\\x7f\\x00\\x00(\\x8b}\\x1a\\xff\\x7f\\x00\\x00\\x14\r\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 21959 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432b96e3", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002704" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 21960 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b96f7", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002708" } ], "repeated": 0, "id": 21961 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b9706", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002398" } ], "repeated": 0, "id": 21962 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b9732", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002704" } ], "repeated": 0, "id": 21963 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432b9779", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d14" } ], "repeated": 0, "id": 21964 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00001170" } ], "repeated": 0, "id": 21965 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff432b9455", "parentcaller": "0x7fff432baae3", "category": "filesystem", "api": "GetDiskFreeSpaceExW", "status": true, "return": "0x00000001", "arguments": [ { "name": "DirectoryName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" } ], "repeated": 0, "id": 21966 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xc0\\xe5\\x14\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x97\\x9c\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\x8dm\\x07\\x00\\x00\\x00\\x00\\x18\\xe6\\x14\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9d|}\\x1a\\xff\\x7f\\x00\\x00C\\x00:\\x00\\\\x00U\\x00s\\x00e\\x00r\\x00s\\x00\\\\x00a\\x00d\\x00m\\x00i\\x00n\\x00\\\\x00A\\x00p\\x00p\\x00D\\x00a\\x00t\\x00a\\x00\\\\x00L\\x00o\\x00c\\x00a\\x00l\\x00\\\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00\\\\x00W\\x00" } ], "repeated": 0, "id": 21967 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000023a0" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 21968 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001170" } ], "repeated": 0, "id": 21969 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002374" } ], "repeated": 0, "id": 21970 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 21971 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432ba560", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 21972 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002694" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 21973 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000004c4" } ], "repeated": 0, "id": 21974 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xecT\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc7\\xb3\\xf7Y\\xff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00i} \\x0c\\xea[\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00(\\xefT\\x03\\x00\\x00\\x00\\x00\\x80ba\\x07\\x00\\x00\\x00\\x00@dm\\x07\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\xb5\n\\x059\\x00\\x00\\x00\\x00\\x80\\xedT\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 21975 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x00002318" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 21976 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c4" } ], "repeated": 0, "id": 21977 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002694" } ], "repeated": 0, "id": 21978 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000232c" } ], "repeated": 0, "id": 21979 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000232c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 21980 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002704" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 21981 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002398" } ], "repeated": 0, "id": 21982 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xeb\\xfc\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc7\\xb3\\xf7Y\\xff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xff\\x7f\\x00\\x00i|\\x88\\x08\\xea[\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00(\\xee\\xfc\\x07\\x00\\x00\\x00\\x00\\x80ba\\x07\\x00\\x00\\x00\\x00 \\x98j\\x07\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00g\n\\x05\\x11\\x00\\x00\\x00\\x00\\x80\\xec\\xfc\\x07\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 21983 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x00002708" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 21984 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002398" } ], "repeated": 0, "id": 21985 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4956", "caller": "0x7ff79bc51f68", "parentcaller": "0x7ff79bc90020", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000100c4" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 21986 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002704" } ], "repeated": 0, "id": 21987 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d14" } ], "repeated": 0, "id": 21988 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d14" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 21989 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000023a0" } ], "repeated": 0, "id": 21990 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000023a0" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 21991 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4956", "caller": "0x7ff79bc51f68", "parentcaller": "0x7ff79bc90020", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000100c4" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 21992 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000022e4" } ], "repeated": 0, "id": 21993 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "`\\xe6\\x14\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\\\x00E\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00c\\x00h\\x00e\\x00_\\x001\\x006\\x00.\\x00d\\x00b\\x00\\x00\\x00\\xa8\\xe6\\x14\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00,\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xe6\\x14\\x01\\x00\\x00\\x00\\x00\\x02\\x00P\\x00\\x01\\x00\\x00\\x00\\x00\\x00$\\x00\\x00\\x00\\x00\\x10\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec" } ], "repeated": 0, "id": 21994 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x000026f8" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 21995 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" } ], "repeated": 0, "id": 21996 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000023a0" } ], "repeated": 0, "id": 21997 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026f8" } ], "repeated": 0, "id": 21998 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 21999 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002318" } ], "repeated": 0, "id": 22000 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002318" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 22001 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002694" } ], "repeated": 0, "id": 22002 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xc0\\xecT\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00@\\xedT\\x03\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x83!,C\\xff\\x7f\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\x1b\\xc5\\x0b\\x00\\x00\\x00\\x00p\\xedT\\x03\\x00\\x00\\x00\\x00f@5X\\xff\\x7f\\x00\\x00\\xb5\n\\x059\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb5\n\\x059\\x00\\x00\\x00\\x00\\xc9\\x1f,C\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xff\\x7f\\x00\\x00" } ], "repeated": 0, "id": 22003 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x000004c4" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 22004 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002694" } ], "repeated": 0, "id": 22005 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 22006 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 22007 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002318" } ], "repeated": 0, "id": 22008 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c4" } ], "repeated": 0, "id": 22009 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000232c" } ], "repeated": 0, "id": 22010 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 22011 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000232c" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 22012 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002708" } ], "repeated": 0, "id": 22013 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002708" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 22014 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000004c4" } ], "repeated": 0, "id": 22015 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xc0\\xeb\\xfc\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00@\\xec\\xfc\\x07\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x83!,C\\xff\\x7f\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10}\\xad\\x0c\\x00\\x00\\x00\\x00p\\xec\\xfc\\x07\\x00\\x00\\x00\\x00f@5X\\xff\\x7f\\x00\\x00g\n\\x05\\x11\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00g\n\\x05\\x11\\x00\\x00\\x00\\x00\\xc9\\x1f,C\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xff\\x7f\\x00\\x00" } ], "repeated": 0, "id": 22016 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002318" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 22017 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c4" } ], "repeated": 0, "id": 22018 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002708" } ], "repeated": 0, "id": 22019 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002318" } ], "repeated": 0, "id": 22020 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d14" } ], "repeated": 0, "id": 22021 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 22022 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d14" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 22023 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000270c" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 22024 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000025c4" } ], "repeated": 0, "id": 22025 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4956", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4956" } ], "repeated": 0, "id": 22026 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xc0\\xe5\\x14\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x97\\x9c\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\x8dm\\x07\\x00\\x00\\x00\\x00\\x18\\xe6\\x14\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9d|}\\x1a\\xff\\x7f\\x00\\x00C\\x00:\\x00\\\\x00U\\x00s\\x00e\\x00r\\x00s\\x00\\\\x00a\\x00d\\x00m\\x00i\\x00n\\x00\\\\x00A\\x00p\\x00p\\x00D\\x00a\\x00t\\x00a\\x00\\\\x00L\\x00o\\x00c\\x00a\\x00l\\x00\\\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00\\\\x00W\\x00" } ], "repeated": 0, "id": 22027 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4956", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432be00e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 22028 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026c4" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 22029 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4956", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432beba1", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025b4" } ], "repeated": 0, "id": 22030 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4956", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432be04f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002700" } ], "repeated": 0, "id": 22031 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025c4" } ], "repeated": 0, "id": 22032 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000270c" } ], "repeated": 0, "id": 22033 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 22034 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002708" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 22035 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000004c4" } ], "repeated": 0, "id": 22036 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 22037 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x00002694" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 22038 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c4" } ], "repeated": 0, "id": 22039 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002708" } ], "repeated": 0, "id": 22040 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000232c" } ], "repeated": 0, "id": 22041 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4696", "caller": "0x7ff79bc7a06e", "parentcaller": "0x7ff79bc66f8c", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 22042 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000232c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 22043 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002708" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 22044 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000004c4" } ], "repeated": 0, "id": 22045 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000039e" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 22046 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xeb\\xfc\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc7\\xb3\\xf7Y\\xff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xff\\x7f\\x00\\x00i|\\x88\\x08\\xea[\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00(\\xee\\xfc\\x07\\x00\\x00\\x00\\x00\\x80ba\\x07\\x00\\x00\\x00\\x00 \\x98j\\x07\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00g\n\\x05\\x11\\x00\\x00\\x00\\x00\\x80\\xec\\xfc\\x07\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 22047 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x000025d4" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 22048 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c4" } ], "repeated": 0, "id": 22049 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000039e" }, { "name": "ObjectAttributesName", "value": "CLSID\\{56AD4C5D-B908-4F85-8FF1-7940C29B3BCF}\\Instance" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{56AD4C5D-B908-4F85-8FF1-7940C29B3BCF}\\Instance" } ], "repeated": 0, "id": 22050 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026c4" } ], "repeated": 0, "id": 22051 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{56AD4C5D-B908-4F85-8FF1-7940C29B3BCF}\\Instance" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{56AD4C5D-B908-4F85-8FF1-7940C29B3BCF}\\Instance" } ], "repeated": 0, "id": 22052 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000026c4" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 22053 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000270c" } ], "repeated": 0, "id": 22054 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 22055 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff58be0000", "arguments": [ { "name": "lpLibFileName", "value": "shell32.dll" }, { "name": "dwFlags", "value": "0x00004000" } ], "repeated": 0, "id": 22056 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "`\\xe6\\x14\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\\\x00E\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00c\\x00h\\x00e\\x00_\\x001\\x006\\x00.\\x00d\\x00b\\x00\\x00\\x00\\xa8\\xe6\\x14\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00,\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xe6\\x14\\x01\\x00\\x00\\x00\\x00\\x02\\x00P\\x00\\x01\\x00\\x00\\x00\\x00\\x00$\\x00\\x00\\x00\\x00\\x10\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec" } ], "repeated": 0, "id": 22057 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "SHELL32.dll" }, { "name": "ModuleHandle", "value": "0x7fff58be0000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff58c378f0" } ], "repeated": 0, "id": 22058 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x000025c4" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 22059 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "synchronization", "api": "NtFindAtom", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "AtomName", "value": "{9F4C2855-9F79-4B39-A8D0-E1D42DE1D5F3} 3" }, { "name": "Atom", "value": "0x00000000" } ], "repeated": 0, "id": 22060 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000270c" } ], "repeated": 0, "id": 22061 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026c4" } ], "repeated": 0, "id": 22062 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025c4" } ], "repeated": 0, "id": 22063 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 22064 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002694" } ], "repeated": 0, "id": 22065 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002694" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 22066 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002708" } ], "repeated": 0, "id": 22067 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xc0\\xecT\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00@\\xedT\\x03\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x83!,C\\xff\\x7f\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\x1b\\xc5\\x0b\\x00\\x00\\x00\\x00p\\xedT\\x03\\x00\\x00\\x00\\x00f@5X\\xff\\x7f\\x00\\x00\\xb5\n\\x059\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb5\n\\x059\\x00\\x00\\x00\\x00\\xc9\\x1f,C\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xff\\x7f\\x00\\x00" } ], "repeated": 0, "id": 22068 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 22069 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 22070 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x000004c4" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 22071 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002708" } ], "repeated": 0, "id": 22072 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002694" } ], "repeated": 0, "id": 22073 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c4" } ], "repeated": 0, "id": 22074 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000232c" } ], "repeated": 0, "id": 22075 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 22076 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "5096", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000232c" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 22077 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025d4" } ], "repeated": 0, "id": 22078 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000025d4" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 22079 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002700" } ], "repeated": 0, "id": 22080 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xc0\\xeb\\xfc\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00@\\xec\\xfc\\x07\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x83!,C\\xff\\x7f\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10}\\xad\\x0c\\x00\\x00\\x00\\x00p\\xec\\xfc\\x07\\x00\\x00\\x00\\x00f@5X\\xff\\x7f\\x00\\x00g\n\\x05\\x11\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00g\n\\x05\\x11\\x00\\x00\\x00\\x00\\xc9\\x1f,C\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xff\\x7f\\x00\\x00" } ], "repeated": 0, "id": 22081 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025b4" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 22082 }, { "timestamp": "2026-05-29 01:05:52,055", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002700" } ], "repeated": 0, "id": 22083 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4956", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432be00e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000468" } ], "repeated": 0, "id": 22084 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4956", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432be00e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002160" } ], "repeated": 0, "id": 22085 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4956", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432be00e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002168" } ], "repeated": 0, "id": 22086 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4956", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432be00e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000229c" } ], "repeated": 0, "id": 22087 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4956", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432be00e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002314" } ], "repeated": 0, "id": 22088 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025d4" } ], "repeated": 0, "id": 22089 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025b4" } ], "repeated": 0, "id": 22090 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d14" } ], "repeated": 0, "id": 22091 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 22092 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d14" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 22093 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000229c" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 22094 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002168" } ], "repeated": 0, "id": 22095 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xc0\\xe5\\x14\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x97\\x9c\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\x8dm\\x07\\x00\\x00\\x00\\x00\\x18\\xe6\\x14\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9d|}\\x1a\\xff\\x7f\\x00\\x00C\\x00:\\x00\\\\x00U\\x00s\\x00e\\x00r\\x00s\\x00\\\\x00a\\x00d\\x00m\\x00i\\x00n\\x00\\\\x00A\\x00p\\x00p\\x00D\\x00a\\x00t\\x00a\\x00\\\\x00L\\x00o\\x00c\\x00a\\x00l\\x00\\\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00\\\\x00W\\x00" } ], "repeated": 0, "id": 22096 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002160" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 22097 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002168" } ], "repeated": 0, "id": 22098 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000229c" } ], "repeated": 0, "id": 22099 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 22100 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002378" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 22101 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 22102 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000026c8" } ], "repeated": 0, "id": 22103 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xecT\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc7\\xb3\\xf7Y\\xff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00i} \\x0c\\xea[\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00(\\xefT\\x03\\x00\\x00\\x00\\x00\\x80ba\\x07\\x00\\x00\\x00\\x00@dm\\x07\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\xb5\n\\x059\\x00\\x00\\x00\\x00\\x80\\xedT\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 22104 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x00002594" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 22105 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026c8" } ], "repeated": 0, "id": 22106 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002378" } ], "repeated": 0, "id": 22107 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000232c" } ], "repeated": 0, "id": 22108 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000232c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 22109 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000004c4" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 22110 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002694" } ], "repeated": 0, "id": 22111 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xeb\\xfc\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc7\\xb3\\xf7Y\\xff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xff\\x7f\\x00\\x00i|\\x88\\x08\\xea[\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00(\\xee\\xfc\\x07\\x00\\x00\\x00\\x00\\x80ba\\x07\\x00\\x00\\x00\\x00 \\x98j\\x07\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00g\n\\x05\\x11\\x00\\x00\\x00\\x00\\x80\\xec\\xfc\\x07\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 22112 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x00002708" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 22113 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002694" } ], "repeated": 0, "id": 22114 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c4" } ], "repeated": 0, "id": 22115 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d14" } ], "repeated": 0, "id": 22116 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d14" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 22117 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002160" } ], "repeated": 0, "id": 22118 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002160" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 22119 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000229c" } ], "repeated": 0, "id": 22120 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "`\\xe6\\x14\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\\\x00E\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00c\\x00h\\x00e\\x00_\\x001\\x006\\x00.\\x00d\\x00b\\x00\\x00\\x00\\xa8\\xe6\\x14\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00,\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xe6\\x14\\x01\\x00\\x00\\x00\\x00\\x02\\x00P\\x00\\x01\\x00\\x00\\x00\\x00\\x00$\\x00\\x00\\x00\\x00\\x10\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec" } ], "repeated": 0, "id": 22121 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x00002168" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 22122 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000229c" } ], "repeated": 0, "id": 22123 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002160" } ], "repeated": 0, "id": 22124 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002168" } ], "repeated": 0, "id": 22125 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4956", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432be00e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001f44" } ], "repeated": 0, "id": 22126 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 22127 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4956", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432be00e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000021e4" } ], "repeated": 0, "id": 22128 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4956", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432be00e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000258c" } ], "repeated": 0, "id": 22129 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4956", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432be00e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025a0" } ], "repeated": 0, "id": 22130 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002594" } ], "repeated": 0, "id": 22131 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4956", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432be00e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002588" } ], "repeated": 0, "id": 22132 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4956", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432be00e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002584" } ], "repeated": 0, "id": 22133 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 22134 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 22135 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4956", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432be00e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002278" } ], "repeated": 0, "id": 22136 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000004c4" } ], "repeated": 0, "id": 22137 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xc0\\xecT\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00@\\xedT\\x03\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x83!,C\\xff\\x7f\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\x1b\\xc5\\x0b\\x00\\x00\\x00\\x00p\\xedT\\x03\\x00\\x00\\x00\\x00f@5X\\xff\\x7f\\x00\\x00\\xb5\n\\x059\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb5\n\\x059\\x00\\x00\\x00\\x00\\xc9\\x1f,C\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xff\\x7f\\x00\\x00" } ], "repeated": 0, "id": 22138 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x00002694" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 22139 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c4" } ], "repeated": 0, "id": 22140 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002594" } ], "repeated": 0, "id": 22141 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002694" } ], "repeated": 0, "id": 22142 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000232c" } ], "repeated": 0, "id": 22143 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002708" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 22144 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 22145 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000232c" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 22146 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xc0\\xeb\\xfc\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00@\\xec\\xfc\\x07\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x83!,C\\xff\\x7f\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10}\\xad\\x0c\\x00\\x00\\x00\\x00p\\xec\\xfc\\x07\\x00\\x00\\x00\\x00f@5X\\xff\\x7f\\x00\\x00g\n\\x05\\x11\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00g\n\\x05\\x11\\x00\\x00\\x00\\x00\\xc9\\x1f,C\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xff\\x7f\\x00\\x00" } ], "repeated": 0, "id": 22147 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002584" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 22148 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002580" } ], "repeated": 0, "id": 22149 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002708" } ], "repeated": 0, "id": 22150 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002584" } ], "repeated": 0, "id": 22151 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d14" } ], "repeated": 0, "id": 22152 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 22153 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d14" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 22154 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002318" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 22155 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000494" } ], "repeated": 0, "id": 22156 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xc0\\xe5\\x14\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x97\\x9c\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\x8dm\\x07\\x00\\x00\\x00\\x00\\x18\\xe6\\x14\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9d|}\\x1a\\xff\\x7f\\x00\\x00C\\x00:\\x00\\\\x00U\\x00s\\x00e\\x00r\\x00s\\x00\\\\x00a\\x00d\\x00m\\x00i\\x00n\\x00\\\\x00A\\x00p\\x00p\\x00D\\x00a\\x00t\\x00a\\x00\\\\x00L\\x00o\\x00c\\x00a\\x00l\\x00\\\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00\\\\x00W\\x00" } ], "repeated": 0, "id": 22157 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026f8" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 22158 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 22159 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002318" } ], "repeated": 0, "id": 22160 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4956", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432c3396", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022b0" } ], "repeated": 0, "id": 22161 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 22162 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 22163 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002694" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 22164 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002594" } ], "repeated": 0, "id": 22165 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xecT\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc7\\xb3\\xf7Y\\xff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00i} \\x0c\\xea[\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00(\\xefT\\x03\\x00\\x00\\x00\\x00\\x80ba\\x07\\x00\\x00\\x00\\x00@dm\\x07\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\xb5\n\\x059\\x00\\x00\\x00\\x00\\x80\\xedT\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 22166 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x000004c4" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 22167 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002594" } ], "repeated": 0, "id": 22168 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002694" } ], "repeated": 0, "id": 22169 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000232c" } ], "repeated": 0, "id": 22170 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002584" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 22171 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000232c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 22172 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xeb\\xfc\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc7\\xb3\\xf7Y\\xff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xff\\x7f\\x00\\x00i|\\x88\\x08\\xea[\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00(\\xee\\xfc\\x07\\x00\\x00\\x00\\x00\\x80ba\\x07\\x00\\x00\\x00\\x00 \\x98j\\x07\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00g\n\\x05\\x11\\x00\\x00\\x00\\x00\\x80\\xec\\xfc\\x07\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 22173 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x00002580" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 22174 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002708" } ], "repeated": 0, "id": 22175 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002584" } ], "repeated": 0, "id": 22176 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d14" } ], "repeated": 0, "id": 22177 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d14" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 22178 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026f8" } ], "repeated": 0, "id": 22179 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000026f8" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 22180 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002278" } ], "repeated": 0, "id": 22181 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "`\\xe6\\x14\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\\\x00E\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00c\\x00h\\x00e\\x00_\\x001\\x006\\x00.\\x00d\\x00b\\x00\\x00\\x00\\xa8\\xe6\\x14\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00,\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xe6\\x14\\x01\\x00\\x00\\x00\\x00\\x02\\x00P\\x00\\x01\\x00\\x00\\x00\\x00\\x00$\\x00\\x00\\x00\\x00\\x10\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec" } ], "repeated": 0, "id": 22182 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x00002168" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 22183 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002278" } ], "repeated": 0, "id": 22184 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4956", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff432c33a9", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0d400000" }, { "name": "RegionSize", "value": "0x0000f000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 22185 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4956", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432c3c47", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f80" } ], "repeated": 0, "id": 22186 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4956", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432c3c5c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002024" } ], "repeated": 0, "id": 22187 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4956", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432c3d86", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b8" } ], "repeated": 0, "id": 22188 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026f8" } ], "repeated": 0, "id": 22189 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002168" } ], "repeated": 0, "id": 22190 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 22191 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c4" } ], "repeated": 0, "id": 22192 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000004c4" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 22193 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002694" } ], "repeated": 0, "id": 22194 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xc0\\xecT\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00@\\xedT\\x03\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x83!,C\\xff\\x7f\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\x1b\\xc5\\x0b\\x00\\x00\\x00\\x00p\\xedT\\x03\\x00\\x00\\x00\\x00f@5X\\xff\\x7f\\x00\\x00\\xb5\n\\x059\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb5\n\\x059\\x00\\x00\\x00\\x00\\xc9\\x1f,C\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xff\\x7f\\x00\\x00" } ], "repeated": 0, "id": 22195 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x00002594" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 22196 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002694" } ], "repeated": 0, "id": 22197 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c4" } ], "repeated": 0, "id": 22198 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002594" } ], "repeated": 0, "id": 22199 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000232c" } ], "repeated": 0, "id": 22200 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4956", "caller": "0x7fff577ce76a", "parentcaller": "0x7fff584cea0e", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "oleaut32.dll" }, { "name": "ModuleHandle", "value": "0x7fff58860000" } ], "repeated": 0, "id": 22201 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002580" } ], "repeated": 0, "id": 22202 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 22203 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000232c" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 22204 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002708" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 22205 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002584" } ], "repeated": 0, "id": 22206 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4956", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "windows", "api": "PostThreadMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessId", "value": "4484" }, { "name": "ThreadId", "value": "4488" }, { "name": "Message", "value": "0" } ], "repeated": 0, "id": 22207 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002580" } ], "repeated": 0, "id": 22208 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4956", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5809da8f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002518" } ], "repeated": 0, "id": 22209 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000026ec" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\xf0\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xe3\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 22210 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002708" } ], "repeated": 0, "id": 22211 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d14" } ], "repeated": 0, "id": 22212 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 22213 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d14" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 22214 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002594" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 22215 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 22216 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 22217 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000004c4" } ], "repeated": 0, "id": 22218 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xecT\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc7\\xb3\\xf7Y\\xff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00i} \\x0c\\xea[\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00(\\xefT\\x03\\x00\\x00\\x00\\x00\\x80ba\\x07\\x00\\x00\\x00\\x00@dm\\x07\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\xb5\n\\x059\\x00\\x00\\x00\\x00\\x80\\xedT\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 22219 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002694" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 22220 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c4" } ], "repeated": 0, "id": 22221 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002594" } ], "repeated": 0, "id": 22222 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000232c" } ], "repeated": 0, "id": 22223 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002708" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 22224 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000232c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 22225 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002580" } ], "repeated": 0, "id": 22226 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xeb\\xfc\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc7\\xb3\\xf7Y\\xff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xff\\x7f\\x00\\x00i|\\x88\\x08\\xea[\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00(\\xee\\xfc\\x07\\x00\\x00\\x00\\x00\\x80ba\\x07\\x00\\x00\\x00\\x00 \\x98j\\x07\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00g\n\\x05\\x11\\x00\\x00\\x00\\x00\\x80\\xec\\xfc\\x07\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 22227 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x00002584" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 22228 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002580" } ], "repeated": 0, "id": 22229 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002708" } ], "repeated": 0, "id": 22230 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d14" } ], "repeated": 0, "id": 22231 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d14" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 22232 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000025d4" } ], "repeated": 0, "id": 22233 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xf0\\xe2\\x14\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00`\\xda\\xd9\\xff\\xff\\xff\\xff\\xffXCBK\\x07\\xef\\xdc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xda\\xd9\\xff\\xff\\xff\\xff\\xffH\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00<&\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 22234 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x00002700" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 22235 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025d4" } ], "repeated": 0, "id": 22236 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025b4" } ], "repeated": 0, "id": 22237 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 22238 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002694" } ], "repeated": 0, "id": 22239 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 22240 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002694" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 22241 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002518" } ], "repeated": 0, "id": 22242 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xc0\\xecT\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00@\\xedT\\x03\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x83!,C\\xff\\x7f\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\x1b\\xc5\\x0b\\x00\\x00\\x00\\x00p\\xedT\\x03\\x00\\x00\\x00\\x00f@5X\\xff\\x7f\\x00\\x00\\xb5\n\\x059\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb5\n\\x059\\x00\\x00\\x00\\x00\\xc9\\x1f,C\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xff\\x7f\\x00\\x00" } ], "repeated": 0, "id": 22243 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x000024b8" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 22244 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002518" } ], "repeated": 0, "id": 22245 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002694" } ], "repeated": 0, "id": 22246 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b8" } ], "repeated": 0, "id": 22247 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000232c" } ], "repeated": 0, "id": 22248 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 22249 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000232c" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 22250 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002584" } ], "repeated": 0, "id": 22251 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002584" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 22252 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002594" } ], "repeated": 0, "id": 22253 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xc0\\xeb\\xfc\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00@\\xec\\xfc\\x07\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x83!,C\\xff\\x7f\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10}\\xad\\x0c\\x00\\x00\\x00\\x00p\\xec\\xfc\\x07\\x00\\x00\\x00\\x00f@5X\\xff\\x7f\\x00\\x00g\n\\x05\\x11\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00g\n\\x05\\x11\\x00\\x00\\x00\\x00\\xc9\\x1f,C\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xff\\x7f\\x00\\x00" } ], "repeated": 0, "id": 22254 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x000004c4" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 22255 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002594" } ], "repeated": 0, "id": 22256 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002584" } ], "repeated": 0, "id": 22257 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c4" } ], "repeated": 0, "id": 22258 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d14" } ], "repeated": 0, "id": 22259 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 22260 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d14" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 22261 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002700" } ], "repeated": 0, "id": 22262 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002700" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 22263 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002168" } ], "repeated": 0, "id": 22264 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xf0\\xe2\\x14\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00'\\x00\\x00\\x00\\x00\\x00\\x00\\x00'\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x81|}\\x1a\\xff\\x7f\\x00\\x00(\\x8b}\\x1a\\xff\\x7f\\x00\\x00\\x00'\\x00\\x00\\x00\\x00\\x00\\x00\\x00'\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x85g}W\\xff\\x7f\\x00\\x00\\x00'\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 22265 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026f8" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 22266 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002168" } ], "repeated": 0, "id": 22267 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002700" } ], "repeated": 0, "id": 22268 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026f8" } ], "repeated": 0, "id": 22269 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 22270 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000004c4" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 22271 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002584" } ], "repeated": 0, "id": 22272 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 22273 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 22274 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xecT\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc7\\xb3\\xf7Y\\xff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00i} \\x0c\\xea[\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00(\\xefT\\x03\\x00\\x00\\x00\\x00\\x80ba\\x07\\x00\\x00\\x00\\x00@dm\\x07\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\xb5\n\\x059\\x00\\x00\\x00\\x00\\x80\\xedT\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 22275 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002594" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 22276 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002584" } ], "repeated": 0, "id": 22277 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c4" } ], "repeated": 0, "id": 22278 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000232c" } ], "repeated": 0, "id": 22279 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000232c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 22280 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002580" } ], "repeated": 0, "id": 22281 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xeb\\xfc\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc7\\xb3\\xf7Y\\xff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xff\\x7f\\x00\\x00i|\\x88\\x08\\xea[\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00(\\xee\\xfc\\x07\\x00\\x00\\x00\\x00\\x80ba\\x07\\x00\\x00\\x00\\x00 \\x98j\\x07\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00g\n\\x05\\x11\\x00\\x00\\x00\\x00\\x80\\xec\\xfc\\x07\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 22282 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x00002588" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 22283 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002580" } ], "repeated": 0, "id": 22284 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002708" } ], "repeated": 0, "id": 22285 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d14" } ], "repeated": 0, "id": 22286 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d14" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 22287 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000024b8" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 22288 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002694" } ], "repeated": 0, "id": 22289 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xf0\\xe2\\x14\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00`\\xda\\xd9\\xff\\xff\\xff\\xff\\xffXCBK\\x07\\xef\\xdc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xda\\xd9\\xff\\xff\\xff\\xff\\xffH\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 22290 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x00002518" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 22291 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002694" } ], "repeated": 0, "id": 22292 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b8" } ], "repeated": 0, "id": 22293 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 22294 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002594" } ], "repeated": 0, "id": 22295 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002594" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 22296 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000004c4" } ], "repeated": 0, "id": 22297 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xc0\\xecT\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00@\\xedT\\x03\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x83!,C\\xff\\x7f\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\x1b\\xc5\\x0b\\x00\\x00\\x00\\x00p\\xedT\\x03\\x00\\x00\\x00\\x00f@5X\\xff\\x7f\\x00\\x00\\xb5\n\\x059\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb5\n\\x059\\x00\\x00\\x00\\x00\\xc9\\x1f,C\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xff\\x7f\\x00\\x00" } ], "repeated": 0, "id": 22298 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x00002584" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 22299 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c4" } ], "repeated": 0, "id": 22300 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002594" } ], "repeated": 0, "id": 22301 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002584" } ], "repeated": 0, "id": 22302 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000232c" } ], "repeated": 0, "id": 22303 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002588" } ], "repeated": 0, "id": 22304 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 22305 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002588" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 22306 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002708" } ], "repeated": 0, "id": 22307 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xc0\\xeb\\xfc\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00@\\xec\\xfc\\x07\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x83!,C\\xff\\x7f\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10}\\xad\\x0c\\x00\\x00\\x00\\x00p\\xec\\xfc\\x07\\x00\\x00\\x00\\x00f@5X\\xff\\x7f\\x00\\x00g\n\\x05\\x11\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00g\n\\x05\\x11\\x00\\x00\\x00\\x00\\xc9\\x1f,C\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xff\\x7f\\x00\\x00" } ], "repeated": 0, "id": 22308 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x00002580" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 22309 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002708" } ], "repeated": 0, "id": 22310 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002588" } ], "repeated": 0, "id": 22311 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002580" } ], "repeated": 0, "id": 22312 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d14" } ], "repeated": 0, "id": 22313 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 22314 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d14" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 22315 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002518" } ], "repeated": 0, "id": 22316 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002518" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 22317 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000026f8" } ], "repeated": 0, "id": 22318 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xf0\\xe2\\x14\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x18%\\x00\\x00\\x00\\x00\\x00\\x00\\x18%\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x81|}\\x1a\\xff\\x7f\\x00\\x00(\\x8b}\\x1a\\xff\\x7f\\x00\\x00\\x18%\\x00\\x00\\x00\\x00\\x00\\x00\\x18%\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x85g}W\\xff\\x7f\\x00\\x00\\x18%\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 22319 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002700" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 22320 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026f8" } ], "repeated": 0, "id": 22321 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002518" } ], "repeated": 0, "id": 22322 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002700" } ], "repeated": 0, "id": 22323 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 22324 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002620" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 22325 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002584" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 22326 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002594" } ], "repeated": 0, "id": 22327 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xecT\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc7\\xb3\\xf7Y\\xff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00i} \\x0c\\xea[\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00(\\xefT\\x03\\x00\\x00\\x00\\x00\\x80ba\\x07\\x00\\x00\\x00\\x00@dm\\x07\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\xb5\n\\x059\\x00\\x00\\x00\\x00\\x80\\xedT\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 22328 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c4" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 22329 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002594" } ], "repeated": 0, "id": 22330 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002584" } ], "repeated": 0, "id": 22331 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000232c" } ], "repeated": 0, "id": 22332 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000232c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 22333 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002580" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 22334 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002588" } ], "repeated": 0, "id": 22335 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x00002708" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 22336 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002588" } ], "repeated": 0, "id": 22337 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002580" } ], "repeated": 0, "id": 22338 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d14" } ], "repeated": 0, "id": 22339 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d14" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 22340 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002700" }, { "name": "DesiredAccess", "value": "0xc0100080", "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_32.db" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 22341 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xc0\\xecT\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00@\\xedT\\x03\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x83!,C\\xff\\x7f\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\x1b\\xc5\\x0b\\x00\\x00\\x00\\x00p\\xedT\\x03\\x00\\x00\\x00\\x00f@5X\\xff\\x7f\\x00\\x00\\xb5\n\\x059\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb5\n\\x059\\x00\\x00\\x00\\x00\\xc9\\x1f,C\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xff\\x7f\\x00\\x00" } ], "repeated": 0, "id": 22342 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x00002594" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 22343 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002584" } ], "repeated": 0, "id": 22344 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c4" } ], "repeated": 0, "id": 22345 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002594" } ], "repeated": 0, "id": 22346 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000232c" } ], "repeated": 0, "id": 22347 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002708" } ], "repeated": 0, "id": 22348 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002708" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 22349 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 22350 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000232c" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 22351 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002580" } ], "repeated": 0, "id": 22352 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xc0\\xeb\\xfc\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00@\\xec\\xfc\\x07\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x83!,C\\xff\\x7f\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10}\\xad\\x0c\\x00\\x00\\x00\\x00p\\xec\\xfc\\x07\\x00\\x00\\x00\\x00f@5X\\xff\\x7f\\x00\\x00g\n\\x05\\x11\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00g\n\\x05\\x11\\x00\\x00\\x00\\x00\\xc9\\x1f,C\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xff\\x7f\\x00\\x00" } ], "repeated": 0, "id": 22353 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002588" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 22354 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002580" } ], "repeated": 0, "id": 22355 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002708" } ], "repeated": 0, "id": 22356 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002588" } ], "repeated": 0, "id": 22357 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d14" } ], "repeated": 0, "id": 22358 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 22359 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d14" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 22360 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002594" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 22361 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000004c4" } ], "repeated": 0, "id": 22362 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xecT\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc7\\xb3\\xf7Y\\xff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00i} \\x0c\\xea[\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00(\\xefT\\x03\\x00\\x00\\x00\\x00\\x80ba\\x07\\x00\\x00\\x00\\x00@dm\\x07\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\xb5\n\\x059\\x00\\x00\\x00\\x00\\x80\\xedT\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 22363 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002584" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 22364 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c4" } ], "repeated": 0, "id": 22365 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002594" } ], "repeated": 0, "id": 22366 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000232c" } ], "repeated": 0, "id": 22367 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000232c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 22368 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002588" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 22369 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002708" } ], "repeated": 0, "id": 22370 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xeb\\xfc\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc7\\xb3\\xf7Y\\xff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xff\\x7f\\x00\\x00i|\\x88\\x08\\xea[\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00(\\xee\\xfc\\x07\\x00\\x00\\x00\\x00\\x80ba\\x07\\x00\\x00\\x00\\x00 \\x98j\\x07\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00g\n\\x05\\x11\\x00\\x00\\x00\\x00\\x80\\xec\\xfc\\x07\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 22371 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002700" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_32.db" }, { "name": "FileInformationClass", "value": "74" }, { "name": "FileInformation", "value": "\\x02\\x00\\x00\\x00" } ], "repeated": 0, "id": 22372 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x00002580" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 22373 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002708" } ], "repeated": 0, "id": 22374 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002588" } ], "repeated": 0, "id": 22375 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d14" } ], "repeated": 0, "id": 22376 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d14" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 22377 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002584" } ], "repeated": 0, "id": 22378 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002584" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 22379 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002594" } ], "repeated": 0, "id": 22380 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xc0\\xecT\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00@\\xedT\\x03\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x83!,C\\xff\\x7f\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\x1b\\xc5\\x0b\\x00\\x00\\x00\\x00p\\xedT\\x03\\x00\\x00\\x00\\x00f@5X\\xff\\x7f\\x00\\x00\\xb5\n\\x059\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb5\n\\x059\\x00\\x00\\x00\\x00\\xc9\\x1f,C\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xff\\x7f\\x00\\x00" } ], "repeated": 0, "id": 22381 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x000004c4" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 22382 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002594" } ], "repeated": 0, "id": 22383 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002584" } ], "repeated": 0, "id": 22384 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c4" } ], "repeated": 0, "id": 22385 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000232c" } ], "repeated": 0, "id": 22386 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002580" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 22387 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 22388 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000232c" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 22389 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002588" } ], "repeated": 0, "id": 22390 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xc0\\xeb\\xfc\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00@\\xec\\xfc\\x07\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x83!,C\\xff\\x7f\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10}\\xad\\x0c\\x00\\x00\\x00\\x00p\\xec\\xfc\\x07\\x00\\x00\\x00\\x00f@5X\\xff\\x7f\\x00\\x00g\n\\x05\\x11\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00g\n\\x05\\x11\\x00\\x00\\x00\\x00\\xc9\\x1f,C\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xff\\x7f\\x00\\x00" } ], "repeated": 0, "id": 22391 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002700" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_32.db" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 22392 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002708" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 22393 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002588" } ], "repeated": 0, "id": 22394 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002580" } ], "repeated": 0, "id": 22395 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002708" } ], "repeated": 0, "id": 22396 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d14" } ], "repeated": 0, "id": 22397 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 22398 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d14" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 22399 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000024b8" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 22400 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002694" } ], "repeated": 0, "id": 22401 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xecT\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc7\\xb3\\xf7Y\\xff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00i} \\x0c\\xea[\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00(\\xefT\\x03\\x00\\x00\\x00\\x00\\x80ba\\x07\\x00\\x00\\x00\\x00@dm\\x07\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\xb5\n\\x059\\x00\\x00\\x00\\x00\\x80\\xedT\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 22402 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002024" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 22403 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002694" } ], "repeated": 0, "id": 22404 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b8" } ], "repeated": 0, "id": 22405 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000232c" } ], "repeated": 0, "id": 22406 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000232c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 22407 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000004c4" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 22408 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002584" } ], "repeated": 0, "id": 22409 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002518" }, { "name": "DesiredAccess", "value": "0x000f0007", "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_WRITE" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x00002700" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_32.db" } ], "repeated": 0, "id": 22410 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002024" } ], "repeated": 0, "id": 22411 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025d4" } ], "repeated": 0, "id": 22412 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000232c" } ], "repeated": 0, "id": 22413 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 22414 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000232c" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 22415 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002594" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 22416 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002708" } ], "repeated": 0, "id": 22417 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xc0\\xeb\\xfc\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00@\\xec\\xfc\\x07\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x83!,C\\xff\\x7f\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10}\\xad\\x0c\\x00\\x00\\x00\\x00p\\xec\\xfc\\x07\\x00\\x00\\x00\\x00f@5X\\xff\\x7f\\x00\\x00g\n\\x05\\x11\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00g\n\\x05\\x11\\x00\\x00\\x00\\x00\\xc9\\x1f,C\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xff\\x7f\\x00\\x00" } ], "repeated": 0, "id": 22418 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002580" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 22419 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002708" } ], "repeated": 0, "id": 22420 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002594" } ], "repeated": 0, "id": 22421 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002580" } ], "repeated": 0, "id": 22422 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d14" } ], "repeated": 0, "id": 22423 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 22424 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d14" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 22425 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002584" } ], "repeated": 0, "id": 22426 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xecT\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc7\\xb3\\xf7Y\\xff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00i} \\x0c\\xea[\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00(\\xefT\\x03\\x00\\x00\\x00\\x00\\x80ba\\x07\\x00\\x00\\x00\\x00@dm\\x07\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\xb5\n\\x059\\x00\\x00\\x00\\x00\\x80\\xedT\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 22427 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002584" } ], "repeated": 0, "id": 22428 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c4" } ], "repeated": 0, "id": 22429 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000232c" } ], "repeated": 0, "id": 22430 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000232c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 22431 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000024b8" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 22432 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002694" } ], "repeated": 0, "id": 22433 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xeb\\xfc\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc7\\xb3\\xf7Y\\xff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xff\\x7f\\x00\\x00i|\\x88\\x08\\xea[\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00(\\xee\\xfc\\x07\\x00\\x00\\x00\\x00\\x80ba\\x07\\x00\\x00\\x00\\x00 \\x98j\\x07\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00g\n\\x05\\x11\\x00\\x00\\x00\\x00\\x80\\xec\\xfc\\x07\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 22434 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x00000f80" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 22435 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b8" } ], "repeated": 0, "id": 22436 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d14" } ], "repeated": 0, "id": 22437 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d14" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 22438 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026a0" } ], "repeated": 0, "id": 22439 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000026a0" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 22440 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002580" } ], "repeated": 0, "id": 22441 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002700" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_32.db" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 22442 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xc0\\xecT\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00@\\xedT\\x03\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x83!,C\\xff\\x7f\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\x1b\\xc5\\x0b\\x00\\x00\\x00\\x00p\\xedT\\x03\\x00\\x00\\x00\\x00f@5X\\xff\\x7f\\x00\\x00\\xb5\n\\x059\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb5\n\\x059\\x00\\x00\\x00\\x00\\xc9\\x1f,C\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xff\\x7f\\x00\\x00" } ], "repeated": 0, "id": 22443 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x00002594" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 22444 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 22445 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 22446 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002580" } ], "repeated": 0, "id": 22447 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026a0" } ], "repeated": 0, "id": 22448 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002594" } ], "repeated": 0, "id": 22449 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000232c" } ], "repeated": 0, "id": 22450 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 22451 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000232c" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 22452 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f80" } ], "repeated": 0, "id": 22453 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000f80" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 22454 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000025d4" } ], "repeated": 0, "id": 22455 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xc0\\xeb\\xfc\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00@\\xec\\xfc\\x07\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x83!,C\\xff\\x7f\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10}\\xad\\x0c\\x00\\x00\\x00\\x00p\\xec\\xfc\\x07\\x00\\x00\\x00\\x00f@5X\\xff\\x7f\\x00\\x00g\n\\x05\\x11\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00g\n\\x05\\x11\\x00\\x00\\x00\\x00\\xc9\\x1f,C\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xff\\x7f\\x00\\x00" } ], "repeated": 0, "id": 22456 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002024" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 22457 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025d4" } ], "repeated": 0, "id": 22458 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f80" } ], "repeated": 0, "id": 22459 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002024" } ], "repeated": 0, "id": 22460 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d14" } ], "repeated": 0, "id": 22461 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 22462 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d14" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 22463 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000024b8" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 22464 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002694" } ], "repeated": 0, "id": 22465 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xf0\\xe3\\x14\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00`\\xda\\xd9\\xff\\xff\\xff\\xff\\xffXCBK\\x07\\xef\\xdc\\x01\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00`\\xda\\xd9\\xff\\xff\\xff\\xff\\xffH\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x91\\x8b\\x0c\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 22466 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022b0" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 22467 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002694" } ], "repeated": 0, "id": 22468 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b8" } ], "repeated": 0, "id": 22469 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 22470 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000026a0" } ], "repeated": 0, "id": 22471 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xecT\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc7\\xb3\\xf7Y\\xff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00i} \\x0c\\xea[\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00(\\xefT\\x03\\x00\\x00\\x00\\x00\\x80ba\\x07\\x00\\x00\\x00\\x00@dm\\x07\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\xb5\n\\x059\\x00\\x00\\x00\\x00\\x80\\xedT\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 22472 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 22473 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x00002580" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 22474 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026a0" } ], "repeated": 0, "id": 22475 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002594" } ], "repeated": 0, "id": 22476 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000232c" } ], "repeated": 0, "id": 22477 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000232c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 22478 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002024" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 22479 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000f80" } ], "repeated": 0, "id": 22480 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xeb\\xfc\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc7\\xb3\\xf7Y\\xff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xff\\x7f\\x00\\x00i|\\x88\\x08\\xea[\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00(\\xee\\xfc\\x07\\x00\\x00\\x00\\x00\\x80ba\\x07\\x00\\x00\\x00\\x00 \\x98j\\x07\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00g\n\\x05\\x11\\x00\\x00\\x00\\x00\\x80\\xec\\xfc\\x07\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 22481 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x000025d4" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 22482 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f80" } ], "repeated": 0, "id": 22483 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002024" } ], "repeated": 0, "id": 22484 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d14" } ], "repeated": 0, "id": 22485 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d14" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 22486 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b953e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022b0" } ], "repeated": 0, "id": 22487 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000022b0" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 22488 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000024b8" } ], "repeated": 0, "id": 22489 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x00\\xe4\\x14\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\x90\\xe4\\x14\\x01\\x00\\x00\\x00\\x00<&\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0fP\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9d|}\\x1a\\xff\\x7f\\x00\\x00(\\x8b}\\x1a\\xff\\x7f\\x00\\x00<&\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\xe6\\xa5\\x0c\\x00\\x00\\x00\\x00]\\xdd|W\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x91\\x8b\\x0c\\x00\\x00\\x00\\x00\\x89u`\\x0e\\xea[\\x00\\x00\\x88\\xe6\\xa5\\x0c\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 22490 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x00002694" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 22491 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b8" } ], "repeated": 0, "id": 22492 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022b0" } ], "repeated": 0, "id": 22493 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002694" } ], "repeated": 0, "id": 22494 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 22495 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002580" } ], "repeated": 0, "id": 22496 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002580" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 22497 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002024" } ], "repeated": 0, "id": 22498 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xc0\\xecT\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00@\\xedT\\x03\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x83!,C\\xff\\x7f\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\x1b\\xc5\\x0b\\x00\\x00\\x00\\x00p\\xedT\\x03\\x00\\x00\\x00\\x00f@5X\\xff\\x7f\\x00\\x00\\xb5\n\\x059\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb5\n\\x059\\x00\\x00\\x00\\x00\\xc9\\x1f,C\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xff\\x7f\\x00\\x00" } ], "repeated": 0, "id": 22499 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x00000f80" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 22500 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002518" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x13260000" }, { "name": "SectionOffset", "value": "0x0114e400" }, { "name": "ViewSize", "value": "0x00100000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 22501 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002024" } ], "repeated": 0, "id": 22502 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002580" } ], "repeated": 0, "id": 22503 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f80" } ], "repeated": 0, "id": 22504 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000232c" } ], "repeated": 0, "id": 22505 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025d4" } ], "repeated": 0, "id": 22506 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 22507 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000232c" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 22508 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000025d4" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 22509 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002594" } ], "repeated": 0, "id": 22510 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000020d4" } ], "repeated": 0, "id": 22511 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xc0\\xeb\\xfc\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00@\\xec\\xfc\\x07\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x83!,C\\xff\\x7f\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10}\\xad\\x0c\\x00\\x00\\x00\\x00p\\xec\\xfc\\x07\\x00\\x00\\x00\\x00f@5X\\xff\\x7f\\x00\\x00g\n\\x05\\x11\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00g\n\\x05\\x11\\x00\\x00\\x00\\x00\\xc9\\x1f,C\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xff\\x7f\\x00\\x00" } ], "repeated": 0, "id": 22512 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026a0" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 22513 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002594" } ], "repeated": 0, "id": 22514 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025d4" } ], "repeated": 0, "id": 22515 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026a0" } ], "repeated": 0, "id": 22516 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d14" } ], "repeated": 0, "id": 22517 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 22518 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d14" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 22519 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000026f8" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 22520 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002168" } ], "repeated": 0, "id": 22521 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xecT\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc7\\xb3\\xf7Y\\xff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00i} \\x0c\\xea[\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00(\\xefT\\x03\\x00\\x00\\x00\\x00\\x80ba\\x07\\x00\\x00\\x00\\x00@dm\\x07\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\xb5\n\\x059\\x00\\x00\\x00\\x00\\x80\\xedT\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 22522 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002278" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 22523 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002168" } ], "repeated": 0, "id": 22524 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026f8" } ], "repeated": 0, "id": 22525 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000232c" } ], "repeated": 0, "id": 22526 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000232c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 22527 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000026a0" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 22528 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000025d4" } ], "repeated": 0, "id": 22529 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xeb\\xfc\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc7\\xb3\\xf7Y\\xff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xff\\x7f\\x00\\x00i|\\x88\\x08\\xea[\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00(\\xee\\xfc\\x07\\x00\\x00\\x00\\x00\\x80ba\\x07\\x00\\x00\\x00\\x00 \\x98j\\x07\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00g\n\\x05\\x11\\x00\\x00\\x00\\x00\\x80\\xec\\xfc\\x07\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 22530 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x00002594" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 22531 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025d4" } ], "repeated": 0, "id": 22532 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026a0" } ], "repeated": 0, "id": 22533 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d14" } ], "repeated": 0, "id": 22534 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d14" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 22535 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002278" } ], "repeated": 0, "id": 22536 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002278" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 22537 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000f80" } ], "repeated": 0, "id": 22538 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xc0\\xecT\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00@\\xedT\\x03\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x83!,C\\xff\\x7f\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\x1b\\xc5\\x0b\\x00\\x00\\x00\\x00p\\xedT\\x03\\x00\\x00\\x00\\x00f@5X\\xff\\x7f\\x00\\x00\\xb5\n\\x059\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb5\n\\x059\\x00\\x00\\x00\\x00\\xc9\\x1f,C\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xff\\x7f\\x00\\x00" } ], "repeated": 0, "id": 22539 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x00002580" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 22540 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f80" } ], "repeated": 0, "id": 22541 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002278" } ], "repeated": 0, "id": 22542 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002580" } ], "repeated": 0, "id": 22543 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000232c" } ], "repeated": 0, "id": 22544 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002594" } ], "repeated": 0, "id": 22545 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002594" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 22546 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000026a0" } ], "repeated": 0, "id": 22547 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xc0\\xeb\\xfc\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00@\\xec\\xfc\\x07\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x83!,C\\xff\\x7f\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10}\\xad\\x0c\\x00\\x00\\x00\\x00p\\xec\\xfc\\x07\\x00\\x00\\x00\\x00f@5X\\xff\\x7f\\x00\\x00g\n\\x05\\x11\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00g\n\\x05\\x11\\x00\\x00\\x00\\x00\\xc9\\x1f,C\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xff\\x7f\\x00\\x00" } ], "repeated": 0, "id": 22548 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025d4" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 22549 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026a0" } ], "repeated": 0, "id": 22550 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002594" } ], "repeated": 0, "id": 22551 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025d4" } ], "repeated": 0, "id": 22552 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d14" } ], "repeated": 0, "id": 22553 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 22554 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d14" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 22555 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002278" } ], "repeated": 0, "id": 22556 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xecT\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc7\\xb3\\xf7Y\\xff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00i} \\x0c\\xea[\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00(\\xefT\\x03\\x00\\x00\\x00\\x00\\x80ba\\x07\\x00\\x00\\x00\\x00@dm\\x07\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\xb5\n\\x059\\x00\\x00\\x00\\x00\\x80\\xedT\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 22557 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f80" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 22558 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002278" } ], "repeated": 0, "id": 22559 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002580" } ], "repeated": 0, "id": 22560 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000232c" } ], "repeated": 0, "id": 22561 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000232c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 22562 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000025d4" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 22563 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002594" } ], "repeated": 0, "id": 22564 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xeb\\xfc\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc7\\xb3\\xf7Y\\xff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xff\\x7f\\x00\\x00i|\\x88\\x08\\xea[\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00(\\xee\\xfc\\x07\\x00\\x00\\x00\\x00\\x80ba\\x07\\x00\\x00\\x00\\x00 \\x98j\\x07\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00g\n\\x05\\x11\\x00\\x00\\x00\\x00\\x80\\xec\\xfc\\x07\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 22565 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x000026a0" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 22566 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002594" } ], "repeated": 0, "id": 22567 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025d4" } ], "repeated": 0, "id": 22568 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d14" } ], "repeated": 0, "id": 22569 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d14" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 22570 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f80" } ], "repeated": 0, "id": 22571 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000f80" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 22572 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002580" } ], "repeated": 0, "id": 22573 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xc0\\xecT\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00@\\xedT\\x03\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x83!,C\\xff\\x7f\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\x1b\\xc5\\x0b\\x00\\x00\\x00\\x00p\\xedT\\x03\\x00\\x00\\x00\\x00f@5X\\xff\\x7f\\x00\\x00\\xb5\n\\x059\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb5\n\\x059\\x00\\x00\\x00\\x00\\xc9\\x1f,C\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xff\\x7f\\x00\\x00" } ], "repeated": 0, "id": 22574 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x00002278" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 22575 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002580" } ], "repeated": 0, "id": 22576 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f80" } ], "repeated": 0, "id": 22577 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002278" } ], "repeated": 0, "id": 22578 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000232c" } ], "repeated": 0, "id": 22579 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026a0" } ], "repeated": 0, "id": 22580 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000026a0" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 22581 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000025d4" } ], "repeated": 0, "id": 22582 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xc0\\xeb\\xfc\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00@\\xec\\xfc\\x07\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x83!,C\\xff\\x7f\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10}\\xad\\x0c\\x00\\x00\\x00\\x00p\\xec\\xfc\\x07\\x00\\x00\\x00\\x00f@5X\\xff\\x7f\\x00\\x00g\n\\x05\\x11\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00g\n\\x05\\x11\\x00\\x00\\x00\\x00\\xc9\\x1f,C\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xff\\x7f\\x00\\x00" } ], "repeated": 0, "id": 22583 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002594" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 22584 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025d4" } ], "repeated": 0, "id": 22585 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026a0" } ], "repeated": 0, "id": 22586 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002594" } ], "repeated": 0, "id": 22587 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d14" } ], "repeated": 0, "id": 22588 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff5780d897", "parentcaller": "0x7fff432b949c", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002288" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\xf0\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xe3\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 22589 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bc5ce", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 22590 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bc5ce", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000232c" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 22591 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bc79b", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002278" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 22592 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bc7fe", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xe9T\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00`\\xda\\xd9\\xff\\xff\\xff\\xff\\xffXCBK\\x07\\xef\\xdc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xda\\xd9\\xff\\xff\\xff\\xff\\xffH\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00,#\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 22593 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bc8d0", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002580" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 22594 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8e4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f80" } ], "repeated": 0, "id": 22595 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002278" } ], "repeated": 0, "id": 22596 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bc61a", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000232c" } ], "repeated": 0, "id": 22597 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bc669", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000232c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 22598 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc691", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002580" } ], "repeated": 0, "id": 22599 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bc79b", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002580" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 22600 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bc7ca", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002278" } ], "repeated": 0, "id": 22601 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bc7fe", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xe9T\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x80%\\x00\\x00\\x00\\x00\\x00\\x00\\x80%\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x81|}\\x1a\\xff\\x7f\\x00\\x00(\\x8b}\\x1a\\xff\\x7f\\x00\\x00\\x80%\\x00\\x00\\x00\\x00\\x00\\x00\\x80%\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x85g}W\\xff\\x7f\\x00\\x00\\x80%\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 22602 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff5780d897", "parentcaller": "0x7fff432b949c", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000d0c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\xf0\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xe3\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 22603 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bc8d0", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f80" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 22604 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8e4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002278" } ], "repeated": 0, "id": 22605 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002580" } ], "repeated": 0, "id": 22606 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc6d4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f80" } ], "repeated": 0, "id": 22607 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bc5ce", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 22608 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bc5ce", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d14" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 22609 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bc6f9", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000232c" } ], "repeated": 0, "id": 22610 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bc79b", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002594" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 22611 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bc7ca", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000026a0" } ], "repeated": 0, "id": 22612 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bc7fe", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xe8\\xfc\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00`\\xda\\xd9\\xff\\xff\\xff\\xff\\xffXCBK\\x07\\xef\\xdc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xda\\xd9\\xff\\xff\\xff\\xff\\xffH\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\r\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 22613 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bc8d0", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025d4" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 22614 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8e4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026a0" } ], "repeated": 0, "id": 22615 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002594" } ], "repeated": 0, "id": 22616 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bc61a", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d14" } ], "repeated": 0, "id": 22617 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bc669", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d14" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 22618 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc691", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025d4" } ], "repeated": 0, "id": 22619 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bc79b", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000025d4" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 22620 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bc7ca", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002594" } ], "repeated": 0, "id": 22621 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bc7fe", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xe8\\xfc\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\xd4%\\x00\\x00\\x00\\x00\\x00\\x00\\xd4%\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x81|}\\x1a\\xff\\x7f\\x00\\x00(\\x8b}\\x1a\\xff\\x7f\\x00\\x00\\xd4%\\x00\\x00\\x00\\x00\\x00\\x00\\xd4%\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x85g}W\\xff\\x7f\\x00\\x00\\xd4%\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 22622 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bc8d0", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026a0" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 22623 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8e4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002594" } ], "repeated": 0, "id": 22624 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff432c4639", "parentcaller": "0x7fff432c45ca", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "317D06E8-5F24-433D-BDF7-79CE68D8ABC2" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EC5EC8A9-C395-4314-9C77-54D7A935FF70" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 22625 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025d4" } ], "repeated": 0, "id": 22626 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc6d4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026a0" } ], "repeated": 0, "id": 22627 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bc6f9", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d14" } ], "repeated": 0, "id": 22628 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432c08f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000233c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 22629 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff432c4639", "parentcaller": "0x7fff432c45ca", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "317D06E8-5F24-433D-BDF7-79CE68D8ABC2" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EC5EC8A9-C395-4314-9C77-54D7A935FF70" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 22630 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432c08f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d24" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 22631 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff5780d897", "parentcaller": "0x7fff432c0a96", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002280" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_48.db" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 22632 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bbc69", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000232c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 22633 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bc79b", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000f80" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 22634 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bc7ca", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002580" } ], "repeated": 0, "id": 22635 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bc7fe", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x90\\xeaT\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xf7\\x8b\\x10\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\"\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 22636 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bc8d0", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002278" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 22637 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8e4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002580" } ], "repeated": 0, "id": 22638 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f80" } ], "repeated": 0, "id": 22639 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bbccd", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002278" } ], "repeated": 0, "id": 22640 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002620" } ], "repeated": 0, "id": 22641 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 22642 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff5780d897", "parentcaller": "0x7fff432bd729", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002288" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\xf0\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xe3\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 22643 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432b9392", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000232c" } ], "repeated": 0, "id": 22644 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000026f8" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 22645 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002168" } ], "repeated": 0, "id": 22646 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xe7\\x14\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xedi\\x07\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 22647 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002160" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 22648 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff5780d897", "parentcaller": "0x7fff432c3b2c", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002280" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_48.db" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 22649 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002168" } ], "repeated": 0, "id": 22650 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026f8" } ], "repeated": 0, "id": 22651 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 22652 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff5780d897", "parentcaller": "0x7fff432c3b51", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002280" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_48.db" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 22653 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432c0a05", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000233c" } ], "repeated": 0, "id": 22654 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bc79b", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002278" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 22655 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bc7ca", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000f80" } ], "repeated": 0, "id": 22656 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bc7fe", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "`\\xedT\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x98\\xeeT\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00C\\x10,C\\xff\\x7f\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb8\\xac,C\\xff\\x7f\\x00\\x00\\xd0\\x1b\\xc5\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00(\\xefT\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\xd0\\x1b\\xc5\\x0b\\x00\\x00\\x00\\x00\\xe7\\xab,C\\xff\\x7f\\x00\\x00\\xd0\\x1b\\xc5\\x0b\\x00\\x00\\x00\\x00Y{ \\x0c\\xea[\\x00\\x00" } ], "repeated": 0, "id": 22657 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bc8d0", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002580" }, { "name": "MutexName", "value": "" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 22658 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002278" } ], "repeated": 0, "id": 22659 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b9845", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002580" } ], "repeated": 0, "id": 22660 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff558b2b5a", "parentcaller": "0x7fff558658f2", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001011c" }, { "name": "Message", "value": "0x000004b5" } ], "repeated": 0, "id": 22661 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff5780d897", "parentcaller": "0x7fff432c0a96", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000d74" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_48.db" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 22662 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000026ec" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\xf0\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xe3\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 22663 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bbc69", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d14" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 22664 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff5587d014", "parentcaller": "0x7fff558252c1", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "CLSID\\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\\Instance" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\CLSID\\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\\Instance" } ], "repeated": 0, "id": 22665 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bc7fe", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x90\\xe9\\xfc\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xf7\\x8b\\x10\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00t\r\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 22666 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 22667 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bc8d0", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x00002594" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 22668 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 22669 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff58be0000", "arguments": [ { "name": "lpLibFileName", "value": "shell32.dll" }, { "name": "dwFlags", "value": "0x00004000" } ], "repeated": 0, "id": 22670 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8e4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025d4" } ], "repeated": 0, "id": 22671 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577dac31", "parentcaller": "0x7fff558258ff", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "SHELL32.dll" }, { "name": "ModuleHandle", "value": "0x7fff58be0000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff58c378f0" } ], "repeated": 0, "id": 22672 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026a0" } ], "repeated": 0, "id": 22673 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bbccd", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002594" } ], "repeated": 0, "id": 22674 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bbd11", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d14" } ], "repeated": 0, "id": 22675 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff58c37b42", "parentcaller": "0x7fff5582592e", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "CLSID\\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\\Instance" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\CLSID\\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\\Instance" } ], "repeated": 0, "id": 22676 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432c182f", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 22677 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432c182f", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d18" }, { "name": "Milliseconds", "value": "5000" } ], "repeated": 0, "id": 22678 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002160" } ], "repeated": 0, "id": 22679 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff558635fc", "parentcaller": "0x7fff55825399", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002580" } ], "repeated": 0, "id": 22680 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff558636a1", "parentcaller": "0x7fff55825399", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "20" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 22681 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff558636e3", "parentcaller": "0x7fff55825399", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002580" } ], "repeated": 0, "id": 22682 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002160" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 22683 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff558638e8", "parentcaller": "0x7fff55825399", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Classes\\CLSID\\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\\InProcServer32" }, { "name": "Handle", "value": "0x00002580" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\\InProcServer32" } ], "repeated": 0, "id": 22684 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000026f8" } ], "repeated": 0, "id": 22685 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "0\\xe7\\x14\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9d|}\\x1a\\xff\\x7f\\x00\\x00(\\x8b}\\x1a\\xff\\x7f\\x00\\x00<&\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\xe6\\xa5\\x0c\\x00\\x00\\x00\\x00]\\xdd|W\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xedi\\x07\\x00\\x00\\x00\\x00\\xd9p`\\x0e\\xea[\\x00\\x00\\x88\\xe6\\xa5\\x0c\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 22686 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002580" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "C:\\Windows\\System32\\ieframe.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 22687 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002580" }, { "name": "ValueName", "value": "LoadWithoutCOM" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\\InProcServer32\\LoadWithoutCOM" } ], "repeated": 0, "id": 22688 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002168" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 22689 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff5586397c", "parentcaller": "0x7fff55825399", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002580" } ], "repeated": 0, "id": 22690 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026f8" } ], "repeated": 0, "id": 22691 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff55825882", "parentcaller": "0x7fff558495d3", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "FBF23B40-E3F0-101B-8488-00AA003E56F8" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "000214FA-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "InternetShortcut" } ], "repeated": 0, "id": 22692 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002160" } ], "repeated": 0, "id": 22693 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff5808b3e7", "parentcaller": "0x7fff558258a5", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ShellCompatibility\\Objects\\{FBF23B40-E3F0-101B-8488-00AA003E56F8}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ShellCompatibility\\Objects\\{FBF23B40-E3F0-101B-8488-00AA003E56F8}" } ], "repeated": 0, "id": 22694 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002168" } ], "repeated": 0, "id": 22695 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff55848063", "parentcaller": "0x7fff55848ae6", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" }, { "name": "Handle", "value": "0x00002580" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" } ], "repeated": 0, "id": 22696 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 22697 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff558480b3", "parentcaller": "0x7fff55848ae6", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002580" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 22698 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff558480df", "parentcaller": "0x7fff55848ae6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002580" } ], "repeated": 0, "id": 22699 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af4" } ], "repeated": 0, "id": 22700 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577ced78", "parentcaller": "0x7fff413787e8", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002580" }, { "name": "MutexName", "value": "Local\\InternetShortcutMutex" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 22701 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 22702 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff41378810", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 22703 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff41378810", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002580" }, { "name": "Milliseconds", "value": "10000" } ], "repeated": 0, "id": 22704 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002168" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 22705 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002160" } ], "repeated": 0, "id": 22706 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xf0\\xe8\\x14\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\xab/C\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 22707 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026f8" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 22708 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002160" } ], "repeated": 0, "id": 22709 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002168" } ], "repeated": 0, "id": 22710 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 22711 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff41396d8c", "parentcaller": "0x7fff41281ead", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "942BC614-676C-464E-B384-D3202AAA02DA" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000000-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 22712 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000026ec" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\xf0\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xe3\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 22713 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff41396d8c", "parentcaller": "0x7fff41378e23", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "06EEE834-461C-42C2-8DCF-1502B527B1F9" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "0000010B-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 22714 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 22715 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026f8" } ], "repeated": 0, "id": 22716 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000026f8" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 22717 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002168" } ], "repeated": 0, "id": 22718 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff41761431", "parentcaller": "0x7fff4141a7ca", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 22719 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x00\\xe9\\x14\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9d|}\\x1a\\xff\\x7f\\x00\\x00(\\x8b}\\x1a\\xff\\x7f\\x00\\x00<&\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\xe6\\xa5\\x0c\\x00\\x00\\x00\\x00]\\xdd|W\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x89~`\\x0e\\xea[\\x00\\x00\\x88\\xe6\\xa5\\x0c\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 22720 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff413788ef", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002580" } ], "repeated": 0, "id": 22721 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff4137890a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002580" } ], "repeated": 0, "id": 22722 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002160" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 22723 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026f8" } ], "repeated": 0, "id": 22724 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff41354f82", "parentcaller": "0x7fff41354da0", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000025b6" }, { "name": "SubKey", "value": "{5CBF2787-48CF-4208-B90E-EE5E5D420294}" }, { "name": "Handle", "value": "0x00002582" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\\Instance\\PropertySetStorage\\{5CBF2787-48CF-4208-B90E-EE5E5D420294}" } ], "repeated": 0, "id": 22725 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002160" } ], "repeated": 0, "id": 22726 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 22727 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Discord\\app.ico" } ], "repeated": 0, "id": 22728 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff41355e24", "parentcaller": "0x7fff41355d74", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f82" }, { "name": "ValueName", "value": "Key" }, { "name": "Data", "value": "URL" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\\Instance\\PropertySetStorage\\{5CBF2787-48CF-4208-B90E-EE5E5D420294}\\2\\Key" } ], "repeated": 0, "id": 22729 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff41355daf", "parentcaller": "0x7fff41355c77", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000f82" }, { "name": "ValueName", "value": "VarType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\\Instance\\PropertySetStorage\\{5CBF2787-48CF-4208-B90E-EE5E5D420294}\\2\\VarType" } ], "repeated": 0, "id": 22730 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff41355dd0", "parentcaller": "0x7fff41355c77", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f82" } ], "repeated": 0, "id": 22731 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff41354ea3", "parentcaller": "0x7fff41354e44", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002582" } ], "repeated": 0, "id": 22732 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff48bc1d86", "parentcaller": "0x7fff48bbfe51", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 3, "id": 22733 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "LoadLibraryExW", "status": false, "return": "0x00000000", "arguments": [ { "name": "lpLibFileName", "value": "c:\\users\\admin\\appdata\\local\\discord\\app.ico" }, { "name": "dwFlags", "value": "0x00000022" } ], "repeated": 0, "id": 22734 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff41354f82", "parentcaller": "0x7fff41354da0", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000025b6" }, { "name": "SubKey", "value": "{000214A0-0000-0000-C000-000000000046}" }, { "name": "Handle", "value": "0x00002582" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\\Instance\\PropertySetStorage\\{000214A0-0000-0000-C000-000000000046}" } ], "repeated": 0, "id": 22735 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff41355d10", "parentcaller": "0x7fff41355c77", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002582" }, { "name": "SubKey", "value": "8" }, { "name": "Handle", "value": "0x00000f82" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\\Instance\\PropertySetStorage\\{000214A0-0000-0000-C000-000000000046}\\8" } ], "repeated": 0, "id": 22736 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff41355e24", "parentcaller": "0x7fff41355d40", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000f82" }, { "name": "ValueName", "value": "Section" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\\Instance\\PropertySetStorage\\{000214A0-0000-0000-C000-000000000046}\\8\\Section" } ], "repeated": 0, "id": 22737 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff41355e24", "parentcaller": "0x7fff41355d56", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002582" }, { "name": "ValueName", "value": "Section" }, { "name": "Data", "value": "InternetShortcut" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\\Instance\\PropertySetStorage\\{000214A0-0000-0000-C000-000000000046}\\Section" } ], "repeated": 0, "id": 22738 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002160" }, { "name": "DesiredAccess", "value": "0x80100180", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|FILE_WRITE_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Discord\\app.ico" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 22739 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff41354f82", "parentcaller": "0x7fff41354da0", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000025b6" }, { "name": "SubKey", "value": "{000214A0-0000-0000-C000-000000000046}" }, { "name": "Handle", "value": "0x00002582" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\\Instance\\PropertySetStorage\\{000214A0-0000-0000-C000-000000000046}" } ], "repeated": 0, "id": 22740 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff41355d10", "parentcaller": "0x7fff41355c77", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002582" }, { "name": "SubKey", "value": "15" }, { "name": "Handle", "value": "0x00000f82" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\\Instance\\PropertySetStorage\\{000214A0-0000-0000-C000-000000000046}\\15" } ], "repeated": 0, "id": 22741 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000f82" }, { "name": "ValueName", "value": "Section" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\\Instance\\PropertySetStorage\\{000214A0-0000-0000-C000-000000000046}\\15\\Section" } ], "repeated": 0, "id": 22742 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff41355e24", "parentcaller": "0x7fff41355d56", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002582" }, { "name": "ValueName", "value": "Section" }, { "name": "Data", "value": "InternetShortcut" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\\Instance\\PropertySetStorage\\{000214A0-0000-0000-C000-000000000046}\\Section" } ], "repeated": 0, "id": 22743 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff41355e24", "parentcaller": "0x7fff41355d74", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f82" }, { "name": "ValueName", "value": "Key" }, { "name": "Data", "value": "Roamed" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\\Instance\\PropertySetStorage\\{000214A0-0000-0000-C000-000000000046}\\15\\Key" } ], "repeated": 0, "id": 22744 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000d0c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\xf0\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xe3\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 22745 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432b9392", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d14" } ], "repeated": 0, "id": 22746 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff41355daf", "parentcaller": "0x7fff41355c77", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f82" }, { "name": "ValueName", "value": "VarType" }, { "name": "Data", "value": "11" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\\Instance\\PropertySetStorage\\{000214A0-0000-0000-C000-000000000046}\\15\\VarType" } ], "repeated": 0, "id": 22747 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff41355dd0", "parentcaller": "0x7fff41355c77", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f82" } ], "repeated": 0, "id": 22748 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff41354ea3", "parentcaller": "0x7fff41354e44", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002582" } ], "repeated": 0, "id": 22749 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff48bc1d86", "parentcaller": "0x7fff48bbfe51", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 22750 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000025b6" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\\Instance\\PropertySetStorage" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 22751 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000025b6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 22752 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xb4T\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\xb6%\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\xb5T\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 22753 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\\Instance\\PropertySetStorage\\{000214A0-0000-0000-C000-000000000046}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\\Instance\\PropertySetStorage\\{000214A0-0000-0000-C000-000000000046}" } ], "repeated": 0, "id": 22754 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002160" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Discord\\app.ico" }, { "name": "FileInformationClass", "value": "4", "pretty_value": "FileBasicInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 22755 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000025b6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 22756 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002580" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000025b6" }, { "name": "ObjectAttributesName", "value": "{000214A0-0000-0000-C000-000000000046}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\\Instance\\PropertySetStorage\\{000214A0-0000-0000-C000-000000000046}" } ], "repeated": 0, "id": 22757 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002160" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Discord\\app.ico" }, { "name": "Buffer", "value": "\\x00\\x00\\x01\\x00\\x04\\x00\\x10\\x10\\x00\\x00\\x01\\x00" }, { "name": "Length", "value": "12" } ], "repeated": 0, "id": 22758 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7fff59f6a28d", "parentcaller": "0x7fff59f69d71", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Discord\\app.ico" } ], "repeated": 0, "id": 22759 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bc79b", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000025d4" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 22760 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 22761 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bc7ca", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002594" } ], "repeated": 0, "id": 22762 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bc7fe", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "`\\xec\\xfc\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x98\\xed\\xfc\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00C\\x10,C\\xff\\x7f\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb8\\xac,C\\xff\\x7f\\x00\\x00\\x10}\\xad\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00(\\xee\\xfc\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x10}\\xad\\x0c\\x00\\x00\\x00\\x00\\xe7\\xab,C\\xff\\x7f\\x00\\x00\\x10}\\xad\\x0c\\x00\\x00\\x00\\x00Yz\\x88\\x08\\xea[\\x00\\x00" } ], "repeated": 0, "id": 22763 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff41355e24", "parentcaller": "0x7fff41355d74", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f82" }, { "name": "ValueName", "value": "Key" }, { "name": "Data", "value": "URL" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\\Instance\\PropertySetStorage\\{000214A0-0000-0000-C000-000000000046}\\2\\Key" } ], "repeated": 0, "id": 22764 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bc8d0", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026a0" }, { "name": "MutexName", "value": "" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 22765 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 22766 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "2440", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 22767 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8e4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002594" } ], "repeated": 0, "id": 22768 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025d4" } ], "repeated": 0, "id": 22769 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b9845", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026a0" } ], "repeated": 0, "id": 22770 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ThumbnailCache" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ThumbnailCache" } ], "repeated": 0, "id": 22771 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff41355daf", "parentcaller": "0x7fff41355c77", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000f82" }, { "name": "ValueName", "value": "VarType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\\Instance\\PropertySetStorage\\{000214A0-0000-0000-C000-000000000046}\\2\\VarType" } ], "repeated": 0, "id": 22772 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff41355dd0", "parentcaller": "0x7fff41355c77", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f82" } ], "repeated": 0, "id": 22773 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff41354ea3", "parentcaller": "0x7fff41354e44", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002582" } ], "repeated": 0, "id": 22774 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "4840", "caller": "0x7fff577d6785", "parentcaller": "0x7fff557c403a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025dc" } ], "repeated": 0, "id": 22775 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff48bc1d86", "parentcaller": "0x7fff48bbfe51", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 22776 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000026f8" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Discord\\app.ico" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 22777 }, { "timestamp": "2026-05-29 01:05:52,071", "thread_id": "5096", "caller": "0x7fff577d07f5", "parentcaller": "0x7fff577cc03b", "category": "filesystem", "api": "NtQueryAttributesFile", "status": false, "return": "0xffffffffc000003a", "pretty_return": "OBJECT_PATH_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Internet Explorer\\pin-5035124850\\rawicon.png" } ], "repeated": 0, "id": 22778 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "5096", "caller": "0x7fff41354f82", "parentcaller": "0x7fff41354da0", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000025b6" }, { "name": "SubKey", "value": "{000214A0-0000-0000-C000-000000000046}" }, { "name": "Handle", "value": "0x00002582" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\\Instance\\PropertySetStorage\\{000214A0-0000-0000-C000-000000000046}" } ], "repeated": 0, "id": 22779 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000026f8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Discord\\app.ico" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00`\\x04\\x00\\x00\\x00\\x00\\x00&[\\x04\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 22780 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "5096", "caller": "0x7fff41355d10", "parentcaller": "0x7fff41355c77", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00002582" }, { "name": "SubKey", "value": "3" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\\Instance\\PropertySetStorage\\{000214A0-0000-0000-C000-000000000046}\\3" } ], "repeated": 0, "id": 22781 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "5096", "caller": "0x7fff41354ea3", "parentcaller": "0x7fff41354e44", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002582" } ], "repeated": 0, "id": 22782 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "5096", "caller": "0x7fff5781026b", "parentcaller": "0x7fff5585204d", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002580" } ], "repeated": 0, "id": 22783 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "5096", "caller": "0x7fff558520a2", "parentcaller": "0x7fff55851f69", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "18" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 22784 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "5096", "caller": "0x7fff55852301", "parentcaller": "0x7fff55851f69", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "20" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 22785 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5585211d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002580" } ], "repeated": 0, "id": 22786 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "5096", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff5588fa25", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 22787 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "5096", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff5588fa84", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " T\\xc3\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00" } ], "repeated": 0, "id": 22788 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "5096", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 22789 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x10050000" }, { "name": "RegionSize", "value": "0x00046000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 22790 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "5096", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 22791 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002168" } ], "repeated": 0, "id": 22792 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "5096", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Extensions\\windows.protocol\\https" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Extensions\\windows.protocol\\https" } ], "repeated": 0, "id": 22793 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026f8" } ], "repeated": 0, "id": 22794 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "5096", "caller": "0x7fff58081596", "parentcaller": "0x7fff58ac668d", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "https" }, { "name": "Handle", "value": "0x00002582" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\https" } ], "repeated": 0, "id": 22795 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\default\\DataProtection\\EDPShowIcons" }, { "name": "Handle", "value": "0x00002160" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\DataProtection\\EDPShowIcons" } ], "repeated": 0, "id": 22796 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "5096", "caller": "0x7fff58081596", "parentcaller": "0x7fff58ac668d", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\Shell\\Associations\\UrlAssociations\\https" }, { "name": "Handle", "value": "0x00002024" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Shell\\Associations\\UrlAssociations\\https" } ], "repeated": 0, "id": 22797 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002160" }, { "name": "ValueName", "value": "PolicyType" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\DataProtection\\EDPShowIcons\\PolicyType" } ], "repeated": 0, "id": 22798 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "5096", "caller": "0x7fff5808ad48", "parentcaller": "0x7fff55854f0b", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002024" }, { "name": "SubKey", "value": "UserChoice" }, { "name": "Handle", "value": "0x00002704" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\Shell\\Associations\\UrlAssociations\\https\\UserChoice" } ], "repeated": 0, "id": 22799 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002160" }, { "name": "ValueName", "value": "Behavior" }, { "name": "Data", "value": "298" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\DataProtection\\EDPShowIcons\\Behavior" } ], "repeated": 0, "id": 22800 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "5096", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808ad83", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002704" }, { "name": "ValueName", "value": "ProgId" }, { "name": "Data", "value": "ChromeHTML" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\Shell\\Associations\\UrlAssociations\\https\\UserChoice\\ProgId" } ], "repeated": 0, "id": 22801 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "5096", "caller": "0x7fff5808ad91", "parentcaller": "0x7fff55854f0b", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002704" } ], "repeated": 0, "id": 22802 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002160" }, { "name": "ValueName", "value": "MergeAlgorithm" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\DataProtection\\EDPShowIcons\\MergeAlgorithm" } ], "repeated": 0, "id": 22803 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "5096", "caller": "0x7fff5808ad48", "parentcaller": "0x7fff55854f4c", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002024" }, { "name": "SubKey", "value": "UserChoice" }, { "name": "Handle", "value": "0x00002704" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\Shell\\Associations\\UrlAssociations\\https\\UserChoice" } ], "repeated": 0, "id": 22804 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002160" }, { "name": "ValueName", "value": "RegKeyPathRedirectMapped" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\DataProtection\\EDPShowIcons\\RegKeyPathRedirectMapped" } ], "repeated": 0, "id": 22805 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "5096", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808ad83", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002704" }, { "name": "ValueName", "value": "Hash" }, { "name": "Data", "value": "280v3B/15so=" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\Shell\\Associations\\UrlAssociations\\https\\UserChoice\\Hash" } ], "repeated": 0, "id": 22806 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "5096", "caller": "0x7fff5808ad91", "parentcaller": "0x7fff55854f4c", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002704" } ], "repeated": 0, "id": 22807 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002160" }, { "name": "ValueName", "value": "RegKeyPathRedirect" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\DataProtection\\EDPShowIcons\\RegKeyPathRedirect" } ], "repeated": 0, "id": 22808 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "5096", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002704" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00002024" }, { "name": "ObjectAttributesName", "value": "" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\Shell\\Associations\\UrlAssociations\\https\\" } ], "repeated": 0, "id": 22809 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002160" }, { "name": "ValueName", "value": "grouppolicyname" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\DataProtection\\EDPShowIcons\\grouppolicyname" } ], "repeated": 0, "id": 22810 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "5096", "caller": "0x7fff55856271", "parentcaller": "0x7fff55854fd0", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002704" }, { "name": "SubKey", "value": "UserChoice" }, { "name": "Handle", "value": "0x00002398" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\Shell\\Associations\\UrlAssociations\\https\\UserChoice" } ], "repeated": 0, "id": 22811 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002160" }, { "name": "ValueName", "value": "ADMXMetadataUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\DataProtection\\EDPShowIcons\\ADMXMetadataUser" } ], "repeated": 0, "id": 22812 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "5096", "caller": "0x7fff5585631b", "parentcaller": "0x7fff55854fd0", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002398" } ], "repeated": 0, "id": 22813 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "5096", "caller": "0x7fff5781026b", "parentcaller": "0x7fff55856caa", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002398" } ], "repeated": 0, "id": 22814 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002160" }, { "name": "ValueName", "value": "ADMXMetadataDevice" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\DataProtection\\EDPShowIcons\\ADMXMetadataDevice" } ], "repeated": 0, "id": 22815 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "5096", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff55856bfb", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x10\\xe7\\xa4\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 22816 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002160" }, { "name": "ValueName", "value": "ADMXMetadataBoth" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\DataProtection\\EDPShowIcons\\ADMXMetadataBoth" } ], "repeated": 0, "id": 22817 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff55856c23", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002398" } ], "repeated": 0, "id": 22818 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "5096", "caller": "0x7fff558550f2", "parentcaller": "0x7fff558a966f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002704" } ], "repeated": 0, "id": 22819 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "5096", "caller": "0x7fff58095eff", "parentcaller": "0x7fff580969fb", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002024" } ], "repeated": 0, "id": 22820 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002160" }, { "name": "ValueName", "value": "30Value" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\DataProtection\\EDPShowIcons\\30Value" } ], "repeated": 0, "id": 22821 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002160" }, { "name": "ValueName", "value": "Value" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\DataProtection\\EDPShowIcons\\Value" } ], "repeated": 0, "id": 22822 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "5096", "caller": "0x7fff558561ac", "parentcaller": "0x7fff55852f1e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "ChromeHTML" }, { "name": "Handle", "value": "0x00002026" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\ChromeHTML" } ], "repeated": 0, "id": 22823 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "5096", "caller": "0x7fff558561c9", "parentcaller": "0x7fff55852f1e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002026" } ], "repeated": 0, "id": 22824 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002160" } ], "repeated": 0, "id": 22825 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 22826 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "5096", "caller": "0x7fff55853405", "parentcaller": "0x7fff55852415", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "ChromeHTML" }, { "name": "Handle", "value": "0x00002026" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\ChromeHTML" } ], "repeated": 0, "id": 22827 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "5096", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002026" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\ChromeHTML" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 22828 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 22829 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "5096", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002026" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 22830 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "5096", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd3T\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00& \\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\xd4T\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 22831 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "5096", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\ChromeHTML\\CurVer" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\ChromeHTML\\CurVer" } ], "repeated": 0, "id": 22832 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "5096", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002026" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 22833 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "5096", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00002026" }, { "name": "ObjectAttributesName", "value": "CurVer" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\ChromeHTML\\CurVer" } ], "repeated": 0, "id": 22834 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "5096", "caller": "0x7fff58081596", "parentcaller": "0x7fff58ac668d", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002026" }, { "name": "SubKey", "value": "" }, { "name": "Handle", "value": "0x00002706" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\ChromeHTML\\" } ], "repeated": 0, "id": 22835 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "5096", "caller": "0x7fff55852456", "parentcaller": "0x7fff558580e8", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002026" } ], "repeated": 0, "id": 22836 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 22837 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 22838 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "5096", "caller": "0x7fff5808ad48", "parentcaller": "0x7fff557c7493", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002706" }, { "name": "SubKey", "value": "DefaultIcon" }, { "name": "Handle", "value": "0x00002026" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\ChromeHTML\\DefaultIcon" } ], "repeated": 0, "id": 22839 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002160" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 22840 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "5096", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808ad83", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002026" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe,10" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\ChromeHTML\\DefaultIcon\\(Default)" } ], "repeated": 0, "id": 22841 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000026f8" } ], "repeated": 0, "id": 22842 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "5096", "caller": "0x7fff5808ad91", "parentcaller": "0x7fff557c7493", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002026" } ], "repeated": 0, "id": 22843 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "5096", "caller": "0x7fff58095eff", "parentcaller": "0x7fff580969fb", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002582" } ], "repeated": 0, "id": 22844 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xd0\\xe2\\x14\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00`\\xda\\xd9\\xff\\xff\\xff\\xff\\xff\\xde\\xa6DK\\x07\\xef\\xdc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xda\\xd9\\xff\\xff\\xff\\xff\\xffH\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 22845 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "5096", "caller": "0x7fff58095eff", "parentcaller": "0x7fff580969fb", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002706" } ], "repeated": 0, "id": 22846 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "5096", "caller": "0x7fff41354ccb", "parentcaller": "0x7fff41354c34", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025b6" } ], "repeated": 0, "id": 22847 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026f8" } ], "repeated": 0, "id": 22848 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "5096", "caller": "0x7fff558b2b5a", "parentcaller": "0x7fff558658f2", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001011c" }, { "name": "Message", "value": "0x000004b5" } ], "repeated": 0, "id": 22849 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 22850 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "5096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff557c403a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026dc" } ], "repeated": 0, "id": 22851 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 22852 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002168" } ], "repeated": 0, "id": 22853 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002168" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 22854 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002160" } ], "repeated": 0, "id": 22855 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe2\\x14\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00<&\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00i\\xd5[\\x1a\\xff\\x7f\\x00\\x00p\\xe3\\x14\\x01\\x00\\x00\\x00\\x00<&\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xe2\\x14\\x01\\x00\\x00\\x00\\x00\\xb8\\xe1\\x14\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9d|}\\x1a\\xff\\x7f\\x00\\x00(\\x8b}\\x1a\\xff\\x7f\\x00\\x00<&\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 22856 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026f8" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 22857 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002168" } ], "repeated": 0, "id": 22858 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002278" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" }, { "name": "FileInformationClass", "value": "74" }, { "name": "FileInformation", "value": "\\x02\\x00\\x00\\x00" } ], "repeated": 0, "id": 22859 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026f8" } ], "repeated": 0, "id": 22860 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 22861 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 22862 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000026dc" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 22863 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "GetDiskFreeSpaceExW", "status": true, "return": "0x00000001", "arguments": [ { "name": "DirectoryName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" } ], "repeated": 0, "id": 22864 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000025b4" } ], "repeated": 0, "id": 22865 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xd0\\xe80\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xedi\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xc6\\x15\\x01\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0094}W\\xff\\x7f\\x00\\x00" } ], "repeated": 0, "id": 22866 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 22867 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 22868 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002704" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 22869 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025b4" } ], "repeated": 0, "id": 22870 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026dc" } ], "repeated": 0, "id": 22871 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 22872 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000f80" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 22873 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000022b0" } ], "repeated": 0, "id": 22874 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xe5\\x14\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc7\\xb3\\xf7Y\\xff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x05\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\xb9s`\\x0e\\xea[\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xe8\\x14\\x01\\x00\\x00\\x00\\x00\\x80ba\\x07\\x00\\x00\\x00\\x00\\xb0\\x8dm\\x07\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00g\n\\x05\\x14\\x00\\x00\\x00\\x00\\xb0\\xe6\\x14\\x01\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 22875 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x000024b8" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 22876 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022b0" } ], "repeated": 0, "id": 22877 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f80" } ], "repeated": 0, "id": 22878 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 22879 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 22880 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b8" } ], "repeated": 0, "id": 22881 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002278" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\xf0\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xe3\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 22882 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000024b8" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 22883 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000f80" } ], "repeated": 0, "id": 22884 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xf0\\xe5\\x14\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00p\\xe6\\x14\\x01\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x83!,C\\xff\\x7f\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00 D\\x80\\x0c\\x00\\x00\\x00\\x00\\xa0\\xe6\\x14\\x01\\x00\\x00\\x00\\x00f@5X\\xff\\x7f\\x00\\x00g\n\\x05\\x14\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00g\n\\x05\\x14\\x00\\x00\\x00\\x00\\xc9\\x1f,C\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xff\\x7f\\x00\\x00" } ], "repeated": 0, "id": 22885 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x000022b0" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 22886 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f80" } ], "repeated": 0, "id": 22887 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b8" } ], "repeated": 0, "id": 22888 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000025dc" }, { "name": "DesiredAccess", "value": "0x000f0007", "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_WRITE" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x00002278" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" } ], "repeated": 0, "id": 22889 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000022b0" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 22890 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000024b8" } ], "repeated": 0, "id": 22891 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000025dc" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09fd0000" }, { "name": "SectionOffset", "value": "0x0130e630" }, { "name": "ViewSize", "value": "0x0000f000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 22892 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xe5\\x14\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc7\\xb3\\xf7Y\\xff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x05\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\xb9s`\\x0e\\xea[\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xe8\\x14\\x01\\x00\\x00\\x00\\x00\\x80ba\\x07\\x00\\x00\\x00\\x00\\xb0\\x8dm\\x07\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00g\n\\x05\\x14\\x00\\x00\\x00\\x00\\xb0\\xe6\\x14\\x01\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 22893 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025dc" } ], "repeated": 0, "id": 22894 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x000026f8" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 22895 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432b9503", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 22896 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001011c" }, { "name": "Message", "value": "0x000004b5" } ], "repeated": 0, "id": 22897 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b8" } ], "repeated": 0, "id": 22898 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022b0" } ], "repeated": 0, "id": 22899 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 22900 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 22901 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002704" } ], "repeated": 0, "id": 22902 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001011c" }, { "name": "Message", "value": "0x000004b5" } ], "repeated": 0, "id": 22903 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002704" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 22904 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000025dc" } ], "repeated": 0, "id": 22905 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xe0\\xe80\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9d|}\\x1a\\xff\\x7f\\x00\\x00(\\x8b}\\x1a\\xff\\x7f\\x00\\x00\\xf0\\x1a\\x00\\x00\\x00\\x00\\x00\\x00\\x98\\xfb\\x1d\\x01\\x00\\x00\\x00\\x00]\\xdd|W\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0094}W\\xff\\x7f\\x00\\x00iqD\\x0e\\xea[\\x00\\x00\\x98\\xfb\\x1d\\x01\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 22906 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x000026a0" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 22907 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025dc" } ], "repeated": 0, "id": 22908 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001011c" }, { "name": "Message", "value": "0x000004b5" } ], "repeated": 0, "id": 22909 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002704" } ], "repeated": 0, "id": 22910 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026a0" } ], "repeated": 0, "id": 22911 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 22912 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026f8" } ], "repeated": 0, "id": 22913 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002278" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000026a0" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 22914 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000026f8" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 22915 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026fc" } ], "repeated": 0, "id": 22916 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000022b0" } ], "repeated": 0, "id": 22917 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xf0\\xe5\\x14\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00p\\xe6\\x14\\x01\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x83!,C\\xff\\x7f\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00 D\\x80\\x0c\\x00\\x00\\x00\\x00\\xa0\\xe6\\x14\\x01\\x00\\x00\\x00\\x00f@5X\\xff\\x7f\\x00\\x00g\n\\x05\\x14\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00g\n\\x05\\x14\\x00\\x00\\x00\\x00\\xc9\\x1f,C\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xff\\x7f\\x00\\x00" } ], "repeated": 0, "id": 22918 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b8" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 22919 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022b0" } ], "repeated": 0, "id": 22920 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026f8" } ], "repeated": 0, "id": 22921 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b8" } ], "repeated": 0, "id": 22922 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 22923 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 22924 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 22925 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000024b8" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 22926 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000026f8" } ], "repeated": 0, "id": 22927 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xe5\\x14\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc7\\xb3\\xf7Y\\xff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x05\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\xb9s`\\x0e\\xea[\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xe8\\x14\\x01\\x00\\x00\\x00\\x00\\x80ba\\x07\\x00\\x00\\x00\\x00\\xb0\\x8dm\\x07\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00g\n\\x05\\x14\\x00\\x00\\x00\\x00\\xb0\\xe6\\x14\\x01\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 22928 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022b0" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 22929 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026f8" } ], "repeated": 0, "id": 22930 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b8" } ], "repeated": 0, "id": 22931 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 22932 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 22933 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022b0" } ], "repeated": 0, "id": 22934 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000022b0" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 22935 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000024b8" } ], "repeated": 0, "id": 22936 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xf0\\xe5\\x14\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00p\\xe6\\x14\\x01\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x83!,C\\xff\\x7f\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00 D\\x80\\x0c\\x00\\x00\\x00\\x00\\xa0\\xe6\\x14\\x01\\x00\\x00\\x00\\x00f@5X\\xff\\x7f\\x00\\x00g\n\\x05\\x14\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00g\n\\x05\\x14\\x00\\x00\\x00\\x00\\xc9\\x1f,C\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xff\\x7f\\x00\\x00" } ], "repeated": 0, "id": 22937 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026f8" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 22938 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b8" } ], "repeated": 0, "id": 22939 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022b0" } ], "repeated": 0, "id": 22940 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026f8" } ], "repeated": 0, "id": 22941 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 22942 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 22943 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 22944 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000026f8" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 22945 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000022b0" } ], "repeated": 0, "id": 22946 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xe5\\x14\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc7\\xb3\\xf7Y\\xff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x05\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\xb9s`\\x0e\\xea[\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xe8\\x14\\x01\\x00\\x00\\x00\\x00\\x80ba\\x07\\x00\\x00\\x00\\x00\\xb0\\x8dm\\x07\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00g\n\\x05\\x14\\x00\\x00\\x00\\x00\\xb0\\xe6\\x14\\x01\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 22947 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b8" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 22948 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022b0" } ], "repeated": 0, "id": 22949 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026f8" } ], "repeated": 0, "id": 22950 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 22951 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 22952 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b8" } ], "repeated": 0, "id": 22953 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000024b8" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 22954 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000026f8" } ], "repeated": 0, "id": 22955 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xf0\\xe5\\x14\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00p\\xe6\\x14\\x01\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x83!,C\\xff\\x7f\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00 D\\x80\\x0c\\x00\\x00\\x00\\x00\\xa0\\xe6\\x14\\x01\\x00\\x00\\x00\\x00f@5X\\xff\\x7f\\x00\\x00g\n\\x05\\x14\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00g\n\\x05\\x14\\x00\\x00\\x00\\x00\\xc9\\x1f,C\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xff\\x7f\\x00\\x00" } ], "repeated": 0, "id": 22956 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022b0" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 22957 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026f8" } ], "repeated": 0, "id": 22958 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b8" } ], "repeated": 0, "id": 22959 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022b0" } ], "repeated": 0, "id": 22960 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 22961 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 22962 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 22963 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000022b0" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 22964 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000024b8" } ], "repeated": 0, "id": 22965 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xe5\\x14\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc7\\xb3\\xf7Y\\xff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x05\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\xb9s`\\x0e\\xea[\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xe8\\x14\\x01\\x00\\x00\\x00\\x00\\x80ba\\x07\\x00\\x00\\x00\\x00\\xb0\\x8dm\\x07\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00g\n\\x05\\x14\\x00\\x00\\x00\\x00\\xb0\\xe6\\x14\\x01\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 22966 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026f8" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 22967 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b8" } ], "repeated": 0, "id": 22968 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022b0" } ], "repeated": 0, "id": 22969 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 22970 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 22971 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026f8" } ], "repeated": 0, "id": 22972 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000026f8" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 22973 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000022b0" } ], "repeated": 0, "id": 22974 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xf0\\xe5\\x14\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00p\\xe6\\x14\\x01\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x83!,C\\xff\\x7f\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00 D\\x80\\x0c\\x00\\x00\\x00\\x00\\xa0\\xe6\\x14\\x01\\x00\\x00\\x00\\x00f@5X\\xff\\x7f\\x00\\x00g\n\\x05\\x14\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00g\n\\x05\\x14\\x00\\x00\\x00\\x00\\xc9\\x1f,C\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xff\\x7f\\x00\\x00" } ], "repeated": 0, "id": 22975 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b8" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 22976 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022b0" } ], "repeated": 0, "id": 22977 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026f8" } ], "repeated": 0, "id": 22978 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b8" } ], "repeated": 0, "id": 22979 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 22980 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 22981 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 22982 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000024b8" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 22983 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000026f8" } ], "repeated": 0, "id": 22984 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xe5\\x14\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc7\\xb3\\xf7Y\\xff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x05\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\xb9s`\\x0e\\xea[\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xe8\\x14\\x01\\x00\\x00\\x00\\x00\\x80ba\\x07\\x00\\x00\\x00\\x00\\xb0\\x8dm\\x07\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00g\n\\x05\\x14\\x00\\x00\\x00\\x00\\xb0\\xe6\\x14\\x01\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 22985 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022b0" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 22986 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026f8" } ], "repeated": 0, "id": 22987 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b8" } ], "repeated": 0, "id": 22988 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 22989 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 22990 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022b0" } ], "repeated": 0, "id": 22991 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000022b0" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 22992 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000024b8" } ], "repeated": 0, "id": 22993 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xf0\\xe5\\x14\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00p\\xe6\\x14\\x01\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x83!,C\\xff\\x7f\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00 D\\x80\\x0c\\x00\\x00\\x00\\x00\\xa0\\xe6\\x14\\x01\\x00\\x00\\x00\\x00f@5X\\xff\\x7f\\x00\\x00g\n\\x05\\x14\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00g\n\\x05\\x14\\x00\\x00\\x00\\x00\\xc9\\x1f,C\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xff\\x7f\\x00\\x00" } ], "repeated": 0, "id": 22994 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026f8" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 22995 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b8" } ], "repeated": 0, "id": 22996 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022b0" } ], "repeated": 0, "id": 22997 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026f8" } ], "repeated": 0, "id": 22998 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 22999 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 23000 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 23001 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000026f8" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 23002 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000022b0" } ], "repeated": 0, "id": 23003 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xe5\\x14\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc7\\xb3\\xf7Y\\xff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x05\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\xb9s`\\x0e\\xea[\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xe8\\x14\\x01\\x00\\x00\\x00\\x00\\x80ba\\x07\\x00\\x00\\x00\\x00\\xb0\\x8dm\\x07\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00g\n\\x05\\x14\\x00\\x00\\x00\\x00\\xb0\\xe6\\x14\\x01\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 23004 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b8" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 23005 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022b0" } ], "repeated": 0, "id": 23006 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026f8" } ], "repeated": 0, "id": 23007 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 23008 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 23009 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b8" } ], "repeated": 0, "id": 23010 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000024b8" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 23011 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000026f8" } ], "repeated": 0, "id": 23012 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xf0\\xe5\\x14\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00p\\xe6\\x14\\x01\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x83!,C\\xff\\x7f\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00 D\\x80\\x0c\\x00\\x00\\x00\\x00\\xa0\\xe6\\x14\\x01\\x00\\x00\\x00\\x00f@5X\\xff\\x7f\\x00\\x00g\n\\x05\\x14\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00g\n\\x05\\x14\\x00\\x00\\x00\\x00\\xc9\\x1f,C\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xff\\x7f\\x00\\x00" } ], "repeated": 0, "id": 23013 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022b0" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 23014 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026f8" } ], "repeated": 0, "id": 23015 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b8" } ], "repeated": 0, "id": 23016 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022b0" } ], "repeated": 0, "id": 23017 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 23018 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 23019 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 23020 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000022b0" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 23021 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000024b8" } ], "repeated": 0, "id": 23022 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xe5\\x14\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc7\\xb3\\xf7Y\\xff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x05\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\xb9s`\\x0e\\xea[\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xe8\\x14\\x01\\x00\\x00\\x00\\x00\\x80ba\\x07\\x00\\x00\\x00\\x00\\xb0\\x8dm\\x07\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00g\n\\x05\\x14\\x00\\x00\\x00\\x00\\xb0\\xe6\\x14\\x01\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 23023 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026f8" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 23024 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b8" } ], "repeated": 0, "id": 23025 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022b0" } ], "repeated": 0, "id": 23026 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 23027 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 23028 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026f8" } ], "repeated": 0, "id": 23029 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000026f8" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 23030 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000022b0" } ], "repeated": 0, "id": 23031 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xf0\\xe5\\x14\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00p\\xe6\\x14\\x01\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x83!,C\\xff\\x7f\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00 D\\x80\\x0c\\x00\\x00\\x00\\x00\\xa0\\xe6\\x14\\x01\\x00\\x00\\x00\\x00f@5X\\xff\\x7f\\x00\\x00g\n\\x05\\x14\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00g\n\\x05\\x14\\x00\\x00\\x00\\x00\\xc9\\x1f,C\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xff\\x7f\\x00\\x00" } ], "repeated": 0, "id": 23032 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b8" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 23033 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022b0" } ], "repeated": 0, "id": 23034 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026f8" } ], "repeated": 0, "id": 23035 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b8" } ], "repeated": 0, "id": 23036 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 23037 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 23038 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 23039 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000024b8" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 23040 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000026f8" } ], "repeated": 0, "id": 23041 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xe5\\x14\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc7\\xb3\\xf7Y\\xff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x05\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\xb9s`\\x0e\\xea[\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xe8\\x14\\x01\\x00\\x00\\x00\\x00\\x80ba\\x07\\x00\\x00\\x00\\x00\\xb0\\x8dm\\x07\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00g\n\\x05\\x14\\x00\\x00\\x00\\x00\\xb0\\xe6\\x14\\x01\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 23042 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022b0" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 23043 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026f8" } ], "repeated": 0, "id": 23044 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b8" } ], "repeated": 0, "id": 23045 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 23046 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 23047 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022b0" } ], "repeated": 0, "id": 23048 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000022b0" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 23049 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000024b8" } ], "repeated": 0, "id": 23050 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xf0\\xe5\\x14\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00p\\xe6\\x14\\x01\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x83!,C\\xff\\x7f\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00 D\\x80\\x0c\\x00\\x00\\x00\\x00\\xa0\\xe6\\x14\\x01\\x00\\x00\\x00\\x00f@5X\\xff\\x7f\\x00\\x00g\n\\x05\\x14\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00g\n\\x05\\x14\\x00\\x00\\x00\\x00\\xc9\\x1f,C\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xff\\x7f\\x00\\x00" } ], "repeated": 0, "id": 23051 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026f8" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 23052 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b8" } ], "repeated": 0, "id": 23053 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022b0" } ], "repeated": 0, "id": 23054 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026f8" } ], "repeated": 0, "id": 23055 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 23056 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 23057 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 23058 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_16.db" } ], "repeated": 0, "id": 23059 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026f8" } ], "repeated": 0, "id": 23060 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 23061 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "GetDiskFreeSpaceExW", "status": true, "return": "0x00000001", "arguments": [ { "name": "DirectoryName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" } ], "repeated": 0, "id": 23062 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 23063 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 23064 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 23065 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000024b8" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 23066 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000026f8" } ], "repeated": 0, "id": 23067 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xf0\\xe5\\x14\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00p\\xe6\\x14\\x01\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x83!,C\\xff\\x7f\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00 D\\x80\\x0c\\x00\\x00\\x00\\x00\\xa0\\xe6\\x14\\x01\\x00\\x00\\x00\\x00f@5X\\xff\\x7f\\x00\\x00g\n\\x05\\x14\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00g\n\\x05\\x14\\x00\\x00\\x00\\x00\\xc9\\x1f,C\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xff\\x7f\\x00\\x00" } ], "repeated": 0, "id": 23068 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022b0" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 23069 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026f8" } ], "repeated": 0, "id": 23070 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b8" } ], "repeated": 0, "id": 23071 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022b0" } ], "repeated": 0, "id": 23072 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 23073 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000004c4" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 23074 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 23075 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 23076 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "p\\xe70\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x97\\x9c\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\x90m\\x07\\x00\\x00\\x00\\x00\\x00\\x0fP\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9d|}\\x1a\\xff\\x7f\\x00\\x00C\\x00:\\x00\\\\x00U\\x00s\\x00e\\x00r\\x00s\\x00\\\\x00a\\x00d\\x00m\\x00i\\x00n\\x00\\\\x00A\\x00p\\x00p\\x00D\\x00a\\x00t\\x00a\\x00\\\\x00L\\x00o\\x00c\\x00a\\x00l\\x00\\\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00\\\\x00W\\x00" } ], "repeated": 0, "id": 23077 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025ac" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 23078 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002584" } ], "repeated": 0, "id": 23079 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c4" } ], "repeated": 0, "id": 23080 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 23081 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 23082 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000022b0" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 23083 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000024b8" } ], "repeated": 0, "id": 23084 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xe5\\x14\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc7\\xb3\\xf7Y\\xff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x05\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\xb9s`\\x0e\\xea[\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xe8\\x14\\x01\\x00\\x00\\x00\\x00\\x80ba\\x07\\x00\\x00\\x00\\x00\\xb0\\x8dm\\x07\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00g\n\\x05\\x14\\x00\\x00\\x00\\x00\\xb0\\xe6\\x14\\x01\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 23085 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x000026f8" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 23086 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b8" } ], "repeated": 0, "id": 23087 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022b0" } ], "repeated": 0, "id": 23088 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 23089 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 23090 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000025ac" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 23091 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000004c4" } ], "repeated": 0, "id": 23092 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x10\\xe80\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\\\x00E\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00c\\x00h\\x00e\\x00_\\x001\\x006\\x00.\\x00d\\x00b\\x00\\x00\\x00X\\xe80\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00,\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xe80\\x01\\x00\\x00\\x00\\x00\\x02\\x00P\\x00\\x01\\x00\\x00\\x00\\x00\\x00$\\x00\\x00\\x00\\x00\\x10\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec" } ], "repeated": 0, "id": 23093 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x00002584" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 23094 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c4" } ], "repeated": 0, "id": 23095 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025ac" } ], "repeated": 0, "id": 23096 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002584" } ], "repeated": 0, "id": 23097 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 23098 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026f8" } ], "repeated": 0, "id": 23099 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 23100 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 23101 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000026f8" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 23102 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002704" } ], "repeated": 0, "id": 23103 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xf0\\xe5\\x14\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00p\\xe6\\x14\\x01\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x83!,C\\xff\\x7f\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00 D\\x80\\x0c\\x00\\x00\\x00\\x00\\xa0\\xe6\\x14\\x01\\x00\\x00\\x00\\x00f@5X\\xff\\x7f\\x00\\x00g\n\\x05\\x14\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00g\n\\x05\\x14\\x00\\x00\\x00\\x00\\xc9\\x1f,C\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xff\\x7f\\x00\\x00" } ], "repeated": 0, "id": 23104 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025dc" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 23105 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002704" } ], "repeated": 0, "id": 23106 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026f8" } ], "repeated": 0, "id": 23107 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025dc" } ], "repeated": 0, "id": 23108 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 23109 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002584" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 23110 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 23111 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 23112 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000025ac" } ], "repeated": 0, "id": 23113 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "p\\xe70\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x97\\x9c\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\x90m\\x07\\x00\\x00\\x00\\x00\\x00\\x0fP\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9d|}\\x1a\\xff\\x7f\\x00\\x00C\\x00:\\x00\\\\x00U\\x00s\\x00e\\x00r\\x00s\\x00\\\\x00a\\x00d\\x00m\\x00i\\x00n\\x00\\\\x00A\\x00p\\x00p\\x00D\\x00a\\x00t\\x00a\\x00\\\\x00L\\x00o\\x00c\\x00a\\x00l\\x00\\\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00\\\\x00W\\x00" } ], "repeated": 0, "id": 23114 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c4" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 23115 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025ac" } ], "repeated": 0, "id": 23116 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002584" } ], "repeated": 0, "id": 23117 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 23118 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 23119 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000022b0" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 23120 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000024b8" } ], "repeated": 0, "id": 23121 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xe5\\x14\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc7\\xb3\\xf7Y\\xff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x05\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\xb9s`\\x0e\\xea[\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xe8\\x14\\x01\\x00\\x00\\x00\\x00\\x80ba\\x07\\x00\\x00\\x00\\x00\\xb0\\x8dm\\x07\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00g\n\\x05\\x14\\x00\\x00\\x00\\x00\\xb0\\xe6\\x14\\x01\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 23122 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x00002168" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 23123 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b8" } ], "repeated": 0, "id": 23124 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022b0" } ], "repeated": 0, "id": 23125 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 23126 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 23127 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c4" } ], "repeated": 0, "id": 23128 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000004c4" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 23129 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002584" } ], "repeated": 0, "id": 23130 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x10\\xe80\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\\\x00E\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00c\\x00h\\x00e\\x00_\\x001\\x006\\x00.\\x00d\\x00b\\x00\\x00\\x00X\\xe80\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00,\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xe80\\x01\\x00\\x00\\x00\\x00\\x02\\x00P\\x00\\x01\\x00\\x00\\x00\\x00\\x00$\\x00\\x00\\x00\\x00\\x10\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec" } ], "repeated": 0, "id": 23131 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x000025ac" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 23132 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002584" } ], "repeated": 0, "id": 23133 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c4" } ], "repeated": 0, "id": 23134 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025ac" } ], "repeated": 0, "id": 23135 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 23136 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002168" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 23137 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 23138 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 23139 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000022b0" } ], "repeated": 0, "id": 23140 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xf0\\xe5\\x14\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00p\\xe6\\x14\\x01\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x83!,C\\xff\\x7f\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00 D\\x80\\x0c\\x00\\x00\\x00\\x00\\xa0\\xe6\\x14\\x01\\x00\\x00\\x00\\x00f@5X\\xff\\x7f\\x00\\x00g\n\\x05\\x14\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00g\n\\x05\\x14\\x00\\x00\\x00\\x00\\xc9\\x1f,C\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xff\\x7f\\x00\\x00" } ], "repeated": 0, "id": 23141 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b8" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 23142 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022b0" } ], "repeated": 0, "id": 23143 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002168" } ], "repeated": 0, "id": 23144 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b8" } ], "repeated": 0, "id": 23145 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 23146 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000025ac" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 23147 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 23148 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 23149 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000004c4" } ], "repeated": 0, "id": 23150 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "p\\xe70\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x97\\x9c\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\x90m\\x07\\x00\\x00\\x00\\x00\\x00\\x0fP\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9d|}\\x1a\\xff\\x7f\\x00\\x00C\\x00:\\x00\\\\x00U\\x00s\\x00e\\x00r\\x00s\\x00\\\\x00a\\x00d\\x00m\\x00i\\x00n\\x00\\\\x00A\\x00p\\x00p\\x00D\\x00a\\x00t\\x00a\\x00\\\\x00L\\x00o\\x00c\\x00a\\x00l\\x00\\\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00\\\\x00W\\x00" } ], "repeated": 0, "id": 23151 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002584" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 23152 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c4" } ], "repeated": 0, "id": 23153 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025ac" } ], "repeated": 0, "id": 23154 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 23155 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 23156 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000024b8" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 23157 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002168" } ], "repeated": 0, "id": 23158 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xe5\\x14\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc7\\xb3\\xf7Y\\xff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x05\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\xb9s`\\x0e\\xea[\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xe8\\x14\\x01\\x00\\x00\\x00\\x00\\x80ba\\x07\\x00\\x00\\x00\\x00\\xb0\\x8dm\\x07\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00g\n\\x05\\x14\\x00\\x00\\x00\\x00\\xb0\\xe6\\x14\\x01\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 23159 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x000022b0" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 23160 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002168" } ], "repeated": 0, "id": 23161 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b8" } ], "repeated": 0, "id": 23162 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 23163 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 23164 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002584" } ], "repeated": 0, "id": 23165 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002584" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 23166 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000025ac" } ], "repeated": 0, "id": 23167 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x10\\xe80\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\\\x00E\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00c\\x00h\\x00e\\x00_\\x001\\x006\\x00.\\x00d\\x00b\\x00\\x00\\x00X\\xe80\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00,\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xe80\\x01\\x00\\x00\\x00\\x00\\x02\\x00P\\x00\\x01\\x00\\x00\\x00\\x00\\x00$\\x00\\x00\\x00\\x00\\x10\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec" } ], "repeated": 0, "id": 23168 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x000004c4" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 23169 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025ac" } ], "repeated": 0, "id": 23170 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002584" } ], "repeated": 0, "id": 23171 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c4" } ], "repeated": 0, "id": 23172 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 23173 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000022b0" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 23174 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 23175 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 23176 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000024b8" } ], "repeated": 0, "id": 23177 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xf0\\xe5\\x14\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00p\\xe6\\x14\\x01\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x83!,C\\xff\\x7f\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00 D\\x80\\x0c\\x00\\x00\\x00\\x00\\xa0\\xe6\\x14\\x01\\x00\\x00\\x00\\x00f@5X\\xff\\x7f\\x00\\x00g\n\\x05\\x14\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00g\n\\x05\\x14\\x00\\x00\\x00\\x00\\xc9\\x1f,C\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xff\\x7f\\x00\\x00" } ], "repeated": 0, "id": 23178 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002168" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 23179 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b8" } ], "repeated": 0, "id": 23180 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022b0" } ], "repeated": 0, "id": 23181 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002168" } ], "repeated": 0, "id": 23182 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 23183 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000004c4" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 23184 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002584" } ], "repeated": 0, "id": 23185 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025ac" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 23186 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002584" } ], "repeated": 0, "id": 23187 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 23188 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 23189 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000026ec" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\xf0\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xe3\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 23190 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025ac" } ], "repeated": 0, "id": 23191 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 23192 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 23193 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000004c4" } ], "repeated": 0, "id": 23194 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x10\\xe80\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\\\x00E\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00c\\x00h\\x00e\\x00_\\x001\\x006\\x00.\\x00d\\x00b\\x00\\x00\\x00X\\xe80\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00,\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xe80\\x01\\x00\\x00\\x00\\x00\\x02\\x00P\\x00\\x01\\x00\\x00\\x00\\x00\\x00$\\x00\\x00\\x00\\x00\\x10\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec" } ], "repeated": 0, "id": 23195 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002584" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 23196 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c4" } ], "repeated": 0, "id": 23197 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025ac" } ], "repeated": 0, "id": 23198 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002584" } ], "repeated": 0, "id": 23199 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 23200 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002168" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 23201 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 23202 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 23203 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000022b0" } ], "repeated": 0, "id": 23204 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xe2\\x14\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00`\\xda\\xd9\\xff\\xff\\xff\\xff\\xff\\xde\\xa6DK\\x07\\xef\\xdc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xda\\xd9\\xff\\xff\\xff\\xff\\xffH\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00<&\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 23205 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b8" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 23206 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022b0" } ], "repeated": 0, "id": 23207 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002168" } ], "repeated": 0, "id": 23208 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 23209 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 23210 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002584" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 23211 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000025ac" } ], "repeated": 0, "id": 23212 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "p\\xe70\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x97\\x9c\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\x90m\\x07\\x00\\x00\\x00\\x00\\x00\\x0fP\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9d|}\\x1a\\xff\\x7f\\x00\\x00C\\x00:\\x00\\\\x00U\\x00s\\x00e\\x00r\\x00s\\x00\\\\x00a\\x00d\\x00m\\x00i\\x00n\\x00\\\\x00A\\x00p\\x00p\\x00D\\x00a\\x00t\\x00a\\x00\\\\x00L\\x00o\\x00c\\x00a\\x00l\\x00\\\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00\\\\x00W\\x00" } ], "repeated": 0, "id": 23213 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x000004c4" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 23214 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025ac" } ], "repeated": 0, "id": 23215 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002584" } ], "repeated": 0, "id": 23216 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 23217 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b8" } ], "repeated": 0, "id": 23218 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 23219 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000024b8" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 23220 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002168" } ], "repeated": 0, "id": 23221 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xe2\\x14\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\xb8$\\x00\\x00\\x00\\x00\\x00\\x00\\xb8$\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x81|}\\x1a\\xff\\x7f\\x00\\x00(\\x8b}\\x1a\\xff\\x7f\\x00\\x00\\xb8$\\x00\\x00\\x00\\x00\\x00\\x00\\xb8$\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x85g}W\\xff\\x7f\\x00\\x00\\xb8$\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 23222 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x000022b0" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 23223 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002168" } ], "repeated": 0, "id": 23224 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b8" } ], "repeated": 0, "id": 23225 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022b0" } ], "repeated": 0, "id": 23226 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 23227 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c4" } ], "repeated": 0, "id": 23228 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000004c4" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 23229 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002584" } ], "repeated": 0, "id": 23230 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x10\\xe80\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\\\x00E\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00c\\x00h\\x00e\\x00_\\x001\\x006\\x00.\\x00d\\x00b\\x00\\x00\\x00X\\xe80\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00,\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xe80\\x01\\x00\\x00\\x00\\x00\\x02\\x00P\\x00\\x01\\x00\\x00\\x00\\x00\\x00$\\x00\\x00\\x00\\x00\\x10\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec" } ], "repeated": 0, "id": 23231 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025ac" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 23232 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "317D06E8-5F24-433D-BDF7-79CE68D8ABC2" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EC5EC8A9-C395-4314-9C77-54D7A935FF70" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 23233 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002584" } ], "repeated": 0, "id": 23234 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c4" } ], "repeated": 0, "id": 23235 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002620" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 23236 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025ac" } ], "repeated": 0, "id": 23237 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 23238 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 23239 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 23240 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000025ac" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 23241 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000004c4" } ], "repeated": 0, "id": 23242 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "p\\xe70\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x97\\x9c\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\x90m\\x07\\x00\\x00\\x00\\x00\\x00\\x0fP\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9d|}\\x1a\\xff\\x7f\\x00\\x00C\\x00:\\x00\\\\x00U\\x00s\\x00e\\x00r\\x00s\\x00\\\\x00a\\x00d\\x00m\\x00i\\x00n\\x00\\\\x00A\\x00p\\x00p\\x00D\\x00a\\x00t\\x00a\\x00\\\\x00L\\x00o\\x00c\\x00a\\x00l\\x00\\\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00\\\\x00W\\x00" } ], "repeated": 0, "id": 23243 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002700" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_32.db" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 23244 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002584" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 23245 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 23246 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c4" } ], "repeated": 0, "id": 23247 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025ac" } ], "repeated": 0, "id": 23248 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 23249 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 23250 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000f80" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 23251 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002318" } ], "repeated": 0, "id": 23252 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xc0\\xe3\\x14\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xf7\\x8b\\x10\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 23253 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 23254 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002318" } ], "repeated": 0, "id": 23255 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f80" } ], "repeated": 0, "id": 23256 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 23257 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 23258 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002584" } ], "repeated": 0, "id": 23259 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 23260 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022ac" }, { "name": "Milliseconds", "value": "5000" } ], "repeated": 0, "id": 23261 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002584" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 23262 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000022b0" } ], "repeated": 0, "id": 23263 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x10\\xe80\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\\\x00E\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00c\\x00h\\x00e\\x00_\\x001\\x006\\x00.\\x00d\\x00b\\x00\\x00\\x00X\\xe80\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00,\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xe80\\x01\\x00\\x00\\x00\\x00\\x02\\x00P\\x00\\x01\\x00\\x00\\x00\\x00\\x00$\\x00\\x00\\x00\\x00\\x10\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec" } ], "repeated": 0, "id": 23264 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b8" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 23265 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022b0" } ], "repeated": 0, "id": 23266 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002584" } ], "repeated": 0, "id": 23267 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b8" } ], "repeated": 0, "id": 23268 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 23269 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 23270 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 23271 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 23272 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000026fc" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 23273 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000020d4" } ], "repeated": 0, "id": 23274 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xc0\\xe3\\x14\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x94\\x04\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 23275 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025c4" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 23276 }, { "timestamp": "2026-05-29 01:05:52,087", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000020d4" } ], "repeated": 0, "id": 23277 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026fc" } ], "repeated": 0, "id": 23278 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025c4" } ], "repeated": 0, "id": 23279 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000026ec" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\xf0\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xe3\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 23280 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 23281 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000025dc" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 23282 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000026f8" } ], "repeated": 0, "id": 23283 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "p\\xe70\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x97\\x9c\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\x90m\\x07\\x00\\x00\\x00\\x00\\x00\\x0fP\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9d|}\\x1a\\xff\\x7f\\x00\\x00C\\x00:\\x00\\\\x00U\\x00s\\x00e\\x00r\\x00s\\x00\\\\x00a\\x00d\\x00m\\x00i\\x00n\\x00\\\\x00A\\x00p\\x00p\\x00D\\x00a\\x00t\\x00a\\x00\\\\x00L\\x00o\\x00c\\x00a\\x00l\\x00\\\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00\\\\x00W\\x00" } ], "repeated": 0, "id": 23284 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002704" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 23285 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002700" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_32.db" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 23286 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026f8" } ], "repeated": 0, "id": 23287 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025dc" } ], "repeated": 0, "id": 23288 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 23289 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 23290 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002704" } ], "repeated": 0, "id": 23291 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002704" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 23292 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000025dc" } ], "repeated": 0, "id": 23293 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x10\\xe80\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\\\x00E\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00c\\x00h\\x00e\\x00_\\x001\\x006\\x00.\\x00d\\x00b\\x00\\x00\\x00X\\xe80\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00,\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xe80\\x01\\x00\\x00\\x00\\x00\\x02\\x00P\\x00\\x01\\x00\\x00\\x00\\x00\\x00$\\x00\\x00\\x00\\x00\\x10\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec" } ], "repeated": 0, "id": 23294 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026f8" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 23295 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002700" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_32.db" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 23296 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025dc" } ], "repeated": 0, "id": 23297 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002704" } ], "repeated": 0, "id": 23298 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002620" } ], "repeated": 0, "id": 23299 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026f8" } ], "repeated": 0, "id": 23300 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000025c4" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 23301 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 23302 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000026fc" } ], "repeated": 0, "id": 23303 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x90\\xe6\\x14\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\xc8\\xe7\\x14\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00C\\x10,C\\xff\\x7f\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb8\\xac,C\\xff\\x7f\\x00\\x00 D\\x80\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xe8\\x14\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00 D\\x80\\x0c\\x00\\x00\\x00\\x00\\xe7\\xab,C\\xff\\x7f\\x00\\x00 D\\x80\\x0c\\x00\\x00\\x00\\x00ip`\\x0e\\xea[\\x00\\x00" } ], "repeated": 0, "id": 23304 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 23305 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 23306 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "MutexName", "value": "" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 23307 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000026f8" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 23308 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026fc" } ], "repeated": 0, "id": 23309 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002704" } ], "repeated": 0, "id": 23310 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025c4" } ], "repeated": 0, "id": 23311 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "p\\xe70\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x97\\x9c\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\x90m\\x07\\x00\\x00\\x00\\x00\\x00\\x0fP\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9d|}\\x1a\\xff\\x7f\\x00\\x00C\\x00:\\x00\\\\x00U\\x00s\\x00e\\x00r\\x00s\\x00\\\\x00a\\x00d\\x00m\\x00i\\x00n\\x00\\\\x00A\\x00p\\x00p\\x00D\\x00a\\x00t\\x00a\\x00\\\\x00L\\x00o\\x00c\\x00a\\x00l\\x00\\\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00\\\\x00W\\x00" } ], "repeated": 0, "id": 23312 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "3424", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 23313 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002704" } ], "repeated": 0, "id": 23314 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026f8" } ], "repeated": 0, "id": 23315 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 23316 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 23317 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025dc" } ], "repeated": 0, "id": 23318 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000025dc" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 23319 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000026f8" } ], "repeated": 0, "id": 23320 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x10\\xe80\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\\\x00E\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00c\\x00h\\x00e\\x00_\\x001\\x006\\x00.\\x00d\\x00b\\x00\\x00\\x00X\\xe80\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00,\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xe80\\x01\\x00\\x00\\x00\\x00\\x02\\x00P\\x00\\x01\\x00\\x00\\x00\\x00\\x00$\\x00\\x00\\x00\\x00\\x10\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec" } ], "repeated": 0, "id": 23321 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002704" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 23322 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026f8" } ], "repeated": 0, "id": 23323 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025dc" } ], "repeated": 0, "id": 23324 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002704" } ], "repeated": 0, "id": 23325 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 23326 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 23327 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 23328 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002704" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 23329 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "3424", "caller": "0x7ff79bc51f68", "parentcaller": "0x7ff79bc90020", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000100c4" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 23330 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000025dc" } ], "repeated": 0, "id": 23331 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "p\\xe70\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x97\\x9c\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\x90m\\x07\\x00\\x00\\x00\\x00\\x00\\x0fP\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9d|}\\x1a\\xff\\x7f\\x00\\x00C\\x00:\\x00\\\\x00U\\x00s\\x00e\\x00r\\x00s\\x00\\\\x00a\\x00d\\x00m\\x00i\\x00n\\x00\\\\x00A\\x00p\\x00p\\x00D\\x00a\\x00t\\x00a\\x00\\\\x00L\\x00o\\x00c\\x00a\\x00l\\x00\\\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00\\\\x00W\\x00" } ], "repeated": 0, "id": 23332 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "3424", "caller": "0x7ff79bc51f68", "parentcaller": "0x7ff79bc90020", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000100c4" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 23333 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025dc" } ], "repeated": 0, "id": 23334 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002704" } ], "repeated": 0, "id": 23335 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 23336 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 23337 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026f8" } ], "repeated": 0, "id": 23338 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000026f8" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 23339 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002704" } ], "repeated": 0, "id": 23340 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x10\\xe80\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\\\x00E\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00c\\x00h\\x00e\\x00_\\x001\\x006\\x00.\\x00d\\x00b\\x00\\x00\\x00X\\xe80\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00,\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xe80\\x01\\x00\\x00\\x00\\x00\\x02\\x00P\\x00\\x01\\x00\\x00\\x00\\x00\\x00$\\x00\\x00\\x00\\x00\\x10\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec" } ], "repeated": 0, "id": 23341 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025dc" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 23342 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002704" } ], "repeated": 0, "id": 23343 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026f8" } ], "repeated": 0, "id": 23344 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025dc" } ], "repeated": 0, "id": 23345 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 23346 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 23347 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 23348 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000025dc" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 23349 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000026f8" } ], "repeated": 0, "id": 23350 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "p\\xe70\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x97\\x9c\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\x90m\\x07\\x00\\x00\\x00\\x00\\x00\\x0fP\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9d|}\\x1a\\xff\\x7f\\x00\\x00C\\x00:\\x00\\\\x00U\\x00s\\x00e\\x00r\\x00s\\x00\\\\x00a\\x00d\\x00m\\x00i\\x00n\\x00\\\\x00A\\x00p\\x00p\\x00D\\x00a\\x00t\\x00a\\x00\\\\x00L\\x00o\\x00c\\x00a\\x00l\\x00\\\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00\\\\x00W\\x00" } ], "repeated": 0, "id": 23351 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002704" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 23352 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026f8" } ], "repeated": 0, "id": 23353 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025dc" } ], "repeated": 0, "id": 23354 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 23355 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "3424", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xfe\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00`\r\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "3424" } ], "repeated": 0, "id": 23356 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "3424", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432be00e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" } ], "repeated": 0, "id": 23357 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 23358 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "3424", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff432beb8c", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x13260000" }, { "name": "RegionSize", "value": "0x00100000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 23359 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002704" } ], "repeated": 0, "id": 23360 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "3424", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432beba1", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002518" } ], "repeated": 0, "id": 23361 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "3424", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432be04f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002700" } ], "repeated": 0, "id": 23362 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002704" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 23363 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000025dc" } ], "repeated": 0, "id": 23364 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x10\\xe80\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\\\x00E\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00c\\x00h\\x00e\\x00_\\x001\\x006\\x00.\\x00d\\x00b\\x00\\x00\\x00X\\xe80\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00,\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xe80\\x01\\x00\\x00\\x00\\x00\\x02\\x00P\\x00\\x01\\x00\\x00\\x00\\x00\\x00$\\x00\\x00\\x00\\x00\\x10\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec" } ], "repeated": 0, "id": 23365 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026f8" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 23366 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025dc" } ], "repeated": 0, "id": 23367 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002704" } ], "repeated": 0, "id": 23368 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026f8" } ], "repeated": 0, "id": 23369 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 23370 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 23371 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 23372 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000026f8" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 23373 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002704" } ], "repeated": 0, "id": 23374 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "p\\xe70\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x97\\x9c\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\x90m\\x07\\x00\\x00\\x00\\x00\\x00\\x0fP\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9d|}\\x1a\\xff\\x7f\\x00\\x00C\\x00:\\x00\\\\x00U\\x00s\\x00e\\x00r\\x00s\\x00\\\\x00a\\x00d\\x00m\\x00i\\x00n\\x00\\\\x00A\\x00p\\x00p\\x00D\\x00a\\x00t\\x00a\\x00\\\\x00L\\x00o\\x00c\\x00a\\x00l\\x00\\\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00\\\\x00W\\x00" } ], "repeated": 0, "id": 23375 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025dc" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 23376 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002704" } ], "repeated": 0, "id": 23377 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026f8" } ], "repeated": 0, "id": 23378 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 23379 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 23380 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025dc" } ], "repeated": 0, "id": 23381 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000025dc" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 23382 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000026f8" } ], "repeated": 0, "id": 23383 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "3424", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432be00e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002620" } ], "repeated": 0, "id": 23384 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "3424", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432be00e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002638" } ], "repeated": 0, "id": 23385 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x10\\xe80\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\\\x00E\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00c\\x00h\\x00e\\x00_\\x001\\x006\\x00.\\x00d\\x00b\\x00\\x00\\x00X\\xe80\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00,\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xe80\\x01\\x00\\x00\\x00\\x00\\x02\\x00P\\x00\\x01\\x00\\x00\\x00\\x00\\x00$\\x00\\x00\\x00\\x00\\x10\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec" } ], "repeated": 0, "id": 23386 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "3424", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432be00e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024a0" } ], "repeated": 0, "id": 23387 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "3424", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432be00e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002530" } ], "repeated": 0, "id": 23388 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "3424", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432be00e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000249c" } ], "repeated": 0, "id": 23389 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "3424", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432be00e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002490" } ], "repeated": 0, "id": 23390 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002704" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 23391 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "3424", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432be00e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002524" } ], "repeated": 0, "id": 23392 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "3424", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432be00e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" } ], "repeated": 0, "id": 23393 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "3424", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432be00e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002450" } ], "repeated": 0, "id": 23394 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026f8" } ], "repeated": 0, "id": 23395 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "3424", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432be00e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 23396 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "3424", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432be00e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002528" } ], "repeated": 0, "id": 23397 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025dc" } ], "repeated": 0, "id": 23398 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "3424", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432c3396", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" } ], "repeated": 0, "id": 23399 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002704" } ], "repeated": 0, "id": 23400 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 23401 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 23402 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 23403 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002704" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 23404 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000025dc" } ], "repeated": 0, "id": 23405 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "p\\xe70\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x97\\x9c\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\x90m\\x07\\x00\\x00\\x00\\x00\\x00\\x0fP\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9d|}\\x1a\\xff\\x7f\\x00\\x00C\\x00:\\x00\\\\x00U\\x00s\\x00e\\x00r\\x00s\\x00\\\\x00a\\x00d\\x00m\\x00i\\x00n\\x00\\\\x00A\\x00p\\x00p\\x00D\\x00a\\x00t\\x00a\\x00\\\\x00L\\x00o\\x00c\\x00a\\x00l\\x00\\\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00\\\\x00W\\x00" } ], "repeated": 0, "id": 23406 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026f8" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 23407 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025dc" } ], "repeated": 0, "id": 23408 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002704" } ], "repeated": 0, "id": 23409 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 23410 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 23411 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026f8" } ], "repeated": 0, "id": 23412 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000026f8" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 23413 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002704" } ], "repeated": 0, "id": 23414 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x10\\xe80\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\\\x00E\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00c\\x00h\\x00e\\x00_\\x001\\x006\\x00.\\x00d\\x00b\\x00\\x00\\x00X\\xe80\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00,\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xe80\\x01\\x00\\x00\\x00\\x00\\x02\\x00P\\x00\\x01\\x00\\x00\\x00\\x00\\x00$\\x00\\x00\\x00\\x00\\x10\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec" } ], "repeated": 0, "id": 23415 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025dc" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 23416 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002704" } ], "repeated": 0, "id": 23417 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026f8" } ], "repeated": 0, "id": 23418 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "3424", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff432c33a9", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09fe0000" }, { "name": "RegionSize", "value": "0x0000f000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 23419 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "3424", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432c3c47", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 23420 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "3424", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432c3c5c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022ac" } ], "repeated": 0, "id": 23421 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "3424", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432c3d86", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af4" } ], "repeated": 0, "id": 23422 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025dc" } ], "repeated": 0, "id": 23423 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "3424", "caller": "0x7fff5582a695", "parentcaller": "0x7fff5582a024", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002648" } ], "repeated": 0, "id": 23424 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 23425 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 23426 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 23427 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000025dc" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 23428 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "p\\xe70\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x97\\x9c\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\x90m\\x07\\x00\\x00\\x00\\x00\\x00\\x0fP\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9d|}\\x1a\\xff\\x7f\\x00\\x00C\\x00:\\x00\\\\x00U\\x00s\\x00e\\x00r\\x00s\\x00\\\\x00a\\x00d\\x00m\\x00i\\x00n\\x00\\\\x00A\\x00p\\x00p\\x00D\\x00a\\x00t\\x00a\\x00\\\\x00L\\x00o\\x00c\\x00a\\x00l\\x00\\\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00\\\\x00W\\x00" } ], "repeated": 0, "id": 23429 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002704" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 23430 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026f8" } ], "repeated": 0, "id": 23431 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025dc" } ], "repeated": 0, "id": 23432 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 23433 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 23434 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "3424", "caller": "0x7fff577ce76a", "parentcaller": "0x7fff584cea0e", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "oleaut32.dll" }, { "name": "ModuleHandle", "value": "0x7fff58860000" } ], "repeated": 0, "id": 23435 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002704" } ], "repeated": 0, "id": 23436 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "3424", "caller": "0x7fff5809b283", "parentcaller": "0x7fff58088b47", "category": "windows", "api": "PostThreadMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessId", "value": "4484" }, { "name": "ThreadId", "value": "4488" }, { "name": "Message", "value": "0" } ], "repeated": 0, "id": 23437 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002704" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 23438 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "3424", "caller": "0x7fff5809b283", "parentcaller": "0x7fff58088b47", "category": "windows", "api": "PostThreadMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessId", "value": "4484" }, { "name": "ThreadId", "value": "4488" }, { "name": "Message", "value": "0" } ], "repeated": 0, "id": 23439 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "3424", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5809da8f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f84" } ], "repeated": 0, "id": 23440 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000025dc" } ], "repeated": 0, "id": 23441 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x10\\xe80\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\\\x00E\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00c\\x00h\\x00e\\x00_\\x001\\x006\\x00.\\x00d\\x00b\\x00\\x00\\x00X\\xe80\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00,\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xe80\\x01\\x00\\x00\\x00\\x00\\x02\\x00P\\x00\\x01\\x00\\x00\\x00\\x00\\x00$\\x00\\x00\\x00\\x00\\x10\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec" } ], "repeated": 0, "id": 23442 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026f8" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 23443 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025dc" } ], "repeated": 0, "id": 23444 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002704" } ], "repeated": 0, "id": 23445 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026f8" } ], "repeated": 0, "id": 23446 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 23447 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002278" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\xf0\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xe3\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 23448 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 23449 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 23450 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000026f8" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 23451 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002704" } ], "repeated": 0, "id": 23452 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xa0\\xe40\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00`\\xda\\xd9\\xff\\xff\\xff\\xff\\xfff\nGK\\x07\\xef\\xdc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xda\\xd9\\xff\\xff\\xff\\xff\\xffH\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\x1a\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 23453 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025dc" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 23454 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002704" } ], "repeated": 0, "id": 23455 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026f8" } ], "repeated": 0, "id": 23456 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 23457 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 23458 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025dc" } ], "repeated": 0, "id": 23459 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000025dc" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 23460 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000026f8" } ], "repeated": 0, "id": 23461 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xa0\\xe40\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\xdc%\\x00\\x00\\x00\\x00\\x00\\x00\\xdc%\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x81|}\\x1a\\xff\\x7f\\x00\\x00(\\x8b}\\x1a\\xff\\x7f\\x00\\x00\\xdc%\\x00\\x00\\x00\\x00\\x00\\x00\\xdc%\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x85g}W\\xff\\x7f\\x00\\x00\\xdc%\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 23462 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002704" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 23463 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026f8" } ], "repeated": 0, "id": 23464 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025dc" } ], "repeated": 0, "id": 23465 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002704" } ], "repeated": 0, "id": 23466 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 23467 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 23468 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 23469 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002704" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 23470 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000025dc" } ], "repeated": 0, "id": 23471 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xa0\\xe40\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00`\\xda\\xd9\\xff\\xff\\xff\\xff\\xfff\nGK\\x07\\xef\\xdc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xda\\xd9\\xff\\xff\\xff\\xff\\xffH\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 23472 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026f8" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 23473 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025dc" } ], "repeated": 0, "id": 23474 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002704" } ], "repeated": 0, "id": 23475 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 23476 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 23477 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026f8" } ], "repeated": 0, "id": 23478 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000026f8" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 23479 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002704" } ], "repeated": 0, "id": 23480 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xa0\\xe40\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\xf8&\\x00\\x00\\x00\\x00\\x00\\x00\\xf8&\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x81|}\\x1a\\xff\\x7f\\x00\\x00(\\x8b}\\x1a\\xff\\x7f\\x00\\x00\\xf8&\\x00\\x00\\x00\\x00\\x00\\x00\\xf8&\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x85g}W\\xff\\x7f\\x00\\x00\\xf8&\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 23481 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025dc" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 23482 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002704" } ], "repeated": 0, "id": 23483 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026f8" } ], "repeated": 0, "id": 23484 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025dc" } ], "repeated": 0, "id": 23485 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 23486 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001190" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 23487 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000025dc" }, { "name": "DesiredAccess", "value": "0xc0100080", "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_32.db" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 23488 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000025dc" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_32.db" }, { "name": "FileInformationClass", "value": "74" }, { "name": "FileInformation", "value": "\\x02\\x00\\x00\\x00" } ], "repeated": 0, "id": 23489 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000025dc" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_32.db" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 23490 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000026f8" }, { "name": "DesiredAccess", "value": "0x000f0007", "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_WRITE" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x000025dc" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_32.db" } ], "repeated": 0, "id": 23491 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000025dc" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_32.db" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 23492 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 23493 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 23494 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002704" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 23495 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000025d4" } ], "repeated": 0, "id": 23496 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xa0\\xe50\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00`\\xda\\xd9\\xff\\xff\\xff\\xff\\xfff\nGK\\x07\\xef\\xdc\\x01\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00`\\xda\\xd9\\xff\\xff\\xff\\xff\\xffH\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe8b\\x8b\\x0c\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 23497 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002594" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 23498 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025d4" } ], "repeated": 0, "id": 23499 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002704" } ], "repeated": 0, "id": 23500 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 23501 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 23502 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002594" } ], "repeated": 0, "id": 23503 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002594" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 23504 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002704" } ], "repeated": 0, "id": 23505 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe50\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00@\\xe60\\x01\\x00\\x00\\x00\\x00\\xf0\\x1a\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0fP\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9d|}\\x1a\\xff\\x7f\\x00\\x00(\\x8b}\\x1a\\xff\\x7f\\x00\\x00\\xf0\\x1a\\x00\\x00\\x00\\x00\\x00\\x00\\x98\\xfb\\x1d\\x01\\x00\\x00\\x00\\x00]\\xdd|W\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe8b\\x8b\\x0c\\x00\\x00\\x00\\x00YrD\\x0e\\xea[\\x00\\x00\\x98\\xfb\\x1d\\x01\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 23506 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025d4" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 23507 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002704" } ], "repeated": 0, "id": 23508 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002594" } ], "repeated": 0, "id": 23509 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025d4" } ], "repeated": 0, "id": 23510 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 23511 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000026f8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x13260000" }, { "name": "SectionOffset", "value": "0x0130e5b0" }, { "name": "ViewSize", "value": "0x00100000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 23512 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000025dc" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000025d4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 23513 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002694" } ], "repeated": 0, "id": 23514 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001190" } ], "repeated": 0, "id": 23515 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 23516 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002694" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 23517 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000020d4" } ], "repeated": 0, "id": 23518 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xd0\\xe80\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0094}W\\xff\\x7f\\x00\\x00" } ], "repeated": 0, "id": 23519 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025ac" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 23520 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000020d4" } ], "repeated": 0, "id": 23521 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002694" } ], "repeated": 0, "id": 23522 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 23523 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002278" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\xf0\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xe3\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 23524 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 23525 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025ac" } ], "repeated": 0, "id": 23526 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000025ac" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 23527 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002694" } ], "repeated": 0, "id": 23528 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xe0\\xe80\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9d|}\\x1a\\xff\\x7f\\x00\\x00(\\x8b}\\x1a\\xff\\x7f\\x00\\x00\\xf0\\x1a\\x00\\x00\\x00\\x00\\x00\\x00\\x98\\xfb\\x1d\\x01\\x00\\x00\\x00\\x00]\\xdd|W\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0094}W\\xff\\x7f\\x00\\x00iqD\\x0e\\xea[\\x00\\x00\\x98\\xfb\\x1d\\x01\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 23529 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002594" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 23530 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002694" } ], "repeated": 0, "id": 23531 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025ac" } ], "repeated": 0, "id": 23532 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002594" } ], "repeated": 0, "id": 23533 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 23534 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 23535 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 23536 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002594" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 23537 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000025ac" } ], "repeated": 0, "id": 23538 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xa0\\xea0\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\xab/C\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 23539 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002694" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 23540 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025ac" } ], "repeated": 0, "id": 23541 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002594" } ], "repeated": 0, "id": 23542 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 23543 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002278" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\xf0\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xe3\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 23544 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 23545 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002694" } ], "repeated": 0, "id": 23546 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002694" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 23547 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002594" } ], "repeated": 0, "id": 23548 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xea0\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9d|}\\x1a\\xff\\x7f\\x00\\x00(\\x8b}\\x1a\\xff\\x7f\\x00\\x00\\xf0\\x1a\\x00\\x00\\x00\\x00\\x00\\x00\\x98\\xfb\\x1d\\x01\\x00\\x00\\x00\\x00]\\xdd|W\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00Y\\x7fD\\x0e\\xea[\\x00\\x00\\x98\\xfb\\x1d\\x01\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 23549 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025ac" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 23550 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002594" } ], "repeated": 0, "id": 23551 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002694" } ], "repeated": 0, "id": 23552 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025ac" } ], "repeated": 0, "id": 23553 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 23554 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Discord\\app.ico" } ], "repeated": 1, "id": 23555 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "LoadLibraryExW", "status": false, "return": "0x00000000", "arguments": [ { "name": "lpLibFileName", "value": "c:\\users\\admin\\appdata\\local\\discord\\app.ico" }, { "name": "dwFlags", "value": "0x00000022" } ], "repeated": 0, "id": 23556 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000025ac" }, { "name": "DesiredAccess", "value": "0x80100180", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|FILE_WRITE_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Discord\\app.ico" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 23557 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000025ac" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Discord\\app.ico" }, { "name": "FileInformationClass", "value": "4", "pretty_value": "FileBasicInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 23558 }, { "timestamp": "2026-05-29 01:05:52,102", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000025ac" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Discord\\app.ico" }, { "name": "Buffer", "value": "\\x00\\x00\\x01\\x00\\x04\\x00\\x10\\x10\\x00\\x00\\x01\\x00" }, { "name": "Length", "value": "12" } ], "repeated": 0, "id": 23559 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Discord\\app.ico" } ], "repeated": 0, "id": 23560 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000f84" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Discord\\app.ico" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 23561 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002648" }, { "name": "DesiredAccess", "value": "0x000f0005", "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x00000f84" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Discord\\app.ico" } ], "repeated": 0, "id": 23562 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002648" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x10050000" }, { "name": "SectionOffset", "value": "0x0130cf90" }, { "name": "ViewSize", "value": "0x00046000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 23563 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000f84" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Discord\\app.ico" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00`\\x04\\x00\\x00\\x00\\x00\\x00&[\\x04\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 23564 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x10050000" }, { "name": "RegionSize", "value": "0x00046000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 23565 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002648" } ], "repeated": 0, "id": 23566 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f84" } ], "repeated": 0, "id": 23567 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025ac" } ], "repeated": 0, "id": 23568 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\default\\DataProtection\\EDPShowIcons" }, { "name": "Handle", "value": "0x000025ac" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\DataProtection\\EDPShowIcons" } ], "repeated": 0, "id": 23569 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025ac" }, { "name": "ValueName", "value": "PolicyType" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\DataProtection\\EDPShowIcons\\PolicyType" } ], "repeated": 0, "id": 23570 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025ac" }, { "name": "ValueName", "value": "Behavior" }, { "name": "Data", "value": "298" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\DataProtection\\EDPShowIcons\\Behavior" } ], "repeated": 0, "id": 23571 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025ac" }, { "name": "ValueName", "value": "MergeAlgorithm" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\DataProtection\\EDPShowIcons\\MergeAlgorithm" } ], "repeated": 0, "id": 23572 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000025ac" }, { "name": "ValueName", "value": "RegKeyPathRedirectMapped" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\DataProtection\\EDPShowIcons\\RegKeyPathRedirectMapped" } ], "repeated": 0, "id": 23573 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000025ac" }, { "name": "ValueName", "value": "RegKeyPathRedirect" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\DataProtection\\EDPShowIcons\\RegKeyPathRedirect" } ], "repeated": 0, "id": 23574 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000025ac" }, { "name": "ValueName", "value": "grouppolicyname" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\DataProtection\\EDPShowIcons\\grouppolicyname" } ], "repeated": 0, "id": 23575 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000025ac" }, { "name": "ValueName", "value": "ADMXMetadataUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\DataProtection\\EDPShowIcons\\ADMXMetadataUser" } ], "repeated": 0, "id": 23576 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000025ac" }, { "name": "ValueName", "value": "ADMXMetadataDevice" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\DataProtection\\EDPShowIcons\\ADMXMetadataDevice" } ], "repeated": 0, "id": 23577 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000025ac" }, { "name": "ValueName", "value": "ADMXMetadataBoth" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\DataProtection\\EDPShowIcons\\ADMXMetadataBoth" } ], "repeated": 0, "id": 23578 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000025ac" }, { "name": "ValueName", "value": "30Value" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\DataProtection\\EDPShowIcons\\30Value" } ], "repeated": 0, "id": 23579 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025ac" }, { "name": "ValueName", "value": "Value" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\DataProtection\\EDPShowIcons\\Value" } ], "repeated": 0, "id": 23580 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025ac" } ], "repeated": 0, "id": 23581 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\DataProtection" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\DataProtection" } ], "repeated": 0, "id": 23582 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 23583 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 23584 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000025ac" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 23585 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000f84" } ], "repeated": 0, "id": 23586 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xe40\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00`\\xda\\xd9\\xff\\xff\\xff\\xff\\xff\\xdfmIK\\x07\\xef\\xdc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xda\\xd9\\xff\\xff\\xff\\xff\\xffH\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 23587 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002648" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 23588 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f84" } ], "repeated": 0, "id": 23589 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025ac" } ], "repeated": 0, "id": 23590 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 23591 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 23592 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002648" } ], "repeated": 0, "id": 23593 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002648" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 23594 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000025ac" } ], "repeated": 0, "id": 23595 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "`\\xe40\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\x1a\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00i\\xd5[\\x1a\\xff\\x7f\\x00\\x00 \\xe50\\x01\\x00\\x00\\x00\\x00\\xf0\\x1a\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0fP\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9d|}\\x1a\\xff\\x7f\\x00\\x00(\\x8b}\\x1a\\xff\\x7f\\x00\\x00\\xf0\\x1a\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 23596 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f84" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 23597 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025ac" } ], "repeated": 0, "id": 23598 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002648" } ], "repeated": 0, "id": 23599 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f84" } ], "repeated": 0, "id": 23600 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 23601 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "GetDiskFreeSpaceExW", "status": true, "return": "0x00000001", "arguments": [ { "name": "DirectoryName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" } ], "repeated": 0, "id": 23602 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 23603 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 23604 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000f84" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 23605 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002648" } ], "repeated": 0, "id": 23606 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x00\\xe70\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc7\\xb3\\xf7Y\\xff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xff\\x7f\\x00\\x00IpD\\x0e\\xea[\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\xea0\\x01\\x00\\x00\\x00\\x00\\x80ba\\x07\\x00\\x00\\x00\\x00\\xe0\\x90m\\x07\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\xdd\n\\x05\\xa4\\xff\\xff\\xff\\xff`\\xe80\\x01\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 23607 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025ac" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 23608 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002648" } ], "repeated": 0, "id": 23609 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f84" } ], "repeated": 0, "id": 23610 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 23611 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 23612 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025ac" } ], "repeated": 0, "id": 23613 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000025ac" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 23614 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000f84" } ], "repeated": 0, "id": 23615 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xa0\\xe70\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00 \\xe80\\x01\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x83!,C\\xff\\x7f\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80s\\xad\\x0c\\x00\\x00\\x00\\x00P\\xe80\\x01\\x00\\x00\\x00\\x00f@5X\\xff\\x7f\\x00\\x00\\xdd\n\\x05\\xa4\\xff\\xff\\xff\\xff \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xdd\n\\x05\\xa4\\xff\\xff\\xff\\xff\\xc9\\x1f,C\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xff\\x7f\\x00\\x00" } ], "repeated": 0, "id": 23616 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002648" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 23617 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f84" } ], "repeated": 0, "id": 23618 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025ac" } ], "repeated": 0, "id": 23619 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002648" } ], "repeated": 0, "id": 23620 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 23621 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 23622 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 23623 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002648" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 23624 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000025ac" } ], "repeated": 0, "id": 23625 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x00\\xe70\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc7\\xb3\\xf7Y\\xff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xff\\x7f\\x00\\x00IpD\\x0e\\xea[\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\xea0\\x01\\x00\\x00\\x00\\x00\\x80ba\\x07\\x00\\x00\\x00\\x00\\xe0\\x90m\\x07\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\xdd\n\\x05\\xa4\\xff\\xff\\xff\\xff`\\xe80\\x01\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 23626 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f84" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 23627 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025ac" } ], "repeated": 0, "id": 23628 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002648" } ], "repeated": 0, "id": 23629 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 23630 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 23631 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f84" } ], "repeated": 0, "id": 23632 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000f84" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 23633 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002648" } ], "repeated": 0, "id": 23634 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xa0\\xe70\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00 \\xe80\\x01\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x83!,C\\xff\\x7f\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80s\\xad\\x0c\\x00\\x00\\x00\\x00P\\xe80\\x01\\x00\\x00\\x00\\x00f@5X\\xff\\x7f\\x00\\x00\\xdd\n\\x05\\xa4\\xff\\xff\\xff\\xff \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xdd\n\\x05\\xa4\\xff\\xff\\xff\\xff\\xc9\\x1f,C\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xff\\x7f\\x00\\x00" } ], "repeated": 0, "id": 23635 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025ac" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 23636 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002648" } ], "repeated": 0, "id": 23637 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f84" } ], "repeated": 0, "id": 23638 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025ac" } ], "repeated": 0, "id": 23639 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 23640 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 23641 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 23642 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000025ac" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 23643 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000f84" } ], "repeated": 0, "id": 23644 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x00\\xe70\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc7\\xb3\\xf7Y\\xff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xff\\x7f\\x00\\x00IpD\\x0e\\xea[\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\xea0\\x01\\x00\\x00\\x00\\x00\\x80ba\\x07\\x00\\x00\\x00\\x00\\xe0\\x90m\\x07\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\xdd\n\\x05\\xa4\\xff\\xff\\xff\\xff`\\xe80\\x01\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 23645 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002648" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 23646 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f84" } ], "repeated": 0, "id": 23647 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025ac" } ], "repeated": 0, "id": 23648 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 23649 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 23650 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002648" } ], "repeated": 0, "id": 23651 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002648" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 23652 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000025ac" } ], "repeated": 0, "id": 23653 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xa0\\xe70\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00 \\xe80\\x01\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x83!,C\\xff\\x7f\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80s\\xad\\x0c\\x00\\x00\\x00\\x00P\\xe80\\x01\\x00\\x00\\x00\\x00f@5X\\xff\\x7f\\x00\\x00\\xdd\n\\x05\\xa4\\xff\\xff\\xff\\xff \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xdd\n\\x05\\xa4\\xff\\xff\\xff\\xff\\xc9\\x1f,C\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xff\\x7f\\x00\\x00" } ], "repeated": 0, "id": 23654 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f84" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 23655 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025ac" } ], "repeated": 0, "id": 23656 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002648" } ], "repeated": 0, "id": 23657 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f84" } ], "repeated": 0, "id": 23658 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 23659 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 23660 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 23661 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000f84" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 23662 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002648" } ], "repeated": 0, "id": 23663 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x00\\xe70\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc7\\xb3\\xf7Y\\xff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xff\\x7f\\x00\\x00IpD\\x0e\\xea[\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\xea0\\x01\\x00\\x00\\x00\\x00\\x80ba\\x07\\x00\\x00\\x00\\x00\\xe0\\x90m\\x07\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\xdd\n\\x05\\xa4\\xff\\xff\\xff\\xff`\\xe80\\x01\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 23664 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025ac" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 23665 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002648" } ], "repeated": 0, "id": 23666 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f84" } ], "repeated": 0, "id": 23667 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 23668 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 23669 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025ac" } ], "repeated": 0, "id": 23670 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000025ac" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 23671 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000f84" } ], "repeated": 0, "id": 23672 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xa0\\xe70\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00 \\xe80\\x01\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x83!,C\\xff\\x7f\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80s\\xad\\x0c\\x00\\x00\\x00\\x00P\\xe80\\x01\\x00\\x00\\x00\\x00f@5X\\xff\\x7f\\x00\\x00\\xdd\n\\x05\\xa4\\xff\\xff\\xff\\xff \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xdd\n\\x05\\xa4\\xff\\xff\\xff\\xff\\xc9\\x1f,C\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xff\\x7f\\x00\\x00" } ], "repeated": 0, "id": 23673 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002648" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 23674 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f84" } ], "repeated": 0, "id": 23675 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025ac" } ], "repeated": 0, "id": 23676 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002648" } ], "repeated": 0, "id": 23677 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 23678 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 23679 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 23680 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002648" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 23681 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000025ac" } ], "repeated": 0, "id": 23682 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x00\\xe70\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc7\\xb3\\xf7Y\\xff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xff\\x7f\\x00\\x00IpD\\x0e\\xea[\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\xea0\\x01\\x00\\x00\\x00\\x00\\x80ba\\x07\\x00\\x00\\x00\\x00\\xe0\\x90m\\x07\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\xdd\n\\x05\\xa4\\xff\\xff\\xff\\xff`\\xe80\\x01\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 23683 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f84" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 23684 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025ac" } ], "repeated": 0, "id": 23685 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002648" } ], "repeated": 0, "id": 23686 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 23687 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 23688 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f84" } ], "repeated": 0, "id": 23689 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000f84" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 23690 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002648" } ], "repeated": 0, "id": 23691 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xa0\\xe70\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00 \\xe80\\x01\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x83!,C\\xff\\x7f\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80s\\xad\\x0c\\x00\\x00\\x00\\x00P\\xe80\\x01\\x00\\x00\\x00\\x00f@5X\\xff\\x7f\\x00\\x00\\xdd\n\\x05\\xa4\\xff\\xff\\xff\\xff \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xdd\n\\x05\\xa4\\xff\\xff\\xff\\xff\\xc9\\x1f,C\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xff\\x7f\\x00\\x00" } ], "repeated": 0, "id": 23692 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025ac" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 23693 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002648" } ], "repeated": 0, "id": 23694 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f84" } ], "repeated": 0, "id": 23695 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025ac" } ], "repeated": 0, "id": 23696 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 23697 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 23698 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 23699 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000025ac" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 23700 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000f84" } ], "repeated": 0, "id": 23701 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x00\\xe70\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc7\\xb3\\xf7Y\\xff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xff\\x7f\\x00\\x00IpD\\x0e\\xea[\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\xea0\\x01\\x00\\x00\\x00\\x00\\x80ba\\x07\\x00\\x00\\x00\\x00\\xe0\\x90m\\x07\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\xdd\n\\x05\\xa4\\xff\\xff\\xff\\xff`\\xe80\\x01\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 23702 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002648" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 23703 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f84" } ], "repeated": 0, "id": 23704 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025ac" } ], "repeated": 0, "id": 23705 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 23706 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 23707 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002648" } ], "repeated": 0, "id": 23708 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002648" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 23709 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000025ac" } ], "repeated": 0, "id": 23710 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xa0\\xe70\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00 \\xe80\\x01\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x83!,C\\xff\\x7f\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80s\\xad\\x0c\\x00\\x00\\x00\\x00P\\xe80\\x01\\x00\\x00\\x00\\x00f@5X\\xff\\x7f\\x00\\x00\\xdd\n\\x05\\xa4\\xff\\xff\\xff\\xff \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xdd\n\\x05\\xa4\\xff\\xff\\xff\\xff\\xc9\\x1f,C\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xff\\x7f\\x00\\x00" } ], "repeated": 0, "id": 23711 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f84" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 23712 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025ac" } ], "repeated": 0, "id": 23713 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002648" } ], "repeated": 0, "id": 23714 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f84" } ], "repeated": 0, "id": 23715 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 23716 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 23717 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 23718 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000f84" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 23719 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002648" } ], "repeated": 0, "id": 23720 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x00\\xe70\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc7\\xb3\\xf7Y\\xff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xff\\x7f\\x00\\x00IpD\\x0e\\xea[\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\xea0\\x01\\x00\\x00\\x00\\x00\\x80ba\\x07\\x00\\x00\\x00\\x00\\xe0\\x90m\\x07\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\xdd\n\\x05\\xa4\\xff\\xff\\xff\\xff`\\xe80\\x01\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 23721 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025ac" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 23722 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002648" } ], "repeated": 0, "id": 23723 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f84" } ], "repeated": 0, "id": 23724 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 23725 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 23726 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025ac" } ], "repeated": 0, "id": 23727 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000025ac" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 23728 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000f84" } ], "repeated": 0, "id": 23729 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xa0\\xe70\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00 \\xe80\\x01\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x83!,C\\xff\\x7f\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80s\\xad\\x0c\\x00\\x00\\x00\\x00P\\xe80\\x01\\x00\\x00\\x00\\x00f@5X\\xff\\x7f\\x00\\x00\\xdd\n\\x05\\xa4\\xff\\xff\\xff\\xff \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xdd\n\\x05\\xa4\\xff\\xff\\xff\\xff\\xc9\\x1f,C\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xff\\x7f\\x00\\x00" } ], "repeated": 0, "id": 23730 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002648" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 23731 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f84" } ], "repeated": 0, "id": 23732 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025ac" } ], "repeated": 0, "id": 23733 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002648" } ], "repeated": 0, "id": 23734 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 23735 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 23736 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 23737 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002648" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 23738 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000025ac" } ], "repeated": 0, "id": 23739 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x00\\xe70\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc7\\xb3\\xf7Y\\xff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xff\\x7f\\x00\\x00IpD\\x0e\\xea[\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\xea0\\x01\\x00\\x00\\x00\\x00\\x80ba\\x07\\x00\\x00\\x00\\x00\\xe0\\x90m\\x07\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\xdd\n\\x05\\xa4\\xff\\xff\\xff\\xff`\\xe80\\x01\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 23740 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f84" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 23741 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025ac" } ], "repeated": 0, "id": 23742 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002648" } ], "repeated": 0, "id": 23743 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 23744 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 23745 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f84" } ], "repeated": 0, "id": 23746 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000f84" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 23747 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002648" } ], "repeated": 0, "id": 23748 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xa0\\xe70\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00 \\xe80\\x01\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x83!,C\\xff\\x7f\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80s\\xad\\x0c\\x00\\x00\\x00\\x00P\\xe80\\x01\\x00\\x00\\x00\\x00f@5X\\xff\\x7f\\x00\\x00\\xdd\n\\x05\\xa4\\xff\\xff\\xff\\xff \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xdd\n\\x05\\xa4\\xff\\xff\\xff\\xff\\xc9\\x1f,C\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xff\\x7f\\x00\\x00" } ], "repeated": 0, "id": 23749 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025ac" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 23750 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002648" } ], "repeated": 0, "id": 23751 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f84" } ], "repeated": 0, "id": 23752 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025ac" } ], "repeated": 0, "id": 23753 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 23754 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 23755 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 23756 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000025ac" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 23757 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000f84" } ], "repeated": 0, "id": 23758 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x00\\xe70\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc7\\xb3\\xf7Y\\xff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xff\\x7f\\x00\\x00IpD\\x0e\\xea[\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\xea0\\x01\\x00\\x00\\x00\\x00\\x80ba\\x07\\x00\\x00\\x00\\x00\\xe0\\x90m\\x07\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\xdd\n\\x05\\xa4\\xff\\xff\\xff\\xff`\\xe80\\x01\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 23759 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002648" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 23760 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f84" } ], "repeated": 0, "id": 23761 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025ac" } ], "repeated": 0, "id": 23762 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 23763 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 23764 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002648" } ], "repeated": 0, "id": 23765 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002648" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 23766 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000025ac" } ], "repeated": 0, "id": 23767 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xa0\\xe70\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00 \\xe80\\x01\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x83!,C\\xff\\x7f\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80s\\xad\\x0c\\x00\\x00\\x00\\x00P\\xe80\\x01\\x00\\x00\\x00\\x00f@5X\\xff\\x7f\\x00\\x00\\xdd\n\\x05\\xa4\\xff\\xff\\xff\\xff \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xdd\n\\x05\\xa4\\xff\\xff\\xff\\xff\\xc9\\x1f,C\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xff\\x7f\\x00\\x00" } ], "repeated": 0, "id": 23768 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f84" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 23769 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025ac" } ], "repeated": 0, "id": 23770 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002648" } ], "repeated": 0, "id": 23771 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f84" } ], "repeated": 0, "id": 23772 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 23773 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 23774 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 23775 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000f84" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 23776 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002648" } ], "repeated": 0, "id": 23777 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x00\\xe70\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc7\\xb3\\xf7Y\\xff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xff\\x7f\\x00\\x00IpD\\x0e\\xea[\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\xea0\\x01\\x00\\x00\\x00\\x00\\x80ba\\x07\\x00\\x00\\x00\\x00\\xe0\\x90m\\x07\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\xdd\n\\x05\\xa4\\xff\\xff\\xff\\xff`\\xe80\\x01\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 23778 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025ac" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 23779 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002648" } ], "repeated": 0, "id": 23780 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f84" } ], "repeated": 0, "id": 23781 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 23782 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 23783 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025ac" } ], "repeated": 0, "id": 23784 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000025ac" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 23785 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000f84" } ], "repeated": 0, "id": 23786 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xa0\\xe70\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00 \\xe80\\x01\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x83!,C\\xff\\x7f\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80s\\xad\\x0c\\x00\\x00\\x00\\x00P\\xe80\\x01\\x00\\x00\\x00\\x00f@5X\\xff\\x7f\\x00\\x00\\xdd\n\\x05\\xa4\\xff\\xff\\xff\\xff \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xdd\n\\x05\\xa4\\xff\\xff\\xff\\xff\\xc9\\x1f,C\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xff\\x7f\\x00\\x00" } ], "repeated": 0, "id": 23787 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002648" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 23788 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f84" } ], "repeated": 0, "id": 23789 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025ac" } ], "repeated": 0, "id": 23790 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002648" } ], "repeated": 0, "id": 23791 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 23792 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 23793 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 23794 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002648" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 23795 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000025ac" } ], "repeated": 0, "id": 23796 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x00\\xe70\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc7\\xb3\\xf7Y\\xff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xff\\x7f\\x00\\x00IpD\\x0e\\xea[\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\xea0\\x01\\x00\\x00\\x00\\x00\\x80ba\\x07\\x00\\x00\\x00\\x00\\xe0\\x90m\\x07\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\xdd\n\\x05\\xa4\\xff\\xff\\xff\\xff`\\xe80\\x01\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 23797 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f84" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 23798 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025ac" } ], "repeated": 0, "id": 23799 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002648" } ], "repeated": 0, "id": 23800 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 23801 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 23802 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f84" } ], "repeated": 0, "id": 23803 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000f84" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 23804 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002648" } ], "repeated": 0, "id": 23805 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xa0\\xe70\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00 \\xe80\\x01\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x83!,C\\xff\\x7f\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80s\\xad\\x0c\\x00\\x00\\x00\\x00P\\xe80\\x01\\x00\\x00\\x00\\x00f@5X\\xff\\x7f\\x00\\x00\\xdd\n\\x05\\xa4\\xff\\xff\\xff\\xff \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xdd\n\\x05\\xa4\\xff\\xff\\xff\\xff\\xc9\\x1f,C\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xff\\x7f\\x00\\x00" } ], "repeated": 0, "id": 23806 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025ac" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 23807 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002648" } ], "repeated": 0, "id": 23808 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f84" } ], "repeated": 0, "id": 23809 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025ac" } ], "repeated": 0, "id": 23810 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 23811 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 23812 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 23813 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000025ac" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 23814 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000f84" } ], "repeated": 0, "id": 23815 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x00\\xe70\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc7\\xb3\\xf7Y\\xff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xff\\x7f\\x00\\x00IpD\\x0e\\xea[\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\xea0\\x01\\x00\\x00\\x00\\x00\\x80ba\\x07\\x00\\x00\\x00\\x00\\xe0\\x90m\\x07\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\xdd\n\\x05\\xa4\\xff\\xff\\xff\\xff`\\xe80\\x01\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 23816 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002648" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 23817 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f84" } ], "repeated": 0, "id": 23818 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025ac" } ], "repeated": 0, "id": 23819 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 23820 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 23821 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002648" } ], "repeated": 0, "id": 23822 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002648" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 23823 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000025ac" } ], "repeated": 0, "id": 23824 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xa0\\xe70\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00 \\xe80\\x01\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x83!,C\\xff\\x7f\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80s\\xad\\x0c\\x00\\x00\\x00\\x00P\\xe80\\x01\\x00\\x00\\x00\\x00f@5X\\xff\\x7f\\x00\\x00\\xdd\n\\x05\\xa4\\xff\\xff\\xff\\xff \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xdd\n\\x05\\xa4\\xff\\xff\\xff\\xff\\xc9\\x1f,C\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xff\\x7f\\x00\\x00" } ], "repeated": 0, "id": 23825 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f84" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 23826 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025ac" } ], "repeated": 0, "id": 23827 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002648" } ], "repeated": 0, "id": 23828 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f84" } ], "repeated": 0, "id": 23829 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 23830 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 23831 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 23832 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000f84" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 23833 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002648" } ], "repeated": 0, "id": 23834 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x00\\xe70\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc7\\xb3\\xf7Y\\xff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xff\\x7f\\x00\\x00IpD\\x0e\\xea[\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\xea0\\x01\\x00\\x00\\x00\\x00\\x80ba\\x07\\x00\\x00\\x00\\x00\\xe0\\x90m\\x07\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\xdd\n\\x05\\xa4\\xff\\xff\\xff\\xff`\\xe80\\x01\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 23835 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025ac" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 23836 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002648" } ], "repeated": 0, "id": 23837 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f84" } ], "repeated": 0, "id": 23838 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 23839 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 23840 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025ac" } ], "repeated": 0, "id": 23841 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000025ac" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 23842 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000f84" } ], "repeated": 0, "id": 23843 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xa0\\xe70\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00 \\xe80\\x01\\x00\\x00\\x00\\x00\\xc3\\xb8dW\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x83!,C\\xff\\x7f\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80s\\xad\\x0c\\x00\\x00\\x00\\x00P\\xe80\\x01\\x00\\x00\\x00\\x00f@5X\\xff\\x7f\\x00\\x00\\xdd\n\\x05\\xa4\\xff\\xff\\xff\\xff \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xdd\n\\x05\\xa4\\xff\\xff\\xff\\xff\\xc9\\x1f,C\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xff\\x7f\\x00\\x00" } ], "repeated": 0, "id": 23844 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002648" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 23845 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f84" } ], "repeated": 0, "id": 23846 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025ac" } ], "repeated": 0, "id": 23847 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002648" } ], "repeated": 0, "id": 23848 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 23849 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002278" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\xf0\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xe3\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 23850 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 23851 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 23852 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002648" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 23853 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000025ac" } ], "repeated": 0, "id": 23854 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "0\\xe40\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00`\\xda\\xd9\\xff\\xff\\xff\\xff\\xff\\xdfmIK\\x07\\xef\\xdc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xda\\xd9\\xff\\xff\\xff\\xff\\xffH\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\x1a\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 23855 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f84" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 23856 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025ac" } ], "repeated": 0, "id": 23857 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002648" } ], "repeated": 0, "id": 23858 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 23859 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 23860 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f84" } ], "repeated": 0, "id": 23861 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000f84" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 23862 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002648" } ], "repeated": 0, "id": 23863 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "0\\xe40\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x84\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x84\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x81|}\\x1a\\xff\\x7f\\x00\\x00(\\x8b}\\x1a\\xff\\x7f\\x00\\x00\\x84\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x84\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x85g}W\\xff\\x7f\\x00\\x00\\x84\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 23864 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025ac" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 23865 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002648" } ], "repeated": 0, "id": 23866 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f84" } ], "repeated": 0, "id": 23867 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025ac" } ], "repeated": 0, "id": 23868 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 23869 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "317D06E8-5F24-433D-BDF7-79CE68D8ABC2" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EC5EC8A9-C395-4314-9C77-54D7A935FF70" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 23870 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001190" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 23871 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000025dc" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_32.db" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 23872 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 23873 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000025ac" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 23874 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000f84" } ], "repeated": 0, "id": 23875 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "p\\xe50\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x06\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x06\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xf7\\x8b\\x10\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xdc%\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 23876 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002648" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 23877 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f84" } ], "repeated": 0, "id": 23878 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025ac" } ], "repeated": 0, "id": 23879 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002648" } ], "repeated": 0, "id": 23880 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002278" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\xf0\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xe3\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 23881 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 23882 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000025dc" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_32.db" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 23883 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001190" } ], "repeated": 0, "id": 23884 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002648" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 23885 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000025ac" } ], "repeated": 0, "id": 23886 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "@\\xe80\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00x\\xe90\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00C\\x10,C\\xff\\x7f\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb8\\xac,C\\xff\\x7f\\x00\\x00\\x80s\\xad\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\xea0\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x80s\\xad\\x0c\\x00\\x00\\x00\\x00\\xe7\\xab,C\\xff\\x7f\\x00\\x00\\x80s\\xad\\x0c\\x00\\x00\\x00\\x009~D\\x0e\\xea[\\x00\\x00" } ], "repeated": 0, "id": 23887 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f84" }, { "name": "MutexName", "value": "" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 23888 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025ac" } ], "repeated": 0, "id": 23889 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002648" } ], "repeated": 0, "id": 23890 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f84" } ], "repeated": 0, "id": 23891 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7ff79bc51f68", "parentcaller": "0x7ff79bc90020", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000100c4" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 1, "id": 23892 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xfe\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\t\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2440" } ], "repeated": 0, "id": 23893 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432be00e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000248c" } ], "repeated": 0, "id": 23894 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff432beb8c", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x13260000" }, { "name": "RegionSize", "value": "0x00100000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 23895 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432beba1", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026f8" } ], "repeated": 0, "id": 23896 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432be04f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025dc" } ], "repeated": 0, "id": 23897 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc686b4", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 23898 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xe2\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x005\\x18\\xff\\x7f\\x00\\x00(\\xe3\\\\x03\\x00\\x00\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 23899 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000020d4" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 23900 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "4696", "caller": "0x7ff79bc8a418", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000020d4" } ], "repeated": 0, "id": 23901 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432be00e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001190" } ], "repeated": 0, "id": 23902 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432be00e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001e68" } ], "repeated": 0, "id": 23903 }, { "timestamp": "2026-05-29 01:05:52,118", "thread_id": "2440", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432be00e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002630" } ], "repeated": 0, "id": 23904 }, { "timestamp": "2026-05-29 01:05:52,133", "thread_id": "2440", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432be00e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026b8" } ], "repeated": 0, "id": 23905 }, { "timestamp": "2026-05-29 01:05:52,133", "thread_id": "2440", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432be00e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025f0" } ], "repeated": 0, "id": 23906 }, { "timestamp": "2026-05-29 01:05:52,133", "thread_id": "2440", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432be00e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002600" } ], "repeated": 0, "id": 23907 }, { "timestamp": "2026-05-29 01:05:52,133", "thread_id": "2440", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432be00e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026b4" } ], "repeated": 0, "id": 23908 }, { "timestamp": "2026-05-29 01:05:52,133", "thread_id": "2440", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432be00e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026cc" } ], "repeated": 0, "id": 23909 }, { "timestamp": "2026-05-29 01:05:52,133", "thread_id": "2440", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432be00e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026d0" } ], "repeated": 0, "id": 23910 }, { "timestamp": "2026-05-29 01:05:52,133", "thread_id": "2440", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432be00e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026d4" } ], "repeated": 0, "id": 23911 }, { "timestamp": "2026-05-29 01:05:52,133", "thread_id": "2440", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432be00e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026d8" } ], "repeated": 0, "id": 23912 }, { "timestamp": "2026-05-29 01:05:52,133", "thread_id": "2440", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432be00e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002688" } ], "repeated": 0, "id": 23913 }, { "timestamp": "2026-05-29 01:05:52,133", "thread_id": "2440", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432be00e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000267c" } ], "repeated": 0, "id": 23914 }, { "timestamp": "2026-05-29 01:05:52,133", "thread_id": "2440", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432c3396", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002278" } ], "repeated": 0, "id": 23915 }, { "timestamp": "2026-05-29 01:05:52,133", "thread_id": "2440", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff432c33a9", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09fd0000" }, { "name": "RegionSize", "value": "0x0000f000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 23916 }, { "timestamp": "2026-05-29 01:05:52,133", "thread_id": "2440", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432c3c47", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 23917 }, { "timestamp": "2026-05-29 01:05:52,133", "thread_id": "2440", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432c3c5c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002520" } ], "repeated": 0, "id": 23918 }, { "timestamp": "2026-05-29 01:05:52,133", "thread_id": "2440", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432c3d86", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 23919 }, { "timestamp": "2026-05-29 01:05:52,133", "thread_id": "2440", "caller": "0x7fff5582a695", "parentcaller": "0x7fff5582a024", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002634" } ], "repeated": 0, "id": 23920 }, { "timestamp": "2026-05-29 01:05:52,133", "thread_id": "2440", "caller": "0x7fff577ce76a", "parentcaller": "0x7fff584cea0e", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "oleaut32.dll" }, { "name": "ModuleHandle", "value": "0x7fff58860000" } ], "repeated": 0, "id": 23921 }, { "timestamp": "2026-05-29 01:05:52,133", "thread_id": "2440", "caller": "0x7fff5809b283", "parentcaller": "0x7fff58088b47", "category": "windows", "api": "PostThreadMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessId", "value": "4484" }, { "name": "ThreadId", "value": "4488" }, { "name": "Message", "value": "0" } ], "repeated": 1, "id": 23922 }, { "timestamp": "2026-05-29 01:05:52,133", "thread_id": "2440", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5809da8f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" } ], "repeated": 0, "id": 23923 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 23924 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff432c5ded", "parentcaller": "0x7fff432c56be", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "AB8902B4-09CA-4BB6-B78D-A8F59079A8D5" }, { "name": "ClsContext", "value": "0x00004004", "pretty_value": "CLSCTX_LOCAL_SERVER|CLSCTX_NO_FAILURE_LOG" }, { "name": "riid", "value": "75121952-E0D0-43E5-9380-1D80483ACF72" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 23925 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff432c5d25", "parentcaller": "0x7fff432c56d1", "category": "system", "api": "CreateTimerQueueTimer", "status": true, "return": "0x00000001", "arguments": [ { "name": "phNewTimer", "value": "0x0cad5800" }, { "name": "TimerQueue", "value": "0x00000000" }, { "name": "Callback", "value": "0x432ed350" }, { "name": "Parameter", "value": "0x0943e820" }, { "name": "DueTime", "value": "60000" }, { "name": "Period", "value": "1000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 23926 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff5587d014", "parentcaller": "0x7fff558252c1", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "CLSID\\{645FF040-5081-101B-9F08-00AA002F954E}\\Instance" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\CLSID\\{645FF040-5081-101B-9F08-00AA002F954E}\\Instance" } ], "repeated": 0, "id": 23927 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 23928 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff58be0000", "arguments": [ { "name": "lpLibFileName", "value": "shell32.dll" }, { "name": "dwFlags", "value": "0x00004000" } ], "repeated": 0, "id": 23929 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577dac31", "parentcaller": "0x7fff558258ff", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "SHELL32.dll" }, { "name": "ModuleHandle", "value": "0x7fff58be0000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff58c378f0" } ], "repeated": 0, "id": 23930 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff5587d014", "parentcaller": "0x7fff558252c1", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "CLSID\\{4A04656D-52AA-49DE-8A09-CB178760E748}\\Instance" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\CLSID\\{4A04656D-52AA-49DE-8A09-CB178760E748}\\Instance" } ], "repeated": 0, "id": 23931 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 23932 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff58be0000", "arguments": [ { "name": "lpLibFileName", "value": "shell32.dll" }, { "name": "dwFlags", "value": "0x00004000" } ], "repeated": 0, "id": 23933 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577dac31", "parentcaller": "0x7fff558258ff", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "SHELL32.dll" }, { "name": "ModuleHandle", "value": "0x7fff58be0000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff58c378f0" } ], "repeated": 0, "id": 23934 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff597a1630", "parentcaller": "0x7fff597a12cd", "category": "system", "api": "NtQuerySystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 23935 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff59f93f7a", "parentcaller": "0x7fff59770ed7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 23936 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 23937 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000fc4" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 23938 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432cbf4b", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 23939 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff432c690b", "parentcaller": "0x7fff432b67f7", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" }, { "name": "Handle", "value": "0x000026ac" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" } ], "repeated": 0, "id": 23940 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff432c6964", "parentcaller": "0x7fff432b67f7", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000026ac" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 23941 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff432c6990", "parentcaller": "0x7fff432b67f7", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 23942 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432baa24", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 23943 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432baa24", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000010a4" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 23944 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bc79b", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000026ac" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 23945 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bc7ca", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002614" } ], "repeated": 0, "id": 23946 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bc7fe", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xf0\\xe4C\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00`\\xda\\xd9\\xff\\xff\\xff\\xff\\xff\\xea4NK\\x07\\xef\\xdc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xda\\xd9\\xff\\xff\\xff\\xff\\xffH\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 23947 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bc8d0", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002634" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 23948 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8e4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" } ], "repeated": 0, "id": 23949 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 23950 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432baa73", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000010a4" } ], "repeated": 0, "id": 23951 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432b9503", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000010a4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 23952 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b953e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002634" } ], "repeated": 0, "id": 23953 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432b95a7", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002634" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 23954 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432b95d8", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000026ac" } ], "repeated": 0, "id": 23955 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432b9610", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xd0\\xe4C\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa4\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00i\\xd5[\\x1a\\xff\\x7f\\x00\\x00\\x90\\xe5C\t\\x00\\x00\\x00\\x00\\xa4\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0fP\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9d|}\\x1a\\xff\\x7f\\x00\\x00(\\x8b}\\x1a\\xff\\x7f\\x00\\x00\\xa4\\x10\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 23956 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432b96e3", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 23957 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b96f7", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 23958 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b9706", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002634" } ], "repeated": 0, "id": 23959 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b9732", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" } ], "repeated": 0, "id": 23960 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432b9779", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000010a4" } ], "repeated": 0, "id": 23961 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff432b9455", "parentcaller": "0x7fff432baae3", "category": "filesystem", "api": "GetDiskFreeSpaceExW", "status": true, "return": "0x00000001", "arguments": [ { "name": "DirectoryName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" } ], "repeated": 0, "id": 23962 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 23963 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000010a4" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 23964 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002614" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 23965 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002634" } ], "repeated": 0, "id": 23966 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "p\\xe7C\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xeaC\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xebC\t\\x00\\x00\\x00\\x00pgm\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\xf0C\t\\x00\\x00\\x00\\x00\\xe8\\xe9C\t\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xeaC\t\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 23967 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 23968 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002634" } ], "repeated": 0, "id": 23969 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" } ], "repeated": 0, "id": 23970 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000010a4" } ], "repeated": 0, "id": 23971 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000010a4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 23972 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 23973 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000026ac" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 23974 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002614" } ], "repeated": 0, "id": 23975 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x10\\xe8C\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xac&\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\xd8\\x0eIs^t\\x00\\x00pgm\\x07\\x00\\x00\\x00\\x00@\\xebC\t\\x00\\x00\\x00\\x00pgm\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\xf0C\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 23976 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002634" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 23977 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" } ], "repeated": 0, "id": 23978 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 23979 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002634" } ], "repeated": 0, "id": 23980 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000010a4" } ], "repeated": 0, "id": 23981 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 23982 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000010a4" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 23983 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002634" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 23984 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000026ac" } ], "repeated": 0, "id": 23985 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "p\\xe7C\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xeaC\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xebC\t\\x00\\x00\\x00\\x00pgm\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\xf0C\t\\x00\\x00\\x00\\x00\\xe8\\xe9C\t\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xeaC\t\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 23986 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 23987 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 23988 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002634" } ], "repeated": 0, "id": 23989 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000010a4" } ], "repeated": 0, "id": 23990 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000010a4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 23991 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" } ], "repeated": 0, "id": 23992 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002614" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 23993 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002634" } ], "repeated": 0, "id": 23994 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x10\\xe8C\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xac&\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\xd8\\x0eIs^t\\x00\\x00pgm\\x07\\x00\\x00\\x00\\x00@\\xebC\t\\x00\\x00\\x00\\x00pgm\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\xf0C\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 23995 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 23996 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002634" } ], "repeated": 0, "id": 23997 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" } ], "repeated": 0, "id": 23998 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 23999 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000010a4" } ], "repeated": 0, "id": 24000 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 24001 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000010a4" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 24002 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000026ac" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 24003 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002614" } ], "repeated": 0, "id": 24004 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "p\\xe7C\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xeaC\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xebC\t\\x00\\x00\\x00\\x00pgm\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\xf0C\t\\x00\\x00\\x00\\x00\\xe8\\xe9C\t\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xeaC\t\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 24005 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002634" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 24006 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" } ], "repeated": 0, "id": 24007 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 24008 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000010a4" } ], "repeated": 0, "id": 24009 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000010a4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 24010 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002634" } ], "repeated": 0, "id": 24011 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002634" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 24012 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000026ac" } ], "repeated": 0, "id": 24013 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x10\\xe8C\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xac&\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\xd8\\x0eIs^t\\x00\\x00pgm\\x07\\x00\\x00\\x00\\x00@\\xebC\t\\x00\\x00\\x00\\x00pgm\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\xf0C\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 24014 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 24015 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 24016 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002634" } ], "repeated": 0, "id": 24017 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" } ], "repeated": 0, "id": 24018 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000010a4" } ], "repeated": 0, "id": 24019 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 24020 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000010a4" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 24021 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002614" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 24022 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002634" } ], "repeated": 0, "id": 24023 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "p\\xe7C\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xeaC\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xebC\t\\x00\\x00\\x00\\x00pgm\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\xf0C\t\\x00\\x00\\x00\\x00\\xe8\\xe9C\t\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xeaC\t\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 24024 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 24025 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002634" } ], "repeated": 0, "id": 24026 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" } ], "repeated": 0, "id": 24027 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000010a4" } ], "repeated": 0, "id": 24028 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000010a4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 24029 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 24030 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000026ac" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 24031 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002614" } ], "repeated": 0, "id": 24032 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x10\\xe8C\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xac&\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\xd8\\x0eIs^t\\x00\\x00pgm\\x07\\x00\\x00\\x00\\x00@\\xebC\t\\x00\\x00\\x00\\x00pgm\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\xf0C\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 24033 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002634" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 24034 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" } ], "repeated": 0, "id": 24035 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 24036 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002634" } ], "repeated": 0, "id": 24037 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000010a4" } ], "repeated": 0, "id": 24038 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 24039 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000010a4" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 24040 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002634" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 24041 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000026ac" } ], "repeated": 0, "id": 24042 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "p\\xe7C\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xeaC\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xebC\t\\x00\\x00\\x00\\x00pgm\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\xf0C\t\\x00\\x00\\x00\\x00\\xe8\\xe9C\t\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xeaC\t\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 24043 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 24044 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 24045 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002634" } ], "repeated": 0, "id": 24046 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000010a4" } ], "repeated": 0, "id": 24047 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000010a4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 24048 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" } ], "repeated": 0, "id": 24049 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002614" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 24050 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002634" } ], "repeated": 0, "id": 24051 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x10\\xe8C\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xac&\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\xd8\\x0eIs^t\\x00\\x00pgm\\x07\\x00\\x00\\x00\\x00@\\xebC\t\\x00\\x00\\x00\\x00pgm\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\xf0C\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 24052 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 24053 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002634" } ], "repeated": 0, "id": 24054 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" } ], "repeated": 0, "id": 24055 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 24056 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000010a4" } ], "repeated": 0, "id": 24057 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 24058 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000010a4" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 24059 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000026ac" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 24060 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002614" } ], "repeated": 0, "id": 24061 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "p\\xe7C\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xeaC\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xebC\t\\x00\\x00\\x00\\x00pgm\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\xf0C\t\\x00\\x00\\x00\\x00\\xe8\\xe9C\t\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xeaC\t\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 24062 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002634" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 24063 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" } ], "repeated": 0, "id": 24064 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 24065 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000010a4" } ], "repeated": 0, "id": 24066 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000010a4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 24067 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002634" } ], "repeated": 0, "id": 24068 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002634" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 24069 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000026ac" } ], "repeated": 0, "id": 24070 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x10\\xe8C\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xac&\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\xd8\\x0eIs^t\\x00\\x00pgm\\x07\\x00\\x00\\x00\\x00@\\xebC\t\\x00\\x00\\x00\\x00pgm\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\xf0C\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 24071 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 24072 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 24073 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002634" } ], "repeated": 0, "id": 24074 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" } ], "repeated": 0, "id": 24075 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000010a4" } ], "repeated": 0, "id": 24076 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 24077 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000010a4" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 24078 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002614" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 24079 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002634" } ], "repeated": 0, "id": 24080 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "p\\xe7C\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xeaC\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xebC\t\\x00\\x00\\x00\\x00pgm\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\xf0C\t\\x00\\x00\\x00\\x00\\xe8\\xe9C\t\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xeaC\t\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 24081 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 24082 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002634" } ], "repeated": 0, "id": 24083 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" } ], "repeated": 0, "id": 24084 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000010a4" } ], "repeated": 0, "id": 24085 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000010a4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 24086 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 24087 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000026ac" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 24088 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002614" } ], "repeated": 0, "id": 24089 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x10\\xe8C\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xac&\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\xd8\\x0eIs^t\\x00\\x00pgm\\x07\\x00\\x00\\x00\\x00@\\xebC\t\\x00\\x00\\x00\\x00pgm\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\xf0C\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 24090 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002634" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 24091 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" } ], "repeated": 0, "id": 24092 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 24093 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002634" } ], "repeated": 0, "id": 24094 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000010a4" } ], "repeated": 0, "id": 24095 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 24096 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000010a4" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 24097 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002634" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 24098 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000026ac" } ], "repeated": 0, "id": 24099 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "p\\xe7C\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xeaC\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xebC\t\\x00\\x00\\x00\\x00pgm\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\xf0C\t\\x00\\x00\\x00\\x00\\xe8\\xe9C\t\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xeaC\t\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 24100 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 24101 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 24102 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002634" } ], "repeated": 0, "id": 24103 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000010a4" } ], "repeated": 0, "id": 24104 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000010a4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 24105 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" } ], "repeated": 0, "id": 24106 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002614" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 24107 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002634" } ], "repeated": 0, "id": 24108 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x10\\xe8C\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xac&\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\xd8\\x0eIs^t\\x00\\x00pgm\\x07\\x00\\x00\\x00\\x00@\\xebC\t\\x00\\x00\\x00\\x00pgm\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\xf0C\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 24109 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 24110 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002634" } ], "repeated": 0, "id": 24111 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" } ], "repeated": 0, "id": 24112 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 24113 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000010a4" } ], "repeated": 0, "id": 24114 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 24115 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000010a4" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 24116 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000026ac" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 24117 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002614" } ], "repeated": 0, "id": 24118 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "p\\xe7C\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xeaC\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xebC\t\\x00\\x00\\x00\\x00pgm\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\xf0C\t\\x00\\x00\\x00\\x00\\xe8\\xe9C\t\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xeaC\t\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 24119 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002634" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 24120 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" } ], "repeated": 0, "id": 24121 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 24122 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000010a4" } ], "repeated": 0, "id": 24123 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000010a4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 24124 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002634" } ], "repeated": 0, "id": 24125 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002634" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 24126 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000026ac" } ], "repeated": 0, "id": 24127 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x10\\xe8C\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xac&\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\xd8\\x0eIs^t\\x00\\x00pgm\\x07\\x00\\x00\\x00\\x00@\\xebC\t\\x00\\x00\\x00\\x00pgm\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\xf0C\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 24128 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 24129 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 24130 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002634" } ], "repeated": 0, "id": 24131 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" } ], "repeated": 0, "id": 24132 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000010a4" } ], "repeated": 0, "id": 24133 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 24134 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000010a4" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 24135 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002614" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 24136 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002634" } ], "repeated": 0, "id": 24137 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "p\\xe7C\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xeaC\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xebC\t\\x00\\x00\\x00\\x00pgm\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\xf0C\t\\x00\\x00\\x00\\x00\\xe8\\xe9C\t\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xeaC\t\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 24138 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 24139 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002634" } ], "repeated": 0, "id": 24140 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" } ], "repeated": 0, "id": 24141 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000010a4" } ], "repeated": 0, "id": 24142 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000010a4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 24143 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 24144 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000026ac" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 24145 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002614" } ], "repeated": 0, "id": 24146 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x10\\xe8C\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xac&\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\xd8\\x0eIs^t\\x00\\x00pgm\\x07\\x00\\x00\\x00\\x00@\\xebC\t\\x00\\x00\\x00\\x00pgm\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\xf0C\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 24147 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002634" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 24148 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" } ], "repeated": 0, "id": 24149 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 24150 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002634" } ], "repeated": 0, "id": 24151 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000010a4" } ], "repeated": 0, "id": 24152 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 24153 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000010a4" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 24154 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002634" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 24155 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000026ac" } ], "repeated": 0, "id": 24156 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "p\\xe7C\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xeaC\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xebC\t\\x00\\x00\\x00\\x00pgm\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\xf0C\t\\x00\\x00\\x00\\x00\\xe8\\xe9C\t\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xeaC\t\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 24157 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 24158 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 24159 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002634" } ], "repeated": 0, "id": 24160 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000010a4" } ], "repeated": 0, "id": 24161 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000010a4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 24162 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" } ], "repeated": 0, "id": 24163 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002614" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 24164 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002634" } ], "repeated": 0, "id": 24165 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x10\\xe8C\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xac&\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\xd8\\x0eIs^t\\x00\\x00pgm\\x07\\x00\\x00\\x00\\x00@\\xebC\t\\x00\\x00\\x00\\x00pgm\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\xf0C\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 24166 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 24167 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002634" } ], "repeated": 0, "id": 24168 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" } ], "repeated": 0, "id": 24169 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 24170 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000010a4" } ], "repeated": 0, "id": 24171 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 24172 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000010a4" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 24173 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000026ac" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 24174 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002614" } ], "repeated": 0, "id": 24175 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "p\\xe7C\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xeaC\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xebC\t\\x00\\x00\\x00\\x00pgm\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\xf0C\t\\x00\\x00\\x00\\x00\\xe8\\xe9C\t\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xeaC\t\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 24176 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002634" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 24177 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" } ], "repeated": 0, "id": 24178 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 24179 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000010a4" } ], "repeated": 0, "id": 24180 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000010a4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 24181 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002634" } ], "repeated": 0, "id": 24182 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002634" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 24183 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000026ac" } ], "repeated": 0, "id": 24184 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x10\\xe8C\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xac&\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\xd8\\x0eIs^t\\x00\\x00pgm\\x07\\x00\\x00\\x00\\x00@\\xebC\t\\x00\\x00\\x00\\x00pgm\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\xf0C\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 24185 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 24186 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 24187 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002634" } ], "repeated": 0, "id": 24188 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" } ], "repeated": 0, "id": 24189 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000010a4" } ], "repeated": 0, "id": 24190 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 24191 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000010a4" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 24192 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002614" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 24193 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002634" } ], "repeated": 0, "id": 24194 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "p\\xe7C\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xeaC\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xebC\t\\x00\\x00\\x00\\x00pgm\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\xf0C\t\\x00\\x00\\x00\\x00\\xe8\\xe9C\t\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xeaC\t\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 24195 }, { "timestamp": "2026-05-29 01:05:52,149", "thread_id": "4140", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 24196 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002634" } ], "repeated": 0, "id": 24197 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" } ], "repeated": 0, "id": 24198 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4140", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000010a4" } ], "repeated": 0, "id": 24199 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4140", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000010a4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 24200 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 24201 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4140", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000026ac" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 24202 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4140", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002614" } ], "repeated": 0, "id": 24203 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4140", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x10\\xe8C\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xac&\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\xd8\\x0eIs^t\\x00\\x00pgm\\x07\\x00\\x00\\x00\\x00@\\xebC\t\\x00\\x00\\x00\\x00pgm\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\xf0C\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 24204 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4140", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002518" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 24205 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" } ], "repeated": 0, "id": 24206 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 24207 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002518" } ], "repeated": 0, "id": 24208 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4140", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000010a4" } ], "repeated": 0, "id": 24209 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4140", "caller": "0x7fff5780d897", "parentcaller": "0x7fff432b949c", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000109c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00@\\x00\\x00\\x00\\x00\\x00\\x00`9\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 24210 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4140", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bc5ce", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 24211 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4140", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bc5ce", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000010a4" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 24212 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4140", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bc79b", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001af4" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 24213 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4140", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bc7ca", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000022ac" } ], "repeated": 0, "id": 24214 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4140", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bc7fe", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xa0\\xe4C\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00`\\xda\\xd9\\xff\\xff\\xff\\xff\\xffd\\x98PK\\x07\\xef\\xdc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xda\\xd9\\xff\\xff\\xff\\xff\\xffH\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa4\\x10\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 24215 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4140", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bc8d0", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000267c" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 24216 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8e4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022ac" } ], "repeated": 0, "id": 24217 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af4" } ], "repeated": 0, "id": 24218 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4140", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bc61a", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000010a4" } ], "repeated": 0, "id": 24219 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4140", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bc669", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000010a4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 24220 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc691", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000267c" } ], "repeated": 0, "id": 24221 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4140", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bc79b", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000267c" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 24222 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4140", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bc7ca", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00001af4" } ], "repeated": 0, "id": 24223 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4140", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bc7fe", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xa0\\xe4C\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00|&\\x00\\x00\\x00\\x00\\x00\\x00|&\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x81|}\\x1a\\xff\\x7f\\x00\\x00(\\x8b}\\x1a\\xff\\x7f\\x00\\x00|&\\x00\\x00\\x00\\x00\\x00\\x00|&\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x85g}W\\xff\\x7f\\x00\\x00|&\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 24224 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4140", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bc8d0", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022ac" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 24225 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8e4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af4" } ], "repeated": 0, "id": 24226 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000267c" } ], "repeated": 0, "id": 24227 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc6d4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022ac" } ], "repeated": 0, "id": 24228 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4140", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bc6f9", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000010a4" } ], "repeated": 0, "id": 24229 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4140", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432c08f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000010bc" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 24230 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4140", "caller": "0x7fff5780d897", "parentcaller": "0x7fff432c0a96", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001114" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 24231 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4140", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bbc69", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000010a4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 24232 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4140", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bc79b", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000022ac" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 24233 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4140", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bc7ca", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000267c" } ], "repeated": 0, "id": 24234 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4140", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bc7fe", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xe0\\xe5C\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x06\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x06\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xf7\\x8b\\x10\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x11\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 24235 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4140", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bc8d0", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af4" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 24236 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8e4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000267c" } ], "repeated": 0, "id": 24237 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022ac" } ], "repeated": 0, "id": 24238 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bbccd", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af4" } ], "repeated": 0, "id": 24239 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4140", "caller": "0x7fff5780d897", "parentcaller": "0x7fff432bd729", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000109c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00@\\x00\\x00\\x00\\x00\\x00\\x00`9\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 24240 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4140", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432b9392", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000010a4" } ], "repeated": 0, "id": 24241 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4140", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bc79b", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001af4" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 24242 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4140", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bc7ca", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000022ac" } ], "repeated": 0, "id": 24243 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4140", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bc7fe", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "0\\xe6C\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe8C\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\xf0C\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00]\\xdd|W\\xff\\x7f\\x00\\x001\\x008\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe8N\\xb8\\xf9Q\\xbc$\t4\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x92\\x93+C\\xff\\x7f\\x00\\x00" } ], "repeated": 0, "id": 24244 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4140", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bc8d0", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000267c" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!418" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 24245 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8e4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022ac" } ], "repeated": 0, "id": 24246 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af4" } ], "repeated": 0, "id": 24247 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b6a3f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000267c" } ], "repeated": 0, "id": 24248 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4140", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bbc69", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000010a4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 24249 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4140", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bc79b", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000267c" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 24250 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4140", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bc7ca", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00001af4" } ], "repeated": 0, "id": 24251 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4140", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bc7fe", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xd0\\xe4C\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\xcf\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04m+C\\xff\\x7f\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 24252 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4140", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bc8d0", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022ac" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 24253 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8e4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af4" } ], "repeated": 0, "id": 24254 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000267c" } ], "repeated": 0, "id": 24255 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bbccd", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022ac" } ], "repeated": 0, "id": 24256 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4140", "caller": "0x7fff5780d897", "parentcaller": "0x7fff432bd729", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000109c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00@\\x00\\x00\\x00\\x00\\x00\\x00`9\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 24257 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4140", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432c084a", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000010a4" } ], "repeated": 0, "id": 24258 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4140", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432c0a05", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000010bc" } ], "repeated": 0, "id": 24259 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff557c3a98", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xf9\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00<\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4668" } ], "repeated": 0, "id": 24260 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff5584a889", "parentcaller": "0x7fff55843ac1", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "CLSID\\{645FF040-5081-101B-9F08-00AA002F954E}" }, { "name": "Handle", "value": "0x0000242e" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\CLSID\\{645FF040-5081-101B-9F08-00AA002F954E}" } ], "repeated": 0, "id": 24261 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff5808b02d", "parentcaller": "0x7fff55899299", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000242e" }, { "name": "ValueName", "value": "System.ThumbnailCacheId" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{645FF040-5081-101B-9F08-00AA002F954E}\\System.ThumbnailCacheId" } ], "repeated": 0, "id": 24262 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff5808b02d", "parentcaller": "0x7fff55899299", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000242e" }, { "name": "ValueName", "value": "{446D16B1-8DAD-4870-A748-402EA43D788C} 100" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{645FF040-5081-101B-9F08-00AA002F954E}\\{446D16B1-8DAD-4870-A748-402EA43D788C} 100" } ], "repeated": 0, "id": 24263 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff55843b53", "parentcaller": "0x7fff52872b32", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242e" } ], "repeated": 0, "id": 24264 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff5584a889", "parentcaller": "0x7fff55843ac1", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "CLSID\\{645FF040-5081-101B-9F08-00AA002F954E}" }, { "name": "Handle", "value": "0x0000242e" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\CLSID\\{645FF040-5081-101B-9F08-00AA002F954E}" } ], "repeated": 0, "id": 24265 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff5808b02d", "parentcaller": "0x7fff55899299", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000242e" }, { "name": "ValueName", "value": "System.DateModified" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{645FF040-5081-101B-9F08-00AA002F954E}\\System.DateModified" } ], "repeated": 0, "id": 24266 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff5808b02d", "parentcaller": "0x7fff55899299", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000242e" }, { "name": "ValueName", "value": "{B725F130-47EF-101A-A5F1-02608C9EEBAC} 14" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{645FF040-5081-101B-9F08-00AA002F954E}\\{B725F130-47EF-101A-A5F1-02608C9EEBAC} 14" } ], "repeated": 0, "id": 24267 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff55843b53", "parentcaller": "0x7fff52872b32", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242e" } ], "repeated": 0, "id": 24268 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff5584a889", "parentcaller": "0x7fff55843ac1", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "CLSID\\{645FF040-5081-101B-9F08-00AA002F954E}" }, { "name": "Handle", "value": "0x0000242e" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\CLSID\\{645FF040-5081-101B-9F08-00AA002F954E}" } ], "repeated": 0, "id": 24269 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff5808b02d", "parentcaller": "0x7fff55899299", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000242e" }, { "name": "ValueName", "value": "System.DateModified" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{645FF040-5081-101B-9F08-00AA002F954E}\\System.DateModified" } ], "repeated": 0, "id": 24270 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff5808b02d", "parentcaller": "0x7fff55899299", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000242e" }, { "name": "ValueName", "value": "{B725F130-47EF-101A-A5F1-02608C9EEBAC} 14" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{645FF040-5081-101B-9F08-00AA002F954E}\\{B725F130-47EF-101A-A5F1-02608C9EEBAC} 14" } ], "repeated": 0, "id": 24271 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff55843b53", "parentcaller": "0x7fff432b62ed", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242e" } ], "repeated": 0, "id": 24272 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bbd54", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 24273 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bc79b", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000242c" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 24274 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bc7ca", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00001c54" } ], "repeated": 0, "id": 24275 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bc7fe", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "@\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\xb9\\xf7Y\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x91\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 24276 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bc8d0", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002450" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 24277 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8e4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001c54" } ], "repeated": 0, "id": 24278 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 24279 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bbd99", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 24280 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff5780d897", "parentcaller": "0x7fff432bd729", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000d5c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00@\\x00\\x00\\x00\\x00\\x00\\x00`9\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 24281 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432b9503", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 24282 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b953e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002450" } ], "repeated": 0, "id": 24283 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432b95a7", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002450" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 24284 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432b95d8", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000242c" } ], "repeated": 0, "id": 24285 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432b9610", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9d|}\\x1a\\xff\\x7f\\x00\\x00(\\x8b}\\x1a\\xff\\x7f\\x00\\x00\\x10\r\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\xf9\\x1d\\x01\\x00\\x00\\x00\\x00]\\xdd|W\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf9\\x7fN\\x0c\\xea[\\x00\\x00\\x18\\xf9\\x1d\\x01\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 24286 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432b96e3", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001c54" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 24287 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b96f7", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 24288 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b9706", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002450" } ], "repeated": 0, "id": 24289 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b9732", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001c54" } ], "repeated": 0, "id": 24290 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432b9779", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 24291 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff432c690b", "parentcaller": "0x7fff432bb551", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" }, { "name": "Handle", "value": "0x00001c54" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" } ], "repeated": 0, "id": 24292 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff432c6964", "parentcaller": "0x7fff432bb551", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001c54" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 24293 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff432c6990", "parentcaller": "0x7fff432bb551", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001c54" } ], "repeated": 0, "id": 24294 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432c5686", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 24295 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432c5686", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001c54" }, { "name": "Milliseconds", "value": "600000" } ], "repeated": 0, "id": 24296 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 24297 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff432c5ded", "parentcaller": "0x7fff432c56be", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "AB8902B4-09CA-4BB6-B78D-A8F59079A8D5" }, { "name": "ClsContext", "value": "0x00004004", "pretty_value": "CLSCTX_LOCAL_SERVER|CLSCTX_NO_FAILURE_LOG" }, { "name": "riid", "value": "75121952-E0D0-43E5-9380-1D80483ACF72" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 24298 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff432c5d25", "parentcaller": "0x7fff432c56d1", "category": "system", "api": "CreateTimerQueueTimer", "status": true, "return": "0x00000001", "arguments": [ { "name": "phNewTimer", "value": "0x0cad55d0" }, { "name": "TimerQueue", "value": "0x00000000" }, { "name": "Callback", "value": "0x432ed350" }, { "name": "Parameter", "value": "0x033aea60" }, { "name": "DueTime", "value": "60000" }, { "name": "Period", "value": "1000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 24299 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff5587d014", "parentcaller": "0x7fff558252c1", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "CLSID\\{645FF040-5081-101B-9F08-00AA002F954E}\\Instance" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\CLSID\\{645FF040-5081-101B-9F08-00AA002F954E}\\Instance" } ], "repeated": 0, "id": 24300 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 24301 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff58be0000", "arguments": [ { "name": "lpLibFileName", "value": "shell32.dll" }, { "name": "dwFlags", "value": "0x00004000" } ], "repeated": 0, "id": 24302 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577dac31", "parentcaller": "0x7fff558258ff", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "SHELL32.dll" }, { "name": "ModuleHandle", "value": "0x7fff58be0000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff58c378f0" } ], "repeated": 0, "id": 24303 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff5587d014", "parentcaller": "0x7fff558252c1", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "CLSID\\{4A04656D-52AA-49DE-8A09-CB178760E748}\\Instance" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\CLSID\\{4A04656D-52AA-49DE-8A09-CB178760E748}\\Instance" } ], "repeated": 0, "id": 24304 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 24305 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff58be0000", "arguments": [ { "name": "lpLibFileName", "value": "shell32.dll" }, { "name": "dwFlags", "value": "0x00004000" } ], "repeated": 0, "id": 24306 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577dac31", "parentcaller": "0x7fff558258ff", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "SHELL32.dll" }, { "name": "ModuleHandle", "value": "0x7fff58be0000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff58c378f0" } ], "repeated": 0, "id": 24307 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 24308 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000c7c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 24309 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432cbf4b", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001c54" } ], "repeated": 0, "id": 24310 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff432c690b", "parentcaller": "0x7fff432b67f7", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" }, { "name": "Handle", "value": "0x00001c54" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" } ], "repeated": 0, "id": 24311 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff432c6964", "parentcaller": "0x7fff432b67f7", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001c54" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 24312 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff432c6990", "parentcaller": "0x7fff432b67f7", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001c54" } ], "repeated": 0, "id": 24313 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432baa24", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 24314 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432baa24", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 24315 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bc79b", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001c54" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 24316 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bc7ca", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002634" } ], "repeated": 0, "id": 24317 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bc7fe", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "0\\xe7:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00`\\xda\\xd9\\xff\\xff\\xff\\xff\\xffd\\x98PK\\x07\\xef\\xdc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xda\\xd9\\xff\\xff\\xff\\xff\\xffH\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 24318 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bc8d0", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 24319 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8e4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002634" } ], "repeated": 0, "id": 24320 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001c54" } ], "repeated": 0, "id": 24321 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432baa73", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 24322 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432b9503", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 24323 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b953e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 24324 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432b95a7", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002674" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 24325 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432b95d8", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00001c54" } ], "repeated": 0, "id": 24326 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432b9610", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x10\\xe7:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00i\\xd5[\\x1a\\xff\\x7f\\x00\\x00\\xd0\\xe7:\\x03\\x00\\x00\\x00\\x00\\x10\r\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0fP\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9d|}\\x1a\\xff\\x7f\\x00\\x00(\\x8b}\\x1a\\xff\\x7f\\x00\\x00\\x10\r\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 24327 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432b96e3", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002634" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 24328 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b96f7", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001c54" } ], "repeated": 0, "id": 24329 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b9706", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 24330 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b9732", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002634" } ], "repeated": 0, "id": 24331 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432b9779", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 24332 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff432b9455", "parentcaller": "0x7fff432baae3", "category": "filesystem", "api": "GetDiskFreeSpaceExW", "status": true, "return": "0x00000001", "arguments": [ { "name": "DirectoryName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" } ], "repeated": 0, "id": 24333 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 24334 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 24335 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002634" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 24336 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002674" } ], "repeated": 0, "id": 24337 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe9:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00(\\xec:\\x03\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 24338 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001c54" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 24339 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 24340 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002634" } ], "repeated": 0, "id": 24341 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 24342 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 24343 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001c54" } ], "repeated": 0, "id": 24344 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001c54" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 24345 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002634" } ], "repeated": 0, "id": 24346 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xffT\\x1c\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\x98\\x080y^t\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 24347 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 24348 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002634" } ], "repeated": 0, "id": 24349 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001c54" } ], "repeated": 0, "id": 24350 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 24351 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 24352 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 24353 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 24354 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002674" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 24355 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00001c54" } ], "repeated": 0, "id": 24356 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe9:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00(\\xec:\\x03\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 24357 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002634" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 24358 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001c54" } ], "repeated": 0, "id": 24359 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 24360 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 24361 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 24362 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002634" } ], "repeated": 0, "id": 24363 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002634" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 24364 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002674" } ], "repeated": 0, "id": 24365 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xffT\\x1c\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\x98\\x080y^t\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 24366 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001c54" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 24367 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 24368 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002634" } ], "repeated": 0, "id": 24369 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001c54" } ], "repeated": 0, "id": 24370 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 24371 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 24372 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 24373 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001c54" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 24374 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002634" } ], "repeated": 0, "id": 24375 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe9:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00(\\xec:\\x03\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 24376 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 24377 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002634" } ], "repeated": 0, "id": 24378 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001c54" } ], "repeated": 0, "id": 24379 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 24380 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 24381 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 24382 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002674" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 24383 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00001c54" } ], "repeated": 0, "id": 24384 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xffT\\x1c\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\x98\\x080y^t\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 24385 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002634" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 24386 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001c54" } ], "repeated": 0, "id": 24387 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 24388 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002634" } ], "repeated": 0, "id": 24389 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 24390 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 24391 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 24392 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002634" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 24393 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002674" } ], "repeated": 0, "id": 24394 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe9:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00(\\xec:\\x03\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 24395 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001c54" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 24396 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 24397 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002634" } ], "repeated": 0, "id": 24398 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 24399 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 24400 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001c54" } ], "repeated": 0, "id": 24401 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001c54" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 24402 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002634" } ], "repeated": 0, "id": 24403 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xffT\\x1c\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\x98\\x080y^t\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 24404 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 24405 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002634" } ], "repeated": 0, "id": 24406 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001c54" } ], "repeated": 0, "id": 24407 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 24408 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 24409 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 24410 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 24411 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002674" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 24412 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00001c54" } ], "repeated": 0, "id": 24413 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe9:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00(\\xec:\\x03\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 24414 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002634" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 24415 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001c54" } ], "repeated": 0, "id": 24416 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 24417 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 24418 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 24419 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002634" } ], "repeated": 0, "id": 24420 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002634" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 24421 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002674" } ], "repeated": 0, "id": 24422 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xffT\\x1c\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\x98\\x080y^t\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 24423 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001c54" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 24424 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 24425 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002634" } ], "repeated": 0, "id": 24426 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001c54" } ], "repeated": 0, "id": 24427 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 24428 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 24429 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 24430 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001c54" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 24431 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002634" } ], "repeated": 0, "id": 24432 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe9:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00(\\xec:\\x03\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 24433 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 24434 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002634" } ], "repeated": 0, "id": 24435 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001c54" } ], "repeated": 0, "id": 24436 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 24437 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 24438 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 24439 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002674" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 24440 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00001c54" } ], "repeated": 0, "id": 24441 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xffT\\x1c\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\x98\\x080y^t\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 24442 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002634" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 24443 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001c54" } ], "repeated": 0, "id": 24444 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 24445 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002634" } ], "repeated": 0, "id": 24446 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 24447 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 24448 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 24449 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002634" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 24450 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002674" } ], "repeated": 0, "id": 24451 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe9:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00(\\xec:\\x03\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 24452 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001c54" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 24453 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 24454 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002634" } ], "repeated": 0, "id": 24455 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 24456 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 24457 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001c54" } ], "repeated": 0, "id": 24458 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001c54" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 24459 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002634" } ], "repeated": 0, "id": 24460 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xffT\\x1c\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\x98\\x080y^t\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 24461 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 24462 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002634" } ], "repeated": 0, "id": 24463 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001c54" } ], "repeated": 0, "id": 24464 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 24465 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 24466 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 24467 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 24468 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002674" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 24469 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00001c54" } ], "repeated": 0, "id": 24470 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe9:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00(\\xec:\\x03\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 24471 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002634" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 24472 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001c54" } ], "repeated": 0, "id": 24473 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 24474 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 24475 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 24476 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002634" } ], "repeated": 0, "id": 24477 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002634" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 24478 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002674" } ], "repeated": 0, "id": 24479 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xffT\\x1c\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\x98\\x080y^t\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 24480 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001c54" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 24481 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 24482 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002634" } ], "repeated": 0, "id": 24483 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001c54" } ], "repeated": 0, "id": 24484 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 24485 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 24486 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 24487 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001c54" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 24488 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002634" } ], "repeated": 0, "id": 24489 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe9:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00(\\xec:\\x03\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 24490 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 24491 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002634" } ], "repeated": 0, "id": 24492 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001c54" } ], "repeated": 0, "id": 24493 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 24494 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 24495 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 24496 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002674" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 24497 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00001c54" } ], "repeated": 0, "id": 24498 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xffT\\x1c\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\x98\\x080y^t\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 24499 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002634" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 24500 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001c54" } ], "repeated": 0, "id": 24501 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 24502 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002634" } ], "repeated": 0, "id": 24503 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 24504 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 24505 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 24506 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002634" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 24507 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002674" } ], "repeated": 0, "id": 24508 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe9:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00(\\xec:\\x03\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 24509 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001c54" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 24510 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 24511 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002634" } ], "repeated": 0, "id": 24512 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 24513 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 24514 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001c54" } ], "repeated": 0, "id": 24515 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001c54" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 24516 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002634" } ], "repeated": 0, "id": 24517 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xffT\\x1c\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\x98\\x080y^t\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 24518 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 24519 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002634" } ], "repeated": 0, "id": 24520 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001c54" } ], "repeated": 0, "id": 24521 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 24522 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 24523 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 24524 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 24525 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002674" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 24526 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00001c54" } ], "repeated": 0, "id": 24527 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe9:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00(\\xec:\\x03\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 24528 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002634" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 24529 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001c54" } ], "repeated": 0, "id": 24530 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 24531 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 24532 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 24533 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002634" } ], "repeated": 0, "id": 24534 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002634" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 24535 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002674" } ], "repeated": 0, "id": 24536 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xffT\\x1c\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\x98\\x080y^t\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 24537 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001c54" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 24538 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 24539 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002634" } ], "repeated": 0, "id": 24540 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001c54" } ], "repeated": 0, "id": 24541 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 24542 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 24543 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 24544 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001c54" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 24545 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002634" } ], "repeated": 0, "id": 24546 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe9:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00(\\xec:\\x03\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 24547 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 24548 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002634" } ], "repeated": 0, "id": 24549 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001c54" } ], "repeated": 0, "id": 24550 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 24551 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 24552 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 24553 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002674" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 24554 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00001c54" } ], "repeated": 0, "id": 24555 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xffT\\x1c\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\x98\\x080y^t\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 24556 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002634" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 24557 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001c54" } ], "repeated": 0, "id": 24558 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 24559 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002634" } ], "repeated": 0, "id": 24560 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 24561 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 24562 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 24563 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002634" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 24564 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002674" } ], "repeated": 0, "id": 24565 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe9:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00(\\xec:\\x03\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 24566 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001c54" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 24567 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 24568 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002634" } ], "repeated": 0, "id": 24569 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 24570 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 24571 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001c54" } ], "repeated": 0, "id": 24572 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001c54" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 24573 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002634" } ], "repeated": 0, "id": 24574 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xffT\\x1c\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\x98\\x080y^t\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 24575 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 24576 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002634" } ], "repeated": 0, "id": 24577 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001c54" } ], "repeated": 0, "id": 24578 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 24579 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 24580 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff5780d897", "parentcaller": "0x7fff432b949c", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000d5c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00@\\x00\\x00\\x00\\x00\\x00\\x00`9\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 24581 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bc5ce", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 24582 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bc5ce", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 24583 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bc79b", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002674" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 24584 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bc7ca", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00001c54" } ], "repeated": 0, "id": 24585 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bc7fe", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xe0\\xe6:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00`\\xda\\xd9\\xff\\xff\\xff\\xff\\xffd\\x98PK\\x07\\xef\\xdc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xda\\xd9\\xff\\xff\\xff\\xff\\xffH\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\r\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 24586 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bc8d0", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002634" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 24587 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8e4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001c54" } ], "repeated": 0, "id": 24588 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 24589 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bc61a", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 24590 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bc669", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 24591 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc691", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002634" } ], "repeated": 0, "id": 24592 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bc79b", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002634" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 24593 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bc7ca", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002674" } ], "repeated": 0, "id": 24594 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bc7fe", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xe0\\xe6:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x004&\\x00\\x00\\x00\\x00\\x00\\x004&\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x81|}\\x1a\\xff\\x7f\\x00\\x00(\\x8b}\\x1a\\xff\\x7f\\x00\\x004&\\x00\\x00\\x00\\x00\\x00\\x004&\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x85g}W\\xff\\x7f\\x00\\x004&\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 24595 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bc8d0", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001c54" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 24596 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8e4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 24597 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002634" } ], "repeated": 0, "id": 24598 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc6d4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001c54" } ], "repeated": 0, "id": 24599 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bc6f9", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 24600 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432c182f", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000dac" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 24601 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432c182f", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d84" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 24602 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001c54" }, { "name": "DesiredAccess", "value": "0xc0100080", "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 24603 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff432c1c19", "parentcaller": "0x7fff432c1ae1", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001c54" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db" }, { "name": "FileInformationClass", "value": "74" }, { "name": "FileInformation", "value": "\\x02\\x00\\x00\\x00" } ], "repeated": 0, "id": 24604 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff5780d897", "parentcaller": "0x7fff432c0ae3", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001c54" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 24605 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577cf0e1", "parentcaller": "0x7fff577cef40", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002634" }, { "name": "DesiredAccess", "value": "0x000f0007", "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_WRITE" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x00001c54" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db" } ], "repeated": 0, "id": 24606 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff5780d897", "parentcaller": "0x7fff432c0b54", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001c54" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 24607 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bbd54", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 24608 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bbd54", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 24609 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bc79b", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002674" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 24610 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bc7ca", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002520" } ], "repeated": 0, "id": 24611 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bc7fe", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xe7:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00`\\xda\\xd9\\xff\\xff\\xff\\xff\\xffd\\x98PK\\x07\\xef\\xdc\\x01\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00`\\xda\\xd9\\xff\\xff\\xff\\xff\\xffH\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00(\\xb4l\\x07\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 24612 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bc8d0", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 24613 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8e4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002520" } ], "repeated": 0, "id": 24614 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 24615 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bbd99", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 24616 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432b9503", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 24617 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b953e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 24618 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432b95a7", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001af0" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 24619 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432b95d8", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002674" } ], "repeated": 0, "id": 24620 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432b9610", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "0\\xe7:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xc0\\xe7:\\x03\\x00\\x00\\x00\\x00\\x10\r\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0fP\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9d|}\\x1a\\xff\\x7f\\x00\\x00(\\x8b}\\x1a\\xff\\x7f\\x00\\x00\\x10\r\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\xf9\\x1d\\x01\\x00\\x00\\x00\\x00]\\xdd|W\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00(\\xb4l\\x07\\x00\\x00\\x00\\x00\\xd9pN\\x0c\\xea[\\x00\\x00\\x18\\xf9\\x1d\\x01\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 24621 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432b96e3", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002520" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 24622 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b96f7", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 24623 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b9706", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 24624 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b9732", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002520" } ], "repeated": 0, "id": 24625 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432b9779", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 24626 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002634" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x13260000" }, { "name": "SectionOffset", "value": "0x033ae730" }, { "name": "ViewSize", "value": "0x00100000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 24627 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff432c1d16", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001c54" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002520" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 24628 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432c1d9b", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001128" } ], "repeated": 0, "id": 24629 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432c1530", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d84" } ], "repeated": 0, "id": 24630 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432c1e9e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000dac" } ], "repeated": 0, "id": 24631 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432c08f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d84" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 24632 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff5780d897", "parentcaller": "0x7fff432c0a96", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001c54" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 24633 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bbc69", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 24634 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bc79b", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001128" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 24635 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bc7ca", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00001af0" } ], "repeated": 0, "id": 24636 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bc7fe", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xe8:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xf7\\x8b\\x10\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00T\\x1c\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 24637 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bc8d0", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 24638 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8e4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 24639 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001128" } ], "repeated": 0, "id": 24640 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bbccd", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 24641 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff5780d897", "parentcaller": "0x7fff432bd729", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000d5c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00@\\x00\\x00\\x00\\x00\\x00\\x00`9\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 24642 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432b9392", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 24643 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bc79b", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002674" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 24644 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bc7ca", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00001128" } ], "repeated": 0, "id": 24645 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bc7fe", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "p\\xe8:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00]\\xdd|W\\xff\\x7f\\x00\\x001\\x008\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe8N\\xb8\\xf9Q\\xbc$\t4\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x92\\x93+C\\xff\\x7f\\x00\\x00" } ], "repeated": 0, "id": 24646 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bc8d0", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!418" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 24647 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8e4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001128" } ], "repeated": 0, "id": 24648 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 24649 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b6a3f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 24650 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bbc69", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 24651 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bc79b", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001af0" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 24652 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bc7ca", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002674" } ], "repeated": 0, "id": 24653 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bc7fe", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x10\\xe7:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00&\\x13\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04m+C\\xff\\x7f\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 24654 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bc8d0", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001128" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 24655 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8e4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 24656 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 24657 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bbccd", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001128" } ], "repeated": 0, "id": 24658 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff5780d897", "parentcaller": "0x7fff432bd729", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000d5c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00@\\x00\\x00\\x00\\x00\\x00\\x00`9\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 24659 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432c084a", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 24660 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432c0a05", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d84" } ], "repeated": 0, "id": 24661 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff558b2b5a", "parentcaller": "0x7fff558658f2", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001011c" }, { "name": "Message", "value": "0x000004b5" } ], "repeated": 0, "id": 24662 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6bcf", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc00000ba", "pretty_return": "FILE_IS_A_DIRECTORY", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 24663 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001128" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 24664 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d5cfb", "parentcaller": "0x7fff577d6bfa", "category": "device", "api": "DeviceIoControl", "status": false, "return": "0x00000000", "arguments": [ { "name": "DeviceHandle", "value": "0x00001128" }, { "name": "IoControlCode", "value": "0x000900a8", "pretty_value": "FSCTL_GET_REPARSE_POINT" }, { "name": "InBuffer", "value": "" }, { "name": "OutBuffer", "value": "\\x00\\xd5:\\x03\\x00\\x00\\x00\\x000\\xd5:\\x03\\x00\\x00\\x00\\x00\\x80\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\xba\\x00\\x00\\xc0\\xff\\xff\\xff\\xff\\x86\r\\x05\\xe4\\x97\\x9c\\x00\\x00\\x08\\x82}\\x1a\\xff\\x7f\\x00\\x00p\\x80\\xb3\\x0c\\x00\\x00\\x00\\x00\\xba\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90t\\xb3\\x0c\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xd5:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfak}W\\xff\\x7f\\x00\\x00C\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xd5:\\x03\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x006\\x00:\\x00\\x00\\x00\\x00\\x00p\\x80\\xb3\\x0c\\x00\\x00\\x00\\x00pJY\\x1a\\xff\\x7f\\x00\\x00$J\\x0cZ\\xff\\x7f\\x00\\x00\\x00\\x00\\xf5Y\\xff\\x7f\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\xd5:\\x03\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 24665 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff577d5d22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001128" } ], "repeated": 0, "id": 24666 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6c28", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001128" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 24667 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6cc4", "parentcaller": "0x7fff577d6f7c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001128" } ], "repeated": 0, "id": 24668 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d4d82", "parentcaller": "0x7fff577d6fe6", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001128" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 24669 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d4dc6", "parentcaller": "0x7fff577d6fe6", "category": "device", "api": "DeviceIoControl", "status": false, "return": "0x00000000", "arguments": [ { "name": "DeviceHandle", "value": "0x00001128" }, { "name": "IoControlCode", "value": "0x004d0008", "pretty_value": "IOCTL_MOUNTDEV_QUERY_DEVICE_NAME" }, { "name": "InBuffer", "value": "" }, { "name": "OutBuffer", "value": "" } ], "repeated": 0, "id": 24670 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d4dd4", "parentcaller": "0x7fff577d6fe6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001128" } ], "repeated": 0, "id": 24671 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001128" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 24672 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d5cfb", "parentcaller": "0x7fff577d7000", "category": "device", "api": "DeviceIoControl", "status": false, "return": "0x00000000", "arguments": [ { "name": "DeviceHandle", "value": "0x00001128" }, { "name": "IoControlCode", "value": "0x000900a8", "pretty_value": "FSCTL_GET_REPARSE_POINT" }, { "name": "InBuffer", "value": "" }, { "name": "OutBuffer", "value": "\\x98D\\xd4U\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd9:\\x03\\x00\\x00\\x00\\x00.\\x000\\x00\\x00\\x00\\x00\\x00V\\x07\\x05\\xe4\\x97\\x9c\\x00\\x00D\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90t\\xb3\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xdb:\\x03\\x00\\x00\\x00\\x00\\xf0\\x1f\\xbf\\x08\\x00\\x00\\x00\\x00\\x90t\\xb3\\x0c\\x00\\x00\\x00\\x00y\\xda:\\x03\\x00\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00p}W\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x90t\\xb3\\x0c\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x01\\x00\\x00\\x00\\x00\\x00\\x000\\x000\\x00\\x00\\x00\\x00\\x00\\x90t\\xb3\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x002\\x00\\x00\\x00\\x00\\x00\\x90t\\xb3\\x0c\\x00\\x00\\x00\\x00\\x06\\x0b\\x05\\xe4\\x97\\x9c\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 24673 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff577d5d22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001128" } ], "repeated": 0, "id": 24674 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6bcf", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc00000ba", "pretty_return": "FILE_IS_A_DIRECTORY", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 24675 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001128" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 24676 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d5cfb", "parentcaller": "0x7fff577d6bfa", "category": "device", "api": "DeviceIoControl", "status": false, "return": "0x00000000", "arguments": [ { "name": "DeviceHandle", "value": "0x00001128" }, { "name": "IoControlCode", "value": "0x000900a8", "pretty_value": "FSCTL_GET_REPARSE_POINT" }, { "name": "InBuffer", "value": "" }, { "name": "OutBuffer", "value": "\\x00\\xd5:\\x03\\x00\\x00\\x00\\x000\\xd5:\\x03\\x00\\x00\\x00\\x00\\x80\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\xba\\x00\\x00\\xc0\\xff\\xff\\xff\\xff\\x86\r\\x05\\xe4\\x97\\x9c\\x00\\x00\\x08\\x82}\\x1a\\xff\\x7f\\x00\\x00P\\xd4\\xc5\\x0b\\x00\\x00\\x00\\x00\\xba\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90t\\xb3\\x0c\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xd5:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfak}W\\xff\\x7f\\x00\\x00C\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xd5:\\x03\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00&\\x00*\\x00\\x00\\x00\\x00\\x00P\\xd4\\xc5\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\xd5:\\x03\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 24677 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff577d5d22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001128" } ], "repeated": 0, "id": 24678 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6c28", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001128" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 24679 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6cc4", "parentcaller": "0x7fff577d6f7c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001128" } ], "repeated": 0, "id": 24680 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d4d82", "parentcaller": "0x7fff577d6fe6", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001128" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 24681 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d4dc6", "parentcaller": "0x7fff577d6fe6", "category": "device", "api": "DeviceIoControl", "status": false, "return": "0x00000000", "arguments": [ { "name": "DeviceHandle", "value": "0x00001128" }, { "name": "IoControlCode", "value": "0x004d0008", "pretty_value": "IOCTL_MOUNTDEV_QUERY_DEVICE_NAME" }, { "name": "InBuffer", "value": "" }, { "name": "OutBuffer", "value": "" } ], "repeated": 0, "id": 24682 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d4dd4", "parentcaller": "0x7fff577d6fe6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001128" } ], "repeated": 0, "id": 24683 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001128" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 24684 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d5cfb", "parentcaller": "0x7fff577d7000", "category": "device", "api": "DeviceIoControl", "status": false, "return": "0x00000000", "arguments": [ { "name": "DeviceHandle", "value": "0x00001128" }, { "name": "IoControlCode", "value": "0x000900a8", "pretty_value": "FSCTL_GET_REPARSE_POINT" }, { "name": "InBuffer", "value": "" }, { "name": "OutBuffer", "value": "\\x98D\\xd4U\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd9:\\x03\\x00\\x00\\x00\\x00.\\x000\\x00\\x00\\x00\\x00\\x00V\\x07\\x05\\xe4\\x97\\x9c\\x00\\x00D\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90t\\xb3\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xdb:\\x03\\x00\\x00\\x00\\x00\\xf0\\x1f\\xbf\\x08\\x00\\x00\\x00\\x00\\x90t\\xb3\\x0c\\x00\\x00\\x00\\x00y\\xda:\\x03\\x00\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00p}W\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x90t\\xb3\\x0c\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00D\\x00\\x00\\x00\\x04\\x01\\x00\\x00\\x00\\x00\\x00\\x00 \\x00\"\\x00\\x00\\x00\\x00\\x00\\x90t\\xb3\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xb0t\\xb3\\x0c\\x00\\x00\\x00\\x00 \\x00\"\\x00\\x00\\x00\\x00\\x00\\x90t\\xb3\\x0c\\x00\\x00\\x00\\x00\\x06\\x0b\\x05\\xe4\\x97\\x9c\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 24685 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff577d5d22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001128" } ], "repeated": 0, "id": 24686 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6bcf", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc00000ba", "pretty_return": "FILE_IS_A_DIRECTORY", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 24687 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001128" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 24688 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d5cfb", "parentcaller": "0x7fff577d6bfa", "category": "device", "api": "DeviceIoControl", "status": false, "return": "0x00000000", "arguments": [ { "name": "DeviceHandle", "value": "0x00001128" }, { "name": "IoControlCode", "value": "0x000900a8", "pretty_value": "FSCTL_GET_REPARSE_POINT" }, { "name": "InBuffer", "value": "" }, { "name": "OutBuffer", "value": "\\x00\\xd5:\\x03\\x00\\x00\\x00\\x000\\xd5:\\x03\\x00\\x00\\x00\\x00\\x80\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\xba\\x00\\x00\\xc0\\xff\\xff\\xff\\xff\\x86\r\\x05\\xe4\\x97\\x9c\\x00\\x00\\x08\\x82}\\x1a\\xff\\x7f\\x00\\x00\\xb06\\xb2\\x0c\\x00\\x00\\x00\\x00\\xba\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90t\\xb3\\x0c\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xd5:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfak}W\\xff\\x7f\\x00\\x00C\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xd5:\\x03\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x1c\\x00\\x00\\x00\\x00\\x00\\xb06\\xb2\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\xd5:\\x03\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 24689 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff577d5d22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001128" } ], "repeated": 0, "id": 24690 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6c28", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001128" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 24691 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6cc4", "parentcaller": "0x7fff577d6f7c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001128" } ], "repeated": 0, "id": 24692 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d4d82", "parentcaller": "0x7fff577d6fe6", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001128" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 24693 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d4dc6", "parentcaller": "0x7fff577d6fe6", "category": "device", "api": "DeviceIoControl", "status": false, "return": "0x00000000", "arguments": [ { "name": "DeviceHandle", "value": "0x00001128" }, { "name": "IoControlCode", "value": "0x004d0008", "pretty_value": "IOCTL_MOUNTDEV_QUERY_DEVICE_NAME" }, { "name": "InBuffer", "value": "" }, { "name": "OutBuffer", "value": "" } ], "repeated": 0, "id": 24694 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d4dd4", "parentcaller": "0x7fff577d6fe6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001128" } ], "repeated": 0, "id": 24695 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001128" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 24696 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d5cfb", "parentcaller": "0x7fff577d7000", "category": "device", "api": "DeviceIoControl", "status": false, "return": "0x00000000", "arguments": [ { "name": "DeviceHandle", "value": "0x00001128" }, { "name": "IoControlCode", "value": "0x000900a8", "pretty_value": "FSCTL_GET_REPARSE_POINT" }, { "name": "InBuffer", "value": "" }, { "name": "OutBuffer", "value": "\\x98D\\xd4U\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd9:\\x03\\x00\\x00\\x00\\x00.\\x000\\x00\\x00\\x00\\x00\\x00V\\x07\\x05\\xe4\\x97\\x9c\\x00\\x00D\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90t\\xb3\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xdb:\\x03\\x00\\x00\\x00\\x00\\xf0\\x1f\\xbf\\x08\\x00\\x00\\x00\\x00\\x90t\\xb3\\x0c\\x00\\x00\\x00\\x00y\\xda:\\x03\\x00\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00p}W\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x90t\\xb3\\x0c\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00P\\x00\\x00\\x00\\x04\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x12\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x90t\\xb3\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xa2t\\xb3\\x0c\\x00\\x00\\x00\\x00\\x12\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x90t\\xb3\\x0c\\x00\\x00\\x00\\x00\\x06\\x0b\\x05\\xe4\\x97\\x9c\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 24697 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff577d5d22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001128" } ], "repeated": 0, "id": 24698 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d4d82", "parentcaller": "0x7fff577d70c7", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001128" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 24699 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d4dc6", "parentcaller": "0x7fff577d70c7", "category": "device", "api": "DeviceIoControl", "status": true, "return": "0x00000001", "arguments": [ { "name": "DeviceHandle", "value": "0x00001128" }, { "name": "IoControlCode", "value": "0x004d0008", "pretty_value": "IOCTL_MOUNTDEV_QUERY_DEVICE_NAME" }, { "name": "InBuffer", "value": "" }, { "name": "OutBuffer", "value": ".\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00" } ], "repeated": 0, "id": 24700 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d4dd4", "parentcaller": "0x7fff577d70c7", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001128" } ], "repeated": 0, "id": 24701 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d4f8e", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001128" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\MountPointManager" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 24702 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d4fcf", "parentcaller": "0x7fff577d70c7", "category": "device", "api": "DeviceIoControl", "status": false, "return": "0x00000000", "arguments": [ { "name": "DeviceHandle", "value": "0x00001128" }, { "name": "IoControlCode", "value": "0x006d0008", "pretty_value": "IOCTL_MOUNTMGR_QUERY_POINTS" }, { "name": "InBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00.\\x00\\x00\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00" }, { "name": "OutBuffer", "value": "\\xee\\x00\\x00\\x00\\x02\\x00\\x00\\x00" } ], "repeated": 0, "id": 24703 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d4fcf", "parentcaller": "0x7fff577d70c7", "category": "device", "api": "DeviceIoControl", "status": true, "return": "0x00000001", "arguments": [ { "name": "DeviceHandle", "value": "0x00001128" }, { "name": "IoControlCode", "value": "0x006d0008", "pretty_value": "IOCTL_MOUNTMGR_QUERY_POINTS" }, { "name": "InBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00.\\x00\\x00\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00" }, { "name": "OutBuffer", "value": "\\xee\\x00\\x00\\x00\\x02\\x00\\x00\\x00r\\x00\\x00\\x00\\x1c\\x00\\x00\\x008\\x00\\x00\\x00\\x0c\\x00\\x00\\x00D\\x00\\x00\\x00.\\x00\\x00\\x00\\x8e\\x00\\x00\\x00`\\x00\\x00\\x008\\x00\\x00\\x00\\x0c\\x00\\x00\\x00D\\x00\\x00\\x00.\\x00\\x00\\x00/\\x10\\x8cR\\x00\\x000\\x03\\x00\\x00\\x00\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00\\\\x00D\\x00o\\x00s\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00s\\x00\\\\x00C\\x00:\\x00\\\\x00?\\x00?\\x00\\\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00{\\x005\\x002\\x008\\x00c\\x001\\x000\\x002\\x00f\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x003\\x000\\x000\\x003\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x00}\\x00" } ], "repeated": 0, "id": 24704 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff577d4fe3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001128" } ], "repeated": 0, "id": 24705 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bbd54", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 24706 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bc79b", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001128" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 24707 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bc7ca", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00001af0" } ], "repeated": 0, "id": 24708 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bc7fe", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "@\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00s\\xb3\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa1[\\xf7Y\\xff\\x7f\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x9c\\xaa\\x0c\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 24709 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bc8d0", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 24710 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8e4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 24711 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001128" } ], "repeated": 0, "id": 24712 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bbd99", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 24713 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff5780d897", "parentcaller": "0x7fff432bd729", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000d5c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00@\\x00\\x00\\x00\\x00\\x00\\x00`9\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 24714 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432b9503", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 24715 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b953e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 24716 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432b95a7", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002674" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 24717 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432b95d8", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00001128" } ], "repeated": 0, "id": 24718 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432b9610", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9d|}\\x1a\\xff\\x7f\\x00\\x00(\\x8b}\\x1a\\xff\\x7f\\x00\\x00\\x10\r\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\xf9\\x1d\\x01\\x00\\x00\\x00\\x00]\\xdd|W\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x9c\\xaa\\x0c\\x00\\x00\\x00\\x00\\xf9\\x7fN\\x0c\\xea[\\x00\\x00\\x18\\xf9\\x1d\\x01\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 24719 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432b96e3", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 24720 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b96f7", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001128" } ], "repeated": 0, "id": 24721 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b9706", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 24722 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b9732", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 24723 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432b9779", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 24724 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff432b643e", "parentcaller": "0x7fff432b8101", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "DE77BA04-3C92-4D11-A1A5-42352A53E0E3" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "7A3BD1D9-35A9-4FB3-A467-F48CAC35E2D0" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 24725 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff40f3155d", "parentcaller": "0x7fff432b645e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "System\\CurrentControlSet\\Services\\HomeGroupProvider\\ServiceData" }, { "name": "Handle", "value": "0x00001af0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\HomeGroupProvider\\ServiceData" } ], "repeated": 0, "id": 24726 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff40f315b1", "parentcaller": "0x7fff432b645e", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001af0" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 24727 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff40f315e2", "parentcaller": "0x7fff432b645e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 24728 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff432c690b", "parentcaller": "0x7fff432bb551", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" }, { "name": "Handle", "value": "0x00001af0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" } ], "repeated": 0, "id": 24729 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff432c6964", "parentcaller": "0x7fff432bb551", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001af0" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 24730 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff432c6990", "parentcaller": "0x7fff432bb551", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 24731 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff5585204d", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00001af0" } ], "repeated": 0, "id": 24732 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff558520a2", "parentcaller": "0x7fff55851f69", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "18" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 24733 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff55852301", "parentcaller": "0x7fff55851f69", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "20" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 24734 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5585211d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 24735 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff58081596", "parentcaller": "0x7fff58ac668d", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": ".lnk" }, { "name": "Handle", "value": "0x00001af2" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\.lnk" } ], "repeated": 0, "id": 24736 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff5808ab55", "parentcaller": "0x7fff5585290f", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af2" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "lnkfile" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.lnk\\(Default)" } ], "repeated": 0, "id": 24737 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff55853405", "parentcaller": "0x7fff55852415", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "lnkfile" }, { "name": "Handle", "value": "0x00002676" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\lnkfile" } ], "repeated": 0, "id": 24738 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002676" }, { "name": "KeyInformation", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\lnkfile" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 24739 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002676" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 1, "id": 24740 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00002676" }, { "name": "ObjectAttributesName", "value": "CurVer" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\lnkfile\\CurVer" } ], "repeated": 0, "id": 24741 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\lnkfile\\CurVer" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\lnkfile\\CurVer" } ], "repeated": 0, "id": 24742 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff58081596", "parentcaller": "0x7fff58ac668d", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002676" }, { "name": "SubKey", "value": "" }, { "name": "Handle", "value": "0x0000112a" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\lnkfile\\" } ], "repeated": 0, "id": 24743 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff55852456", "parentcaller": "0x7fff5585298d", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002676" } ], "repeated": 0, "id": 24744 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b51c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000112a" }, { "name": "ValueName", "value": "IsShortcut" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\lnkfile\\IsShortcut" } ], "repeated": 0, "id": 24745 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000112a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\lnkfile" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 24746 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000112a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 1, "id": 24747 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000112a" }, { "name": "ObjectAttributesName", "value": "ShellEx\\{000214F9-0000-0000-C000-000000000046}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\lnkfile\\ShellEx\\{000214F9-0000-0000-C000-000000000046}" } ], "repeated": 0, "id": 24748 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\lnkfile\\ShellEx\\{000214F9-0000-0000-C000-000000000046}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\lnkfile\\ShellEx\\{000214F9-0000-0000-C000-000000000046}" } ], "repeated": 0, "id": 24749 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001af2" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\.lnk" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 24750 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001af2" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 24751 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "`\\xca:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\xf2\\x1a\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xcb:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 24752 }, { "timestamp": "2026-05-29 01:05:52,165", "thread_id": "4668", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\.lnk\\ShellEx\\{000214F9-0000-0000-C000-000000000046}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\.lnk\\ShellEx\\{000214F9-0000-0000-C000-000000000046}" } ], "repeated": 0, "id": 24753 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001af2" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 24754 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002450" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00001af2" }, { "name": "ObjectAttributesName", "value": "ShellEx\\{000214F9-0000-0000-C000-000000000046}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.lnk\\ShellEx\\{000214F9-0000-0000-C000-000000000046}" } ], "repeated": 0, "id": 24755 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff58099041", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002452" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{00021401-0000-0000-C000-000000000046}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.lnk\\ShellEx\\{000214F9-0000-0000-C000-000000000046}\\(Default)" } ], "repeated": 0, "id": 24756 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d3018", "parentcaller": "0x7fff58099041", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002452" } ], "repeated": 0, "id": 24757 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff58095eff", "parentcaller": "0x7fff580969fb", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af2" } ], "repeated": 0, "id": 24758 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff58095eff", "parentcaller": "0x7fff580969fb", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000112a" } ], "repeated": 0, "id": 24759 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff558499ce", "parentcaller": "0x7fff558498a0", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "CLSID\\{00021401-0000-0000-C000-000000000046}" }, { "name": "Handle", "value": "0x0000112a" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\CLSID\\{00021401-0000-0000-C000-000000000046}" } ], "repeated": 0, "id": 24760 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff558498d6", "parentcaller": "0x7fff5584a964", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000112a" }, { "name": "ValueName", "value": "DisableProcessIsolation" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{00021401-0000-0000-C000-000000000046}\\DisableProcessIsolation" } ], "repeated": 0, "id": 24761 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff558498d6", "parentcaller": "0x7fff5584a990", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000112a" }, { "name": "ValueName", "value": "NoOplock" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{00021401-0000-0000-C000-000000000046}\\NoOplock" } ], "repeated": 0, "id": 24762 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff558498d6", "parentcaller": "0x7fff5584a9be", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000112a" }, { "name": "ValueName", "value": "UseInProcHandlerCache" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{00021401-0000-0000-C000-000000000046}\\UseInProcHandlerCache" } ], "repeated": 0, "id": 24763 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff558498d6", "parentcaller": "0x7fff5584a9d3", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000112a" }, { "name": "ValueName", "value": "UseOutOfProcHandlerCache" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{00021401-0000-0000-C000-000000000046}\\UseOutOfProcHandlerCache" } ], "repeated": 0, "id": 24764 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff5584a9f6", "parentcaller": "0x7fff558344d2", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000112a" } ], "repeated": 0, "id": 24765 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff5807fb58", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "MutexName", "value": "" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 24766 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002450" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop\\Google Chrome.lnk" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 24767 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 24768 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 24769 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 24770 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 24771 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d5783", "parentcaller": "0x7fff58090260", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002450" }, { "name": "HandleName", "value": "C:\\Users\\Public\\Desktop\\Google Chrome.lnk" }, { "name": "Buffer", "value": "L\\x00\\x00\\x00\\x01\\x14\\x02\\x00\\x00\\x00\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00F\\xdf@\\x00\\x00 \\x00\\x00\\x00\\x9f2\\xc3\\x06\\x00\\xef\\xdc\\x01\\x9f2\\xc3\\x06\\x00\\xef\\xdc\\x01r\\x96LY\\x80\\xed\\xdc\\x01\\x98\\xac@\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00#\\x02\\x14\\x00\\x1fP\\xe0O\\xd0 \\xea:i\\x10\\xa2\\xd8\\x08\\x00+00\\x9d\\x19\\x00/C:\\\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x8c\\x001\\x00\\x00\\x00\\x00\\x00\\xbd\\\\xb9\\x01\\x11\\x00PROGRA~1\\x00\\x00t\\x00\t\\x00\\x04\\x00\\xef\\xbe\\x87O\\xdbI\\xbd\\\\xb9\\x01.\\x00\\x00\\x00>\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00J\\x00\\x00\\x00\\x00\\x00\\xea\\xc9'\\x00P\\x00r\\x00o\\x00g\\x00r\\x00a\\x00m\\x00 \\x00F\\x00i\\x00l\\x00e\\x00s\\x00\\x00\\x00@\\x00s\\x00h\\x00e\\x00l\\x00l\\x003\\x002\\x00.\\x00d\\x00l\\x00l\\x00,\\x00-\\x002\\x001\\x007\\x008" }, { "name": "Length", "value": "2206" } ], "repeated": 0, "id": 24772 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 24773 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 24774 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 1, "id": 24775 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 24776 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 24777 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 24778 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 24779 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 24780 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 24781 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 1, "id": 24782 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 24783 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 24784 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 24785 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 24786 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 24787 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 24788 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 1, "id": 24789 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 24790 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 24791 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 24792 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 24793 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 24794 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 24795 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 1, "id": 24796 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 24797 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 24798 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002488" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 24799 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002488" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 24800 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" } ], "repeated": 0, "id": 24801 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 24802 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 24803 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002488" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 24804 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" }, { "name": "ValueName", "value": "MonitorRegistry" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\MonitorRegistry" } ], "repeated": 0, "id": 24805 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" } ], "repeated": 0, "id": 24806 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 24807 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 24808 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002488" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" } ], "repeated": 0, "id": 24809 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002488" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 24810 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" } ], "repeated": 0, "id": 24811 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 24812 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 24813 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002488" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" } ], "repeated": 0, "id": 24814 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002488" }, { "name": "ValueName", "value": "MonitorRegistry" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\MonitorRegistry" } ], "repeated": 0, "id": 24815 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" } ], "repeated": 0, "id": 24816 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 24817 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 24818 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 24819 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 24820 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff5780b767", "parentcaller": "0x7fff58085024", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002450" }, { "name": "HandleName", "value": "C:\\Users\\Public\\Desktop\\Google Chrome.lnk" }, { "name": "FileInformationClass", "value": "4", "pretty_value": "FileBasicInformation" }, { "name": "FileInformation", "value": "\\xb5L|\\x08\\x00\\xef\\xdc\\x01\\xcd\\xfaRK\\x07\\xef\\xdc\\x01\\xb5L|\\x08\\x00\\xef\\xdc\\x01\\xb5L|\\x08\\x00\\xef\\xdc\\x01 \\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 24821 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff5780b767", "parentcaller": "0x7fff5808504b", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002450" }, { "name": "HandleName", "value": "C:\\Users\\Public\\Desktop\\Google Chrome.lnk" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x9e\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 24822 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 24823 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 24824 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 1, "id": 24825 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 24826 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 24827 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 24828 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 24829 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 24830 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 24831 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 1, "id": 24832 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 24833 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 24834 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 24835 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 24836 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 24837 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 24838 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 1, "id": 24839 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 24840 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 24841 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 24842 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 24843 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 24844 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 24845 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 1, "id": 24846 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 24847 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 24848 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 24849 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 24850 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 24851 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 24852 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 1, "id": 24853 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 24854 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 24855 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 24856 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 24857 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 24858 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 24859 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 1, "id": 24860 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 24861 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 24862 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 24863 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 24864 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 24865 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 24866 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 1, "id": 24867 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 24868 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 24869 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 24870 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 24871 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 24872 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 24873 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 1, "id": 24874 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 24875 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 24876 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 24877 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 24878 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 24879 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 24880 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 1, "id": 24881 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 24882 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 24883 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 24884 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 24885 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 24886 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 24887 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 1, "id": 24888 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 24889 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 24890 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 24891 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 24892 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 24893 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 24894 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 1, "id": 24895 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 24896 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 24897 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 24898 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 24899 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 24900 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 24901 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 1, "id": 24902 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 24903 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 24904 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 24905 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 24906 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 24907 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 24908 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 1, "id": 24909 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 24910 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 24911 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 24912 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 24913 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 24914 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 24915 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 1, "id": 24916 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 24917 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 24918 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 24919 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 24920 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 24921 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 24922 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 1, "id": 24923 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 24924 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 24925 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 24926 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 24927 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 24928 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 24929 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 1, "id": 24930 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 24931 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 24932 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 24933 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 24934 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 24935 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 24936 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 1, "id": 24937 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 24938 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 24939 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 24940 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 24941 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 24942 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 24943 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 1, "id": 24944 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 24945 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 24946 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 24947 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 24948 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 24949 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 24950 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 1, "id": 24951 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 24952 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 24953 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 24954 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 24955 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 24956 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 24957 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 1, "id": 24958 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 24959 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 24960 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 24961 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 24962 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 24963 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 24964 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 1, "id": 24965 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 24966 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 24967 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 24968 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 24969 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 24970 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 24971 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 1, "id": 24972 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff557b4361", "parentcaller": "0x7fff557b3e47", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 24973 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58080032", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 24974 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5807fd7f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002450" } ], "repeated": 0, "id": 24975 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5807fdaa", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 24976 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5807fdca", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 24977 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 24978 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 24979 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001af0" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 24980 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 24981 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 24982 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 24983 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 24984 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001af0" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 24985 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "ValueName", "value": "MonitorRegistry" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\MonitorRegistry" } ], "repeated": 0, "id": 24986 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 24987 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 24988 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 24989 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001af0" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" } ], "repeated": 0, "id": 24990 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 24991 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 24992 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 24993 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 24994 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001af0" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" } ], "repeated": 0, "id": 24995 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "ValueName", "value": "MonitorRegistry" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\MonitorRegistry" } ], "repeated": 0, "id": 24996 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 24997 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff55848063", "parentcaller": "0x7fff55848ae6", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" }, { "name": "Handle", "value": "0x00001af0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" } ], "repeated": 0, "id": 24998 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff558480b3", "parentcaller": "0x7fff55848ae6", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001af0" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 24999 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff558480df", "parentcaller": "0x7fff55848ae6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 25000 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff5585204d", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00001af0" } ], "repeated": 0, "id": 25001 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff558520a2", "parentcaller": "0x7fff55851f69", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "18" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 25002 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff55852301", "parentcaller": "0x7fff55851f69", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "20" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 25003 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5585211d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 25004 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff58081596", "parentcaller": "0x7fff58ac668d", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": ".exe" }, { "name": "Handle", "value": "0x00001af2" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\.exe" } ], "repeated": 0, "id": 25005 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff5808ab55", "parentcaller": "0x7fff5585290f", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af2" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "exefile" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.exe\\(Default)" } ], "repeated": 0, "id": 25006 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff55853405", "parentcaller": "0x7fff55852415", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "exefile" }, { "name": "Handle", "value": "0x00002452" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\exefile" } ], "repeated": 0, "id": 25007 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002452" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\exefile" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 25008 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002452" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 25009 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x00\\xbf:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00R$\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 25010 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\exefile\\CurVer" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\exefile\\CurVer" } ], "repeated": 0, "id": 25011 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002452" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 25012 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00002452" }, { "name": "ObjectAttributesName", "value": "CurVer" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\CurVer" } ], "repeated": 0, "id": 25013 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff58081596", "parentcaller": "0x7fff58ac668d", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002452" }, { "name": "SubKey", "value": "" }, { "name": "Handle", "value": "0x0000248a" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\" } ], "repeated": 0, "id": 25014 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff55852456", "parentcaller": "0x7fff5585298d", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002452" } ], "repeated": 0, "id": 25015 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b51c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000248a" }, { "name": "ValueName", "value": "IsShortcut" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\IsShortcut" } ], "repeated": 0, "id": 25016 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000248a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\exefile" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 25017 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000248a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 25018 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xd0\\xc1:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\x8a$\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xc2:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 25019 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\exefile\\ShellEx\\{000214F9-0000-0000-C000-000000000046}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\exefile\\ShellEx\\{000214F9-0000-0000-C000-000000000046}" } ], "repeated": 0, "id": 25020 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000248a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 25021 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000248a" }, { "name": "ObjectAttributesName", "value": "ShellEx\\{000214F9-0000-0000-C000-000000000046}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\ShellEx\\{000214F9-0000-0000-C000-000000000046}" } ], "repeated": 0, "id": 25022 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001af2" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\.exe" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 25023 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001af2" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 25024 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xf0\\xc1:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\xf2\\x1a\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xc2:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 25025 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\.exe\\ShellEx\\{000214F9-0000-0000-C000-000000000046}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\.exe\\ShellEx\\{000214F9-0000-0000-C000-000000000046}" } ], "repeated": 0, "id": 25026 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001af2" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 25027 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00001af2" }, { "name": "ObjectAttributesName", "value": "ShellEx\\{000214F9-0000-0000-C000-000000000046}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.exe\\ShellEx\\{000214F9-0000-0000-C000-000000000046}" } ], "repeated": 0, "id": 25028 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff58081596", "parentcaller": "0x7fff58ac668d", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "SystemFileAssociations\\.exe" }, { "name": "Handle", "value": "0x00002452" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\SystemFileAssociations\\.exe" } ], "repeated": 0, "id": 25029 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002452" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\SystemFileAssociations\\.exe" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 25030 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002452" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 25031 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xe0\\xc1:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00R$\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xc2:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 25032 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\SystemFileAssociations\\.exe\\ShellEx\\{000214F9-0000-0000-C000-000000000046}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\SystemFileAssociations\\.exe\\ShellEx\\{000214F9-0000-0000-C000-000000000046}" } ], "repeated": 0, "id": 25033 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002452" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 25034 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00002452" }, { "name": "ObjectAttributesName", "value": "ShellEx\\{000214F9-0000-0000-C000-000000000046}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\SystemFileAssociations\\.exe\\ShellEx\\{000214F9-0000-0000-C000-000000000046}" } ], "repeated": 0, "id": 25035 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000248a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\exefile" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 25036 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000248a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 25037 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x00\\xc1:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\x8a$\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc2:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 25038 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\exefile\\Clsid" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\exefile\\Clsid" } ], "repeated": 0, "id": 25039 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000248a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 25040 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000248a" }, { "name": "ObjectAttributesName", "value": "Clsid" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\Clsid" } ], "repeated": 0, "id": 25041 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff58081596", "parentcaller": "0x7fff58ac668d", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "*" }, { "name": "Handle", "value": "0x00002526" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\*" } ], "repeated": 0, "id": 25042 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002526" }, { "name": "KeyInformation", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\*" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 25043 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002526" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 1, "id": 25044 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00002526" }, { "name": "ObjectAttributesName", "value": "ShellEx\\{000214F9-0000-0000-C000-000000000046}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\*\\ShellEx\\{000214F9-0000-0000-C000-000000000046}" } ], "repeated": 0, "id": 25045 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\*\\ShellEx\\{000214F9-0000-0000-C000-000000000046}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\*\\ShellEx\\{000214F9-0000-0000-C000-000000000046}" } ], "repeated": 0, "id": 25046 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff58081596", "parentcaller": "0x7fff58ac668d", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "AllFilesystemObjects" }, { "name": "Handle", "value": "0x00002416" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\AllFilesystemObjects" } ], "repeated": 0, "id": 25047 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002416" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 25048 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002416" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 25049 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xe0\\xc1:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\x16$\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xc2:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 25050 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\AllFilesystemObjects\\ShellEx\\{000214F9-0000-0000-C000-000000000046}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\AllFilesystemObjects\\ShellEx\\{000214F9-0000-0000-C000-000000000046}" } ], "repeated": 0, "id": 25051 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002416" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 25052 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00002416" }, { "name": "ObjectAttributesName", "value": "ShellEx\\{000214F9-0000-0000-C000-000000000046}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\ShellEx\\{000214F9-0000-0000-C000-000000000046}" } ], "repeated": 0, "id": 25053 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff58095eff", "parentcaller": "0x7fff580969fb", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af2" } ], "repeated": 0, "id": 25054 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff58095eff", "parentcaller": "0x7fff580969fb", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000248a" } ], "repeated": 0, "id": 25055 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff58095eff", "parentcaller": "0x7fff580969fb", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002452" } ], "repeated": 0, "id": 25056 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff58095eff", "parentcaller": "0x7fff580969fb", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002526" } ], "repeated": 0, "id": 25057 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff58095eff", "parentcaller": "0x7fff580969fb", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002416" } ], "repeated": 0, "id": 25058 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff557c0016", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001128" } ], "repeated": 0, "id": 25059 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff52874c3e", "parentcaller": "0x7fff52878a3f", "category": "system", "api": "GetUserDefaultLCID", "status": true, "return": "0x00000c09", "arguments": [ { "name": "SystemDefaultLangID", "value": "0x00000c09" }, { "name": "LanguageName", "value": "English (Australia)" } ], "repeated": 11, "id": 25060 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432c5686", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25061 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432c5686", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001128" }, { "name": "Milliseconds", "value": "600000" } ], "repeated": 0, "id": 25062 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 25063 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff432c5ded", "parentcaller": "0x7fff432c56be", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "AB8902B4-09CA-4BB6-B78D-A8F59079A8D5" }, { "name": "ClsContext", "value": "0x00004004", "pretty_value": "CLSCTX_LOCAL_SERVER|CLSCTX_NO_FAILURE_LOG" }, { "name": "riid", "value": "75121952-E0D0-43E5-9380-1D80483ACF72" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 25064 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff432c5d25", "parentcaller": "0x7fff432c56d1", "category": "system", "api": "CreateTimerQueueTimer", "status": true, "return": "0x00000001", "arguments": [ { "name": "phNewTimer", "value": "0x0cad5410" }, { "name": "TimerQueue", "value": "0x00000000" }, { "name": "Callback", "value": "0x432ed350" }, { "name": "Parameter", "value": "0x033aea60" }, { "name": "DueTime", "value": "60000" }, { "name": "Period", "value": "1000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 25065 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xf9\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00<\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4668" } ], "repeated": 0, "id": 25066 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58085ee4", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002048" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 25067 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 25068 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 25069 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4620", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25070 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4620", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000360" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 25071 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4620", "caller": "0x7fff59f86798", "parentcaller": "0x7fff5780ced6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 25072 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4620", "caller": "0x7fff59f867b9", "parentcaller": "0x7fff5780ced6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 25073 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4620", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25074 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4620", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000360" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 25075 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 25076 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff5585204d", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000494" } ], "repeated": 0, "id": 25077 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff558520a2", "parentcaller": "0x7fff55851f69", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "18" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 25078 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff55852301", "parentcaller": "0x7fff55851f69", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "20" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 25079 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5585211d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 25080 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff58081596", "parentcaller": "0x7fff58ac668d", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": ".lnk" }, { "name": "Handle", "value": "0x00000496" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\.lnk" } ], "repeated": 0, "id": 25081 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff5808ab55", "parentcaller": "0x7fff5585290f", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000496" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "lnkfile" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.lnk\\(Default)" } ], "repeated": 0, "id": 25082 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff55853405", "parentcaller": "0x7fff55852415", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "lnkfile" }, { "name": "Handle", "value": "0x000025c6" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\lnkfile" } ], "repeated": 0, "id": 25083 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000025c6" }, { "name": "KeyInformation", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\lnkfile" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 25084 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000025c6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 1, "id": 25085 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000025c6" }, { "name": "ObjectAttributesName", "value": "CurVer" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\lnkfile\\CurVer" } ], "repeated": 0, "id": 25086 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\lnkfile\\CurVer" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\lnkfile\\CurVer" } ], "repeated": 0, "id": 25087 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff58081596", "parentcaller": "0x7fff58ac668d", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000025c6" }, { "name": "SubKey", "value": "" }, { "name": "Handle", "value": "0x000026fe" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\lnkfile\\" } ], "repeated": 0, "id": 25088 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff55852456", "parentcaller": "0x7fff5585298d", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025c6" } ], "repeated": 0, "id": 25089 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b51c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026fe" }, { "name": "ValueName", "value": "IsShortcut" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\lnkfile\\IsShortcut" } ], "repeated": 0, "id": 25090 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000026fe" }, { "name": "KeyInformation", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\lnkfile" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 25091 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000026fe" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 1, "id": 25092 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000026fe" }, { "name": "ObjectAttributesName", "value": "ShellEx\\{e357fccd-a995-4576-b01f-234630154e96}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\lnkfile\\ShellEx\\{e357fccd-a995-4576-b01f-234630154e96}" } ], "repeated": 0, "id": 25093 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\lnkfile\\ShellEx\\{e357fccd-a995-4576-b01f-234630154e96}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\lnkfile\\ShellEx\\{e357fccd-a995-4576-b01f-234630154e96}" } ], "repeated": 0, "id": 25094 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000496" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\.lnk" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 25095 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000496" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 25096 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xcc:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\x96\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\xcd:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 25097 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\.lnk\\ShellEx\\{e357fccd-a995-4576-b01f-234630154e96}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\.lnk\\ShellEx\\{e357fccd-a995-4576-b01f-234630154e96}" } ], "repeated": 0, "id": 25098 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000496" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 25099 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000025c4" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000496" }, { "name": "ObjectAttributesName", "value": "ShellEx\\{e357fccd-a995-4576-b01f-234630154e96}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.lnk\\ShellEx\\{e357fccd-a995-4576-b01f-234630154e96}" } ], "repeated": 0, "id": 25100 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff58099041", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025c6" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{00021401-0000-0000-C000-000000000046}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.lnk\\ShellEx\\{E357FCCD-A995-4576-B01F-234630154E96}\\(Default)" } ], "repeated": 0, "id": 25101 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d3018", "parentcaller": "0x7fff58099041", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025c6" } ], "repeated": 0, "id": 25102 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff58095eff", "parentcaller": "0x7fff580969fb", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000496" } ], "repeated": 0, "id": 25103 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff58095eff", "parentcaller": "0x7fff580969fb", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026fe" } ], "repeated": 0, "id": 25104 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff558499ce", "parentcaller": "0x7fff558498a0", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "CLSID\\{00021401-0000-0000-C000-000000000046}" }, { "name": "Handle", "value": "0x000026fe" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\CLSID\\{00021401-0000-0000-C000-000000000046}" } ], "repeated": 0, "id": 25105 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff558498d6", "parentcaller": "0x7fff5584a964", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026fe" }, { "name": "ValueName", "value": "DisableProcessIsolation" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{00021401-0000-0000-C000-000000000046}\\DisableProcessIsolation" } ], "repeated": 0, "id": 25106 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff558498d6", "parentcaller": "0x7fff5584a990", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026fe" }, { "name": "ValueName", "value": "NoOplock" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{00021401-0000-0000-C000-000000000046}\\NoOplock" } ], "repeated": 0, "id": 25107 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff558498d6", "parentcaller": "0x7fff5584a9be", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000026fe" }, { "name": "ValueName", "value": "UseInProcHandlerCache" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{00021401-0000-0000-C000-000000000046}\\UseInProcHandlerCache" } ], "repeated": 0, "id": 25108 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff558498d6", "parentcaller": "0x7fff5584a9d3", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000026fe" }, { "name": "ValueName", "value": "UseOutOfProcHandlerCache" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{00021401-0000-0000-C000-000000000046}\\UseOutOfProcHandlerCache" } ], "repeated": 0, "id": 25109 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff5584a9f6", "parentcaller": "0x7fff558344d2", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026fe" } ], "repeated": 0, "id": 25110 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff55848063", "parentcaller": "0x7fff55848ae6", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" }, { "name": "Handle", "value": "0x00000494" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" } ], "repeated": 0, "id": 25111 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff558480b3", "parentcaller": "0x7fff55848ae6", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000494" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 25112 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff558480df", "parentcaller": "0x7fff55848ae6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 25113 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff558499ce", "parentcaller": "0x7fff558498a0", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "CLSID\\{00021401-0000-0000-C000-000000000046}" }, { "name": "Handle", "value": "0x00000496" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\CLSID\\{00021401-0000-0000-C000-000000000046}" } ], "repeated": 0, "id": 25114 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff558498d6", "parentcaller": "0x7fff55849723", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000496" }, { "name": "ValueName", "value": "EnableShareDenyNone" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{00021401-0000-0000-C000-000000000046}\\EnableShareDenyNone" } ], "repeated": 0, "id": 25115 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff5807c5e9", "parentcaller": "0x7fff5807fc58", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "E2EB4CA4-C96E-4DA4-94B1-673C8334A5BB" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "265CFCAA-9B0C-44CA-996F-4A6F6620C72D" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 25116 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff5807ce6f", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025c4" }, { "name": "MutexName", "value": "" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 25117 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff5781c37f", "parentcaller": "0x7fff5781c2fc", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 25118 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d6579", "parentcaller": "0x7fff5781c32f", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000f80" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop\\Google Chrome.lnk" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 25119 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff58096fcb", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000f80" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002318" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 25120 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff57fc5921", "parentcaller": "0x7fff58097162", "category": "device", "api": "DeviceIoControl", "status": false, "return": "0x00000000", "arguments": [ { "name": "DeviceHandle", "value": "0x00002318" }, { "name": "IoControlCode", "value": "0x00090240" }, { "name": "InBuffer", "value": "\\x01\\x00\\x0c\\x00\\x03\\x00\\x00\\x00\\x01\\x00\\x00\\x00" }, { "name": "OutBuffer", "value": "" } ], "repeated": 0, "id": 25121 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5809bd52", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f80" } ], "repeated": 0, "id": 25122 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58080032", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025c4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 25123 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff5807d391", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f80" }, { "name": "MutexName", "value": "" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 25124 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000268c" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop\\Google Chrome.lnk" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 25125 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5807d1cc", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025c4" } ], "repeated": 0, "id": 25126 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58080032", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025c4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 25127 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5807905d", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025c4" } ], "repeated": 0, "id": 25128 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5809b0b5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025c4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 25129 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f80" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 25130 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25131 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f80" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 25132 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f80" } ], "repeated": 0, "id": 25133 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5809b106", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25134 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5809b106", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025c4" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 25135 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5809b122", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025c4" } ], "repeated": 0, "id": 25136 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff57814097", "parentcaller": "0x7fff5807a6a8", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000268c" }, { "name": "HandleName", "value": "C:\\Users\\Public\\Desktop\\Google Chrome.lnk" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x9e\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 25137 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577cf0e1", "parentcaller": "0x7fff577cef40", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002368" }, { "name": "DesiredAccess", "value": "0x000f0005", "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x0000268c" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop\\Google Chrome.lnk" } ], "repeated": 0, "id": 25138 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002368" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08b10000" }, { "name": "SectionOffset", "value": "0x033ad6f0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 25139 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5809abbd", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25140 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5809abbd", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025c4" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 25141 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25142 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f80" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 25143 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f80" } ], "repeated": 1, "id": 25144 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5809ac06", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025c4" } ], "repeated": 1, "id": 25145 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 25146 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 25147 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002284" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 25148 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002284" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 25149 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002284" } ], "repeated": 0, "id": 25150 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 25151 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 25152 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002284" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 25153 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002284" }, { "name": "ValueName", "value": "MonitorRegistry" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\MonitorRegistry" } ], "repeated": 0, "id": 25154 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002284" } ], "repeated": 0, "id": 25155 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 25156 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 25157 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002284" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" } ], "repeated": 0, "id": 25158 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002284" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 25159 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002284" } ], "repeated": 0, "id": 25160 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 25161 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 25162 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002284" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" } ], "repeated": 0, "id": 25163 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002284" }, { "name": "ValueName", "value": "MonitorRegistry" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\MonitorRegistry" } ], "repeated": 0, "id": 25164 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002284" } ], "repeated": 0, "id": 25165 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d1e5c", "parentcaller": "0x7fff58090a54", "category": "filesystem", "api": "NtQueryFullAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Users\\Public\\Desktop\\Google Chrome.lnk" } ], "repeated": 0, "id": 25166 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff557b4361", "parentcaller": "0x7fff557b3e47", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25167 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58080032", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025c4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 25168 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff580912fe", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025c4" } ], "repeated": 0, "id": 25169 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff5807aeaa", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08b10000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 25170 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5807af2c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002368" } ], "repeated": 0, "id": 25171 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58080032", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f80" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 25172 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5807fd7f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" } ], "repeated": 0, "id": 25173 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5807fdaa", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f80" } ], "repeated": 0, "id": 25174 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5807fdca", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f80" } ], "repeated": 0, "id": 25175 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5807ea94", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002318" } ], "repeated": 0, "id": 25176 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5807eabd", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000023a0" } ], "repeated": 0, "id": 25177 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5807c972", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025c4" } ], "repeated": 0, "id": 25178 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff59f5c23a", "parentcaller": "0x7fff59f5c30d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" } ], "repeated": 0, "id": 25179 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff558497da", "parentcaller": "0x7fff55849057", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000496" } ], "repeated": 0, "id": 25180 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d07f5", "parentcaller": "0x7fff577cc03b", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" } ], "repeated": 0, "id": 25181 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xf9\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00<\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4668" } ], "repeated": 0, "id": 25182 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58085ee4", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002048" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 25183 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 25184 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 25185 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4620", "caller": "0x7fff59f86798", "parentcaller": "0x7fff5780ced6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002414" } ], "repeated": 0, "id": 25186 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4620", "caller": "0x7fff59f867b9", "parentcaller": "0x7fff5780ced6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002524" } ], "repeated": 0, "id": 25187 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 25188 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff5585204d", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002518" } ], "repeated": 0, "id": 25189 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff55852301", "parentcaller": "0x7fff55851f69", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "20" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 25190 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5585211d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002518" } ], "repeated": 0, "id": 25191 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff58081596", "parentcaller": "0x7fff58ac668d", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": ".exe" }, { "name": "Handle", "value": "0x0000251a" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\.exe" } ], "repeated": 0, "id": 25192 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff5808ab55", "parentcaller": "0x7fff5585290f", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000251a" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "exefile" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.exe\\(Default)" } ], "repeated": 0, "id": 25193 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff55853405", "parentcaller": "0x7fff55852415", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "exefile" }, { "name": "Handle", "value": "0x000026ae" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\exefile" } ], "repeated": 0, "id": 25194 }, { "timestamp": "2026-05-29 01:05:52,180", "thread_id": "4668", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000026ae" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\exefile" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 25195 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000026ae" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 25196 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xe0\\xc8:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\xae&\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xc9:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 25197 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\exefile\\CurVer" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\exefile\\CurVer" } ], "repeated": 0, "id": 25198 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000026ae" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 25199 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000026ae" }, { "name": "ObjectAttributesName", "value": "CurVer" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\CurVer" } ], "repeated": 0, "id": 25200 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff58081596", "parentcaller": "0x7fff58ac668d", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000026ae" }, { "name": "SubKey", "value": "" }, { "name": "Handle", "value": "0x00002616" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\" } ], "repeated": 0, "id": 25201 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff55852456", "parentcaller": "0x7fff5585298d", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ae" } ], "repeated": 0, "id": 25202 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b51c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002616" }, { "name": "ValueName", "value": "IsShortcut" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\IsShortcut" } ], "repeated": 0, "id": 25203 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002616" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\exefile" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 25204 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002616" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 25205 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xcb:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\x16&\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\xcc:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 25206 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\exefile\\ShellEx\\{e357fccd-a995-4576-b01f-234630154e96}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\exefile\\ShellEx\\{e357fccd-a995-4576-b01f-234630154e96}" } ], "repeated": 0, "id": 25207 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002616" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 25208 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00002616" }, { "name": "ObjectAttributesName", "value": "ShellEx\\{e357fccd-a995-4576-b01f-234630154e96}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\ShellEx\\{e357fccd-a995-4576-b01f-234630154e96}" } ], "repeated": 0, "id": 25209 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000251a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\.exe" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 25210 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000251a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 25211 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xd0\\xcb:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\x1a%\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xcc:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 25212 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\.exe\\ShellEx\\{e357fccd-a995-4576-b01f-234630154e96}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\.exe\\ShellEx\\{e357fccd-a995-4576-b01f-234630154e96}" } ], "repeated": 0, "id": 25213 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000251a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 25214 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000251a" }, { "name": "ObjectAttributesName", "value": "ShellEx\\{e357fccd-a995-4576-b01f-234630154e96}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.exe\\ShellEx\\{e357fccd-a995-4576-b01f-234630154e96}" } ], "repeated": 0, "id": 25215 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff58081596", "parentcaller": "0x7fff58ac668d", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "SystemFileAssociations\\.exe" }, { "name": "Handle", "value": "0x000026ae" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\SystemFileAssociations\\.exe" } ], "repeated": 0, "id": 25216 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000026ae" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\SystemFileAssociations\\.exe" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 25217 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000026ae" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 25218 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xc0\\xcb:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\xae&\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\xcc:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 25219 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\SystemFileAssociations\\.exe\\ShellEx\\{e357fccd-a995-4576-b01f-234630154e96}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\SystemFileAssociations\\.exe\\ShellEx\\{e357fccd-a995-4576-b01f-234630154e96}" } ], "repeated": 0, "id": 25220 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000026ae" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 25221 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000026ae" }, { "name": "ObjectAttributesName", "value": "ShellEx\\{e357fccd-a995-4576-b01f-234630154e96}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\SystemFileAssociations\\.exe\\ShellEx\\{e357fccd-a995-4576-b01f-234630154e96}" } ], "repeated": 0, "id": 25222 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002616" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\exefile" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 25223 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002616" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 25224 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xe0\\xca:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\x16&\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xcb:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 25225 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\exefile\\Clsid" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\exefile\\Clsid" } ], "repeated": 0, "id": 25226 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002616" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 25227 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00002616" }, { "name": "ObjectAttributesName", "value": "Clsid" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\Clsid" } ], "repeated": 0, "id": 25228 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff58081596", "parentcaller": "0x7fff58ac668d", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "*" }, { "name": "Handle", "value": "0x00002346" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\*" } ], "repeated": 0, "id": 25229 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002346" }, { "name": "KeyInformation", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\*" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 25230 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002346" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 1, "id": 25231 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00002346" }, { "name": "ObjectAttributesName", "value": "ShellEx\\{e357fccd-a995-4576-b01f-234630154e96}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\*\\ShellEx\\{e357fccd-a995-4576-b01f-234630154e96}" } ], "repeated": 0, "id": 25232 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\*\\ShellEx\\{e357fccd-a995-4576-b01f-234630154e96}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\*\\ShellEx\\{e357fccd-a995-4576-b01f-234630154e96}" } ], "repeated": 0, "id": 25233 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff58081596", "parentcaller": "0x7fff58ac668d", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "AllFilesystemObjects" }, { "name": "Handle", "value": "0x000024ba" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\AllFilesystemObjects" } ], "repeated": 0, "id": 25234 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000024ba" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 25235 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000024ba" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 25236 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xc0\\xcb:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\xba$\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\xcc:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 25237 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\AllFilesystemObjects\\ShellEx\\{e357fccd-a995-4576-b01f-234630154e96}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\AllFilesystemObjects\\ShellEx\\{e357fccd-a995-4576-b01f-234630154e96}" } ], "repeated": 0, "id": 25238 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000024ba" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 25239 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000024ba" }, { "name": "ObjectAttributesName", "value": "ShellEx\\{e357fccd-a995-4576-b01f-234630154e96}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\ShellEx\\{e357fccd-a995-4576-b01f-234630154e96}" } ], "repeated": 0, "id": 25240 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff58095eff", "parentcaller": "0x7fff580969fb", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000251a" } ], "repeated": 0, "id": 25241 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff58095eff", "parentcaller": "0x7fff580969fb", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002616" } ], "repeated": 0, "id": 25242 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff58095eff", "parentcaller": "0x7fff580969fb", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ae" } ], "repeated": 0, "id": 25243 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff58095eff", "parentcaller": "0x7fff580969fb", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002346" } ], "repeated": 0, "id": 25244 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff58095eff", "parentcaller": "0x7fff580969fb", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024ba" } ], "repeated": 0, "id": 25245 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xf9\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00<\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4668" } ], "repeated": 0, "id": 25246 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58085ee4", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002048" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 25247 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 25248 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 25249 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4620", "caller": "0x7fff59f86798", "parentcaller": "0x7fff5780ced6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 25250 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4620", "caller": "0x7fff59f867b9", "parentcaller": "0x7fff5780ced6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" } ], "repeated": 0, "id": 25251 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 25252 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff558520a2", "parentcaller": "0x7fff55851f69", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "18" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 25253 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff55852301", "parentcaller": "0x7fff55851f69", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "20" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 25254 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5585211d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 25255 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff58081596", "parentcaller": "0x7fff58ac668d", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": ".exe" }, { "name": "Handle", "value": "0x00000496" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\.exe" } ], "repeated": 0, "id": 25256 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff5808ab55", "parentcaller": "0x7fff5585290f", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000496" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "exefile" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.exe\\(Default)" } ], "repeated": 0, "id": 25257 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff55853405", "parentcaller": "0x7fff55852415", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "exefile" }, { "name": "Handle", "value": "0x000022e6" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\exefile" } ], "repeated": 0, "id": 25258 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000022e6" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\exefile" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 25259 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000022e6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 25260 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "p\\xc7:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\xe6\"\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xc8:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 25261 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\exefile\\CurVer" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\exefile\\CurVer" } ], "repeated": 0, "id": 25262 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000022e6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 25263 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000022e6" }, { "name": "ObjectAttributesName", "value": "CurVer" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\CurVer" } ], "repeated": 0, "id": 25264 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff58081596", "parentcaller": "0x7fff58ac668d", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000022e6" }, { "name": "SubKey", "value": "" }, { "name": "Handle", "value": "0x000025c6" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\" } ], "repeated": 0, "id": 25265 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff55852456", "parentcaller": "0x7fff5585298d", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e6" } ], "repeated": 0, "id": 25266 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b51c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000025c6" }, { "name": "ValueName", "value": "IsShortcut" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\IsShortcut" } ], "repeated": 0, "id": 25267 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000025c6" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\exefile" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 25268 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000025c6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 25269 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "@\\xca:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\xc6%\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xcb:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 25270 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\exefile\\ShellEx\\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\exefile\\ShellEx\\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1}" } ], "repeated": 0, "id": 25271 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000025c6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 25272 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000025c6" }, { "name": "ObjectAttributesName", "value": "ShellEx\\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\ShellEx\\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1}" } ], "repeated": 0, "id": 25273 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000496" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\.exe" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 25274 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000496" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 25275 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "`\\xca:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\x96\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xcb:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 25276 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\.exe\\ShellEx\\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\.exe\\ShellEx\\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1}" } ], "repeated": 0, "id": 25277 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000496" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 25278 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000496" }, { "name": "ObjectAttributesName", "value": "ShellEx\\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.exe\\ShellEx\\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1}" } ], "repeated": 0, "id": 25279 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff58081596", "parentcaller": "0x7fff58ac668d", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "SystemFileAssociations\\.exe" }, { "name": "Handle", "value": "0x000022e6" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\SystemFileAssociations\\.exe" } ], "repeated": 0, "id": 25280 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000022e6" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\SystemFileAssociations\\.exe" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 25281 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000022e6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 25282 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xca:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\xe6\"\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xcb:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 25283 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\SystemFileAssociations\\.exe\\ShellEx\\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\SystemFileAssociations\\.exe\\ShellEx\\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1}" } ], "repeated": 0, "id": 25284 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000022e6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 25285 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000022e6" }, { "name": "ObjectAttributesName", "value": "ShellEx\\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\SystemFileAssociations\\.exe\\ShellEx\\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1}" } ], "repeated": 0, "id": 25286 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000025c6" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\exefile" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 25287 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000025c6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 25288 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "p\\xc9:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\xc6%\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xca:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 25289 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\exefile\\Clsid" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\exefile\\Clsid" } ], "repeated": 0, "id": 25290 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000025c6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 25291 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000025c6" }, { "name": "ObjectAttributesName", "value": "Clsid" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\Clsid" } ], "repeated": 0, "id": 25292 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff58081596", "parentcaller": "0x7fff58ac668d", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "*" }, { "name": "Handle", "value": "0x000023a2" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\*" } ], "repeated": 0, "id": 25293 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000023a2" }, { "name": "KeyInformation", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\*" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 25294 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000023a2" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 1, "id": 25295 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000023a2" }, { "name": "ObjectAttributesName", "value": "ShellEx\\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\*\\ShellEx\\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1}" } ], "repeated": 0, "id": 25296 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\*\\ShellEx\\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\*\\ShellEx\\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1}" } ], "repeated": 0, "id": 25297 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff58081596", "parentcaller": "0x7fff58ac668d", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "AllFilesystemObjects" }, { "name": "Handle", "value": "0x0000231a" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\AllFilesystemObjects" } ], "repeated": 0, "id": 25298 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000231a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 25299 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000231a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 25300 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xca:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\x1a#\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xcb:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 25301 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\AllFilesystemObjects\\ShellEx\\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\AllFilesystemObjects\\ShellEx\\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1}" } ], "repeated": 0, "id": 25302 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000231a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 25303 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000231a" }, { "name": "ObjectAttributesName", "value": "ShellEx\\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\ShellEx\\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1}" } ], "repeated": 0, "id": 25304 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff58095eff", "parentcaller": "0x7fff580969fb", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000496" } ], "repeated": 0, "id": 25305 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff58095eff", "parentcaller": "0x7fff580969fb", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025c6" } ], "repeated": 0, "id": 25306 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff58095eff", "parentcaller": "0x7fff580969fb", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e6" } ], "repeated": 0, "id": 25307 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff58095eff", "parentcaller": "0x7fff580969fb", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000023a2" } ], "repeated": 0, "id": 25308 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff58095eff", "parentcaller": "0x7fff580969fb", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000231a" } ], "repeated": 0, "id": 25309 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff557c0016", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026fc" } ], "repeated": 0, "id": 25310 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25311 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000c7c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 25312 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432cbf4b", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001128" } ], "repeated": 0, "id": 25313 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff5807fb58", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "MutexName", "value": "" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 25314 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000242c" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop\\Google Chrome.lnk" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 25315 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 25316 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25317 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 25318 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 25319 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d5783", "parentcaller": "0x7fff58090260", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000242c" }, { "name": "HandleName", "value": "C:\\Users\\Public\\Desktop\\Google Chrome.lnk" }, { "name": "Buffer", "value": "L\\x00\\x00\\x00\\x01\\x14\\x02\\x00\\x00\\x00\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00F\\xdf@\\x00\\x00 \\x00\\x00\\x00\\x9f2\\xc3\\x06\\x00\\xef\\xdc\\x01\\x9f2\\xc3\\x06\\x00\\xef\\xdc\\x01r\\x96LY\\x80\\xed\\xdc\\x01\\x98\\xac@\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00#\\x02\\x14\\x00\\x1fP\\xe0O\\xd0 \\xea:i\\x10\\xa2\\xd8\\x08\\x00+00\\x9d\\x19\\x00/C:\\\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x8c\\x001\\x00\\x00\\x00\\x00\\x00\\xbd\\\\xb9\\x01\\x11\\x00PROGRA~1\\x00\\x00t\\x00\t\\x00\\x04\\x00\\xef\\xbe\\x87O\\xdbI\\xbd\\\\xb9\\x01.\\x00\\x00\\x00>\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00J\\x00\\x00\\x00\\x00\\x00\\xea\\xc9'\\x00P\\x00r\\x00o\\x00g\\x00r\\x00a\\x00m\\x00 \\x00F\\x00i\\x00l\\x00e\\x00s\\x00\\x00\\x00@\\x00s\\x00h\\x00e\\x00l\\x00l\\x003\\x002\\x00.\\x00d\\x00l\\x00l\\x00,\\x00-\\x002\\x001\\x007\\x008" }, { "name": "Length", "value": "2206" } ], "repeated": 0, "id": 25320 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25321 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 25322 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 1, "id": 25323 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 25324 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25325 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 25326 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 25327 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25328 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 25329 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 1, "id": 25330 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 25331 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25332 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 25333 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 25334 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25335 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 25336 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 1, "id": 25337 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 25338 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25339 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 25340 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 25341 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25342 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 25343 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 1, "id": 25344 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 25345 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 25346 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002278" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 25347 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002278" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 25348 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002278" } ], "repeated": 0, "id": 25349 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 25350 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 25351 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002278" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 25352 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002278" }, { "name": "ValueName", "value": "MonitorRegistry" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\MonitorRegistry" } ], "repeated": 0, "id": 25353 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002278" } ], "repeated": 0, "id": 25354 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 25355 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 25356 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002278" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" } ], "repeated": 0, "id": 25357 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002278" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 25358 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002278" } ], "repeated": 0, "id": 25359 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 25360 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 25361 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002278" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" } ], "repeated": 0, "id": 25362 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002278" }, { "name": "ValueName", "value": "MonitorRegistry" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\MonitorRegistry" } ], "repeated": 0, "id": 25363 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002278" } ], "repeated": 0, "id": 25364 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 25365 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25366 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 25367 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 25368 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff5780b767", "parentcaller": "0x7fff58085024", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000242c" }, { "name": "HandleName", "value": "C:\\Users\\Public\\Desktop\\Google Chrome.lnk" }, { "name": "FileInformationClass", "value": "4", "pretty_value": "FileBasicInformation" }, { "name": "FileInformation", "value": "\\xb5L|\\x08\\x00\\xef\\xdc\\x01\\x00^UK\\x07\\xef\\xdc\\x01\\xb5L|\\x08\\x00\\xef\\xdc\\x01\\xb5L|\\x08\\x00\\xef\\xdc\\x01 \\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 25369 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff5780b767", "parentcaller": "0x7fff5808504b", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000242c" }, { "name": "HandleName", "value": "C:\\Users\\Public\\Desktop\\Google Chrome.lnk" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x9e\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 25370 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25371 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 25372 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 1, "id": 25373 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 25374 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25375 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 25376 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 25377 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25378 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 25379 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 1, "id": 25380 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 25381 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25382 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 25383 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 25384 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25385 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 25386 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 1, "id": 25387 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 25388 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25389 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 25390 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 25391 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25392 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 25393 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 1, "id": 25394 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 25395 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25396 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 25397 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 25398 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25399 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 25400 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 1, "id": 25401 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 25402 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25403 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 25404 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 25405 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25406 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 25407 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 1, "id": 25408 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 25409 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25410 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 25411 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 25412 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25413 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 25414 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 1, "id": 25415 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 25416 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25417 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 25418 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 25419 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25420 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 25421 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 1, "id": 25422 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 25423 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25424 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 25425 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 25426 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25427 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 25428 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 1, "id": 25429 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 25430 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25431 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 25432 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 25433 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25434 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 25435 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 1, "id": 25436 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 25437 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25438 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 25439 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 25440 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25441 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 25442 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 1, "id": 25443 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 25444 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25445 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 25446 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 25447 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25448 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 25449 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 1, "id": 25450 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 25451 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25452 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 25453 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 25454 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25455 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 25456 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 1, "id": 25457 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 25458 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25459 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 25460 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 25461 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25462 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 25463 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 1, "id": 25464 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 25465 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25466 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 25467 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 25468 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25469 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 25470 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 1, "id": 25471 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 25472 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25473 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 25474 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 25475 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25476 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 25477 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 1, "id": 25478 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 25479 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25480 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 25481 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 25482 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25483 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 25484 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 1, "id": 25485 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 25486 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25487 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 25488 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 25489 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25490 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 25491 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 1, "id": 25492 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 25493 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25494 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 25495 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 25496 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25497 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 25498 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 1, "id": 25499 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 25500 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25501 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 25502 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 25503 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25504 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 25505 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 1, "id": 25506 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 25507 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25508 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 25509 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 25510 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25511 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 25512 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 1, "id": 25513 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 25514 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25515 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 25516 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 25517 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25518 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 25519 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 1, "id": 25520 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff557b4361", "parentcaller": "0x7fff557b3e47", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25521 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58080032", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 25522 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5807fd7f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 25523 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5807fdaa", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 25524 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5807fdca", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 25525 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 25526 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 25527 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002674" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 25528 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 25529 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 25530 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 25531 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 25532 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002674" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 25533 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "ValueName", "value": "MonitorRegistry" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\MonitorRegistry" } ], "repeated": 0, "id": 25534 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 25535 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 25536 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 25537 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002674" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" } ], "repeated": 0, "id": 25538 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 25539 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 25540 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 25541 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 25542 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002674" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" } ], "repeated": 0, "id": 25543 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "ValueName", "value": "MonitorRegistry" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\MonitorRegistry" } ], "repeated": 0, "id": 25544 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 25545 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff55848063", "parentcaller": "0x7fff55848ae6", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" }, { "name": "Handle", "value": "0x00002674" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" } ], "repeated": 0, "id": 25546 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff558480b3", "parentcaller": "0x7fff55848ae6", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002674" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 25547 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff558480df", "parentcaller": "0x7fff55848ae6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 25548 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff557c0016", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001128" } ], "repeated": 0, "id": 25549 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff52874c3e", "parentcaller": "0x7fff52878a3f", "category": "system", "api": "GetUserDefaultLCID", "status": true, "return": "0x00000c09", "arguments": [ { "name": "SystemDefaultLangID", "value": "0x00000c09" }, { "name": "LanguageName", "value": "English (Australia)" } ], "repeated": 11, "id": 25550 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff432c690b", "parentcaller": "0x7fff432b67f7", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" }, { "name": "Handle", "value": "0x00001128" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" } ], "repeated": 0, "id": 25551 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff432c6964", "parentcaller": "0x7fff432b67f7", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001128" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 25552 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff432c6990", "parentcaller": "0x7fff432b67f7", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001128" } ], "repeated": 0, "id": 25553 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432baa24", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25554 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432baa24", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 25555 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bc79b", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001128" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 25556 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bc7ca", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002674" } ], "repeated": 0, "id": 25557 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bc7fe", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "0\\xe7:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00`\\xda\\xd9\\xff\\xff\\xff\\xff\\xff\\x00^UK\\x07\\xef\\xdc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xda\\xd9\\xff\\xff\\xff\\xff\\xffH\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 25558 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bc8d0", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 25559 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8e4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 25560 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001128" } ], "repeated": 0, "id": 25561 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432baa73", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 25562 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432b9503", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 25563 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b953e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 25564 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432b95a7", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000242c" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 25565 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432b95d8", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00001128" } ], "repeated": 0, "id": 25566 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432b9610", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x10\\xe7:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00i\\xd5[\\x1a\\xff\\x7f\\x00\\x00\\xd0\\xe7:\\x03\\x00\\x00\\x00\\x00\\x10\r\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0fP\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9d|}\\x1a\\xff\\x7f\\x00\\x00(\\x8b}\\x1a\\xff\\x7f\\x00\\x00\\x10\r\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 25567 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432b96e3", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 25568 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b96f7", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001128" } ], "repeated": 0, "id": 25569 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b9706", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 25570 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b9732", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 25571 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432b9779", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 25572 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff432b9455", "parentcaller": "0x7fff432baae3", "category": "filesystem", "api": "GetDiskFreeSpaceExW", "status": true, "return": "0x00000001", "arguments": [ { "name": "DirectoryName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" } ], "repeated": 0, "id": 25573 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25574 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 25575 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002674" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 25576 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000242c" } ], "repeated": 0, "id": 25577 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe9:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00(\\xec:\\x03\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 25578 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001128" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 25579 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 25580 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 25581 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 25582 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 25583 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001128" } ], "repeated": 0, "id": 25584 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001128" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 25585 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002674" } ], "repeated": 0, "id": 25586 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff(\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\x98\\x080y^t\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 25587 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 25588 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 25589 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001128" } ], "repeated": 0, "id": 25590 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 25591 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 25592 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25593 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 25594 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000242c" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 25595 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00001128" } ], "repeated": 0, "id": 25596 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe9:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00(\\xec:\\x03\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 25597 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 25598 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001128" } ], "repeated": 0, "id": 25599 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 25600 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 25601 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 25602 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 25603 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002674" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 25604 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000242c" } ], "repeated": 0, "id": 25605 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff(\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\x98\\x080y^t\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 25606 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001128" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 25607 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 25608 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 25609 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001128" } ], "repeated": 0, "id": 25610 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 25611 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25612 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 25613 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001128" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 25614 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002674" } ], "repeated": 0, "id": 25615 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe9:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00(\\xec:\\x03\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 25616 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 25617 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 25618 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001128" } ], "repeated": 0, "id": 25619 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 25620 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 25621 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 25622 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000242c" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 25623 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00001128" } ], "repeated": 0, "id": 25624 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff(\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\x98\\x080y^t\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 25625 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 25626 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001128" } ], "repeated": 0, "id": 25627 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 25628 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 25629 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 25630 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25631 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 25632 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002674" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 25633 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000242c" } ], "repeated": 0, "id": 25634 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe9:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00(\\xec:\\x03\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 25635 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001128" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 25636 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 25637 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 25638 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 25639 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 25640 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001128" } ], "repeated": 0, "id": 25641 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001128" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 25642 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002674" } ], "repeated": 0, "id": 25643 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff(\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\x98\\x080y^t\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 25644 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 25645 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 25646 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001128" } ], "repeated": 0, "id": 25647 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 25648 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 25649 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25650 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 25651 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000242c" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 25652 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00001128" } ], "repeated": 0, "id": 25653 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe9:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00(\\xec:\\x03\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 25654 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 25655 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001128" } ], "repeated": 0, "id": 25656 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 25657 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 25658 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 25659 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 25660 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002674" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 25661 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000242c" } ], "repeated": 0, "id": 25662 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff(\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\x98\\x080y^t\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 25663 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001128" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 25664 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 25665 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 25666 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001128" } ], "repeated": 0, "id": 25667 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 25668 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25669 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 25670 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001128" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 25671 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002674" } ], "repeated": 0, "id": 25672 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe9:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00(\\xec:\\x03\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 25673 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 25674 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 25675 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001128" } ], "repeated": 0, "id": 25676 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 25677 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 25678 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 25679 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000242c" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 25680 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00001128" } ], "repeated": 0, "id": 25681 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff(\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\x98\\x080y^t\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 25682 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 25683 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001128" } ], "repeated": 0, "id": 25684 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 25685 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 25686 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 25687 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25688 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 25689 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002674" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 25690 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000242c" } ], "repeated": 0, "id": 25691 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe9:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00(\\xec:\\x03\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 25692 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001128" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 25693 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 25694 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 25695 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 25696 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 25697 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001128" } ], "repeated": 0, "id": 25698 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001128" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 25699 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002674" } ], "repeated": 0, "id": 25700 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff(\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\x98\\x080y^t\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 25701 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 25702 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 25703 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001128" } ], "repeated": 0, "id": 25704 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 25705 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 25706 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25707 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 25708 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000242c" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 25709 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00001128" } ], "repeated": 0, "id": 25710 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe9:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00(\\xec:\\x03\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 25711 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 25712 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001128" } ], "repeated": 0, "id": 25713 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 25714 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 25715 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 25716 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 25717 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002674" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 25718 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000242c" } ], "repeated": 0, "id": 25719 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff(\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\x98\\x080y^t\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 25720 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001128" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 25721 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 25722 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 25723 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001128" } ], "repeated": 0, "id": 25724 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 25725 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25726 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 25727 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001128" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 25728 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002674" } ], "repeated": 0, "id": 25729 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe9:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00(\\xec:\\x03\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 25730 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 25731 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 25732 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001128" } ], "repeated": 0, "id": 25733 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 25734 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 25735 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 25736 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000242c" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 25737 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00001128" } ], "repeated": 0, "id": 25738 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff(\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\x98\\x080y^t\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 25739 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 25740 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001128" } ], "repeated": 0, "id": 25741 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 25742 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 25743 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 25744 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25745 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 25746 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002674" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 25747 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000242c" } ], "repeated": 0, "id": 25748 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe9:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00(\\xec:\\x03\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 25749 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001128" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 25750 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 25751 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 25752 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 25753 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 25754 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001128" } ], "repeated": 0, "id": 25755 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001128" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 25756 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002674" } ], "repeated": 0, "id": 25757 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff(\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\x98\\x080y^t\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 25758 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 25759 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 25760 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001128" } ], "repeated": 0, "id": 25761 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 25762 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 25763 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25764 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 25765 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000242c" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 25766 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00001128" } ], "repeated": 0, "id": 25767 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe9:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00(\\xec:\\x03\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 25768 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 25769 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001128" } ], "repeated": 0, "id": 25770 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 25771 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 25772 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 25773 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 25774 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002674" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 25775 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000242c" } ], "repeated": 0, "id": 25776 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff(\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\x98\\x080y^t\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 25777 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001128" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 25778 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 25779 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 25780 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001128" } ], "repeated": 0, "id": 25781 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 25782 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25783 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 25784 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001128" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 25785 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002674" } ], "repeated": 0, "id": 25786 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe9:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00(\\xec:\\x03\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 25787 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 25788 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 25789 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001128" } ], "repeated": 0, "id": 25790 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 25791 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 25792 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 25793 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000242c" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 25794 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00001128" } ], "repeated": 0, "id": 25795 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff(\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\x98\\x080y^t\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 25796 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 25797 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001128" } ], "repeated": 0, "id": 25798 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 25799 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 25800 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 25801 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25802 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 25803 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002674" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 25804 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000242c" } ], "repeated": 0, "id": 25805 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe9:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00(\\xec:\\x03\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 25806 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001128" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 25807 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 25808 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 25809 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 25810 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 25811 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001128" } ], "repeated": 0, "id": 25812 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001128" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 25813 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002674" } ], "repeated": 0, "id": 25814 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff(\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\x98\\x080y^t\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 25815 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 25816 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 25817 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001128" } ], "repeated": 0, "id": 25818 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 25819 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 25820 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff5780d897", "parentcaller": "0x7fff432b949c", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000d5c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00@\\x00\\x00\\x00\\x00\\x00\\x00`9\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 25821 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bc5ce", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25822 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bc5ce", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 25823 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bc79b", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000242c" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 25824 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bc7ca", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00001128" } ], "repeated": 0, "id": 25825 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bc7fe", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xe0\\xe6:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00`\\xda\\xd9\\xff\\xff\\xff\\xff\\xff\\x00^UK\\x07\\xef\\xdc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xda\\xd9\\xff\\xff\\xff\\xff\\xffH\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\r\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 25826 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bc8d0", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 25827 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8e4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001128" } ], "repeated": 0, "id": 25828 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 25829 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bc61a", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 25830 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bc669", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 25831 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc691", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 25832 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bc79b", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002674" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 25833 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bc7ca", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000242c" } ], "repeated": 0, "id": 25834 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bc7fe", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xe0\\xe6:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00t&\\x00\\x00\\x00\\x00\\x00\\x00t&\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x81|}\\x1a\\xff\\x7f\\x00\\x00(\\x8b}\\x1a\\xff\\x7f\\x00\\x00t&\\x00\\x00\\x00\\x00\\x00\\x00t&\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x85g}W\\xff\\x7f\\x00\\x00t&\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 25835 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bc8d0", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001128" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 25836 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8e4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 25837 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 25838 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc6d4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001128" } ], "repeated": 0, "id": 25839 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bc6f9", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 25840 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432c08f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d84" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 25841 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff5780d897", "parentcaller": "0x7fff432c0a96", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001c54" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 25842 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bbc69", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 25843 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bc79b", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001128" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 25844 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bc7ca", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002674" } ], "repeated": 0, "id": 25845 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bc7fe", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xe8:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xf7\\x8b\\x10\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00T\\x1c\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 25846 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bc8d0", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 25847 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8e4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 25848 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001128" } ], "repeated": 0, "id": 25849 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bbccd", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 25850 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff5780d897", "parentcaller": "0x7fff432bd729", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000d5c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00@\\x00\\x00\\x00\\x00\\x00\\x00`9\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 25851 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432b9392", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 25852 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bc79b", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000242c" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 25853 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bc7ca", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00001128" } ], "repeated": 0, "id": 25854 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bc7fe", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "p\\xe8:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00]\\xdd|W\\xff\\x7f\\x00\\x006\\x008\\x004\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xcf\\xd5\\xf4j\\xc58\\xb5\\x1b4\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x92\\x93+C\\xff\\x7f\\x00\\x00" } ], "repeated": 0, "id": 25855 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bc8d0", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!4684" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 25856 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8e4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001128" } ], "repeated": 0, "id": 25857 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 25858 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b6a3f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 25859 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bbc69", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 25860 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bc79b", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002674" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 25861 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bc7ca", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000242c" } ], "repeated": 0, "id": 25862 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bc7fe", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x10\\xe7:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x84\\x06&\\x13\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04m+C\\xff\\x7f\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 25863 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bc8d0", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001128" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 25864 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8e4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 25865 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 25866 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bbccd", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001128" } ], "repeated": 0, "id": 25867 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff5780d897", "parentcaller": "0x7fff432bd729", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000d5c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00@\\x00\\x00\\x00\\x00\\x00\\x00`9\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 25868 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432c084a", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 25869 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432c0a05", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d84" } ], "repeated": 0, "id": 25870 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff558b2b5a", "parentcaller": "0x7fff558658f2", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001011c" }, { "name": "Message", "value": "0x000004b5" } ], "repeated": 0, "id": 25871 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bbd54", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 25872 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bc79b", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001128" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 25873 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bc7ca", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002674" } ], "repeated": 0, "id": 25874 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bc7fe", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "@\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00s\\xb3\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa1[\\xf7Y\\xff\\x7f\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\x85\\xaa\\x0c\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 25875 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bc8d0", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 25876 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8e4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 25877 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001128" } ], "repeated": 0, "id": 25878 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bbd99", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 25879 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff5780d897", "parentcaller": "0x7fff432bd729", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000d5c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00@\\x00\\x00\\x00\\x00\\x00\\x00`9\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 25880 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432b9503", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 25881 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b953e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 25882 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432b95a7", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000242c" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 25883 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432b95d8", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00001128" } ], "repeated": 0, "id": 25884 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432b9610", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9d|}\\x1a\\xff\\x7f\\x00\\x00(\\x8b}\\x1a\\xff\\x7f\\x00\\x00\\x10\r\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\xf9\\x1d\\x01\\x00\\x00\\x00\\x00]\\xdd|W\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\x85\\xaa\\x0c\\x00\\x00\\x00\\x00\\xf9\\x7fN\\x0c\\xea[\\x00\\x00\\x18\\xf9\\x1d\\x01\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 25885 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432b96e3", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 25886 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b96f7", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001128" } ], "repeated": 0, "id": 25887 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b9706", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 25888 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b9732", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 25889 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432b9779", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 25890 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff432c690b", "parentcaller": "0x7fff432bb551", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" }, { "name": "Handle", "value": "0x00002674" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" } ], "repeated": 0, "id": 25891 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff432c6964", "parentcaller": "0x7fff432bb551", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002674" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 25892 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff432c6990", "parentcaller": "0x7fff432bb551", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 25893 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff5807fb58", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "MutexName", "value": "" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 25894 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001128" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop\\Microsoft Edge.lnk" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 25895 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 25896 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25897 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 25898 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 25899 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d5783", "parentcaller": "0x7fff58090260", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001128" }, { "name": "HandleName", "value": "C:\\Users\\Public\\Desktop\\Microsoft Edge.lnk" }, { "name": "Buffer", "value": "L\\x00\\x00\\x00\\x01\\x14\\x02\\x00\\x00\\x00\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00F\\xdf@\\x00\\x00 \\x00\\x00\\x00\\xac\\xbc|\\x12K\\x8a\\xd7\\x01,\\x01\\xfdS\\xb6\\xee\\xdc\\x01\\x1cK\\x06\\x9e\\xe8\\xe8\\xdc\\x01h\\xddN\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x001\\x02\\x14\\x00\\x1fP\\xe0O\\xd0 \\xea:i\\x10\\xa2\\xd8\\x08\\x00+00\\x9d\\x19\\x00/C:\\\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x98\\x001\\x00\\x00\\x00\\x00\\x00\\x84W\\x15\\x17\\x11\\x00PROGRA~2\\x00\\x00\\x80\\x00\t\\x00\\x04\\x00\\xef\\xbe\\x87O\\xdbI\\xbc\\I{.\\x00\\x00\\x00\\xc9\\x04\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00V\\x00\\x00\\x00\\x00\\x00\\x893\\x00\\x00P\\x00r\\x00o\\x00g\\x00r\\x00a\\x00m\\x00 \\x00F\\x00i\\x00l\\x00e\\x00s\\x00 \\x00(\\x00x\\x008\\x006\\x00)\\x00\\x00\\x00@\\x00s\\x00h\\x00e\\x00l\\x00l\\x003\\x002\\x00.\\x00d\\x00l\\x00l" }, { "name": "Length", "value": "2276" } ], "repeated": 0, "id": 25900 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25901 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 25902 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 1, "id": 25903 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 25904 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25905 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 25906 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 25907 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25908 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 25909 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 1, "id": 25910 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 25911 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25912 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 25913 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 25914 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25915 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 25916 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 1, "id": 25917 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 25918 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25919 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 25920 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 25921 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25922 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 25923 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4c2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 25924 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 25925 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 25926 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002278" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 25927 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002278" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 25928 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002278" } ], "repeated": 0, "id": 25929 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 25930 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 25931 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002278" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 25932 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002278" }, { "name": "ValueName", "value": "MonitorRegistry" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\MonitorRegistry" } ], "repeated": 0, "id": 25933 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002278" } ], "repeated": 0, "id": 25934 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 25935 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 25936 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002278" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" } ], "repeated": 0, "id": 25937 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002278" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 25938 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002278" } ], "repeated": 0, "id": 25939 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 25940 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 25941 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002278" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" } ], "repeated": 0, "id": 25942 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002278" }, { "name": "ValueName", "value": "MonitorRegistry" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\MonitorRegistry" } ], "repeated": 0, "id": 25943 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002278" } ], "repeated": 0, "id": 25944 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 25945 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25946 }, { "timestamp": "2026-05-29 01:05:52,196", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 25947 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 25948 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff5780b767", "parentcaller": "0x7fff58085024", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001128" }, { "name": "HandleName", "value": "C:\\Users\\Public\\Desktop\\Microsoft Edge.lnk" }, { "name": "FileInformationClass", "value": "4", "pretty_value": "FileBasicInformation" }, { "name": "FileInformation", "value": "2h6\\xc6\\xf0\\xee\\xdc\\x01\\x00^UK\\x07\\xef\\xdc\\x01\\xa8\\xdd\\x11T\\xb6\\xee\\xdc\\x01\\x15o\\xe7\\x9c\\xb6\\xee\\xdc\\x01 \\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 25949 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc686b4", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 25950 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xe2\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x005\\x18\\xff\\x7f\\x00\\x00(\\xe3\\\\x03\\x00\\x00\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 25951 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff5780b767", "parentcaller": "0x7fff5808504b", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001128" }, { "name": "HandleName", "value": "C:\\Users\\Public\\Desktop\\Microsoft Edge.lnk" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xe4\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 25952 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000024b8" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 25953 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25954 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 25955 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 25956 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4696", "caller": "0x7ff79bc8a418", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b8" } ], "repeated": 0, "id": 25957 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4c2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 25958 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 25959 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25960 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 25961 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 25962 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25963 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 25964 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 1, "id": 25965 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 25966 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25967 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 25968 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 25969 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25970 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 25971 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 1, "id": 25972 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 25973 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25974 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 25975 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 25976 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25977 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 25978 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 1, "id": 25979 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 25980 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25981 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 25982 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 25983 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25984 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 25985 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 1, "id": 25986 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 25987 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25988 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 25989 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 25990 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25991 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 25992 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 1, "id": 25993 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 25994 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25995 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 25996 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 25997 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25998 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 25999 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 1, "id": 26000 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 26001 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26002 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26003 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 26004 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26005 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26006 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 1, "id": 26007 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 26008 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26009 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26010 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 26011 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26012 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26013 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 1, "id": 26014 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 26015 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26016 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26017 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 26018 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26019 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26020 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 1, "id": 26021 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 26022 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26023 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26024 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 26025 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26026 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26027 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 1, "id": 26028 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 26029 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26030 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26031 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 26032 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26033 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26034 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 1, "id": 26035 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 26036 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26037 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26038 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 26039 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26040 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26041 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 1, "id": 26042 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 26043 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26044 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26045 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 26046 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26047 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26048 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 1, "id": 26049 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 26050 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26051 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26052 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 26053 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26054 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26055 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 1, "id": 26056 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 26057 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26058 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26059 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 26060 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26061 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26062 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 1, "id": 26063 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 26064 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26065 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26066 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 26067 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26068 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26069 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 1, "id": 26070 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 26071 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26072 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26073 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 26074 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26075 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26076 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 1, "id": 26077 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 26078 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26079 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26080 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 26081 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26082 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26083 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 1, "id": 26084 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 26085 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26086 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26087 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 26088 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26089 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26090 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 1, "id": 26091 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 26092 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26093 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26094 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 26095 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26096 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26097 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 1, "id": 26098 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 26099 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26100 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26101 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 26102 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26103 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26104 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 1, "id": 26105 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff557b4361", "parentcaller": "0x7fff557b3e47", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26106 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58080032", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 26107 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5807fd7f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001128" } ], "repeated": 0, "id": 26108 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5807fdaa", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 26109 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5807fdca", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 26110 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 26111 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 26112 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000242c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 26113 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 26114 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 26115 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 26116 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 26117 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000242c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 26118 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "ValueName", "value": "MonitorRegistry" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\MonitorRegistry" } ], "repeated": 0, "id": 26119 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 26120 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 26121 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 26122 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000242c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" } ], "repeated": 0, "id": 26123 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 26124 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 26125 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 26126 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 26127 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000242c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" } ], "repeated": 0, "id": 26128 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "ValueName", "value": "MonitorRegistry" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\MonitorRegistry" } ], "repeated": 0, "id": 26129 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 26130 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff55848063", "parentcaller": "0x7fff55848ae6", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" }, { "name": "Handle", "value": "0x0000242c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" } ], "repeated": 0, "id": 26131 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff558480b3", "parentcaller": "0x7fff55848ae6", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000242c" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 26132 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff558480df", "parentcaller": "0x7fff55848ae6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 26133 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff557c0016", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 26134 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff52874c3e", "parentcaller": "0x7fff52878a3f", "category": "system", "api": "GetUserDefaultLCID", "status": true, "return": "0x00000c09", "arguments": [ { "name": "SystemDefaultLangID", "value": "0x00000c09" }, { "name": "LanguageName", "value": "English (Australia)" } ], "repeated": 11, "id": 26135 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432c5686", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26136 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432c5686", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "Milliseconds", "value": "600000" } ], "repeated": 0, "id": 26137 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 26138 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff432c5ded", "parentcaller": "0x7fff432c56be", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "AB8902B4-09CA-4BB6-B78D-A8F59079A8D5" }, { "name": "ClsContext", "value": "0x00004004", "pretty_value": "CLSCTX_LOCAL_SERVER|CLSCTX_NO_FAILURE_LOG" }, { "name": "riid", "value": "75121952-E0D0-43E5-9380-1D80483ACF72" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 26139 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff432c5d25", "parentcaller": "0x7fff432c56d1", "category": "system", "api": "CreateTimerQueueTimer", "status": true, "return": "0x00000001", "arguments": [ { "name": "phNewTimer", "value": "0x0cad55d0" }, { "name": "TimerQueue", "value": "0x00000000" }, { "name": "Callback", "value": "0x432ed350" }, { "name": "Parameter", "value": "0x033aea60" }, { "name": "DueTime", "value": "60000" }, { "name": "Period", "value": "1000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 26140 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff55848063", "parentcaller": "0x7fff55848ae6", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" }, { "name": "Handle", "value": "0x00002318" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" } ], "repeated": 0, "id": 26141 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff558480b3", "parentcaller": "0x7fff55848ae6", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002318" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 26142 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff558480df", "parentcaller": "0x7fff55848ae6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002318" } ], "repeated": 0, "id": 26143 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff558499ce", "parentcaller": "0x7fff558498a0", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "CLSID\\{00021401-0000-0000-C000-000000000046}" }, { "name": "Handle", "value": "0x0000231a" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\CLSID\\{00021401-0000-0000-C000-000000000046}" } ], "repeated": 0, "id": 26144 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff558498d6", "parentcaller": "0x7fff55849723", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000231a" }, { "name": "ValueName", "value": "EnableShareDenyNone" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{00021401-0000-0000-C000-000000000046}\\EnableShareDenyNone" } ], "repeated": 0, "id": 26145 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff5807c5e9", "parentcaller": "0x7fff5807fc58", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "E2EB4CA4-C96E-4DA4-94B1-673C8334A5BB" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "265CFCAA-9B0C-44CA-996F-4A6F6620C72D" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 26146 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff5807ce6f", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000023a0" }, { "name": "MutexName", "value": "" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 26147 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff5781c37f", "parentcaller": "0x7fff5781c2fc", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 26148 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d6579", "parentcaller": "0x7fff5781c32f", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022e4" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop\\Microsoft Edge.lnk" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 26149 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff58096fcb", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000022e4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002524" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 26150 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff57fc5921", "parentcaller": "0x7fff58097162", "category": "device", "api": "DeviceIoControl", "status": false, "return": "0x00000000", "arguments": [ { "name": "DeviceHandle", "value": "0x00002524" }, { "name": "IoControlCode", "value": "0x00090240" }, { "name": "InBuffer", "value": "\\x01\\x00\\x0c\\x00\\x03\\x00\\x00\\x00\\x01\\x00\\x00\\x00" }, { "name": "OutBuffer", "value": "" } ], "repeated": 0, "id": 26151 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5809bd52", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" } ], "repeated": 0, "id": 26152 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58080032", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000023a0" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 26153 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff5807d391", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "MutexName", "value": "" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 26154 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002488" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop\\Microsoft Edge.lnk" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 26155 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5807d1cc", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000023a0" } ], "repeated": 0, "id": 26156 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58080032", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000023a0" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 26157 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5807905d", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000023a0" } ], "repeated": 0, "id": 26158 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5809b0b5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000023a0" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 26159 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 26160 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26161 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26162 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" } ], "repeated": 0, "id": 26163 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5809b106", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26164 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5809b106", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000023a0" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26165 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5809b122", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000023a0" } ], "repeated": 0, "id": 26166 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff57814097", "parentcaller": "0x7fff5807a6a8", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002488" }, { "name": "HandleName", "value": "C:\\Users\\Public\\Desktop\\Microsoft Edge.lnk" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xe4\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 26167 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cf0e1", "parentcaller": "0x7fff577cef40", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001af0" }, { "name": "DesiredAccess", "value": "0x000f0005", "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x00002488" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop\\Microsoft Edge.lnk" } ], "repeated": 0, "id": 26168 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001af0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08b10000" }, { "name": "SectionOffset", "value": "0x033ad6f0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 26169 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5809abbd", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26170 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5809abbd", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000023a0" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26171 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26172 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26173 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" } ], "repeated": 1, "id": 26174 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5809ac06", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000023a0" } ], "repeated": 1, "id": 26175 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 26176 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 26177 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002490" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 26178 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002490" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 26179 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002490" } ], "repeated": 0, "id": 26180 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 26181 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 26182 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002490" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 26183 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002490" }, { "name": "ValueName", "value": "MonitorRegistry" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\MonitorRegistry" } ], "repeated": 0, "id": 26184 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002490" } ], "repeated": 0, "id": 26185 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 26186 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 26187 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002490" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" } ], "repeated": 0, "id": 26188 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002490" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 26189 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002490" } ], "repeated": 0, "id": 26190 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 26191 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 26192 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002490" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" } ], "repeated": 0, "id": 26193 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002490" }, { "name": "ValueName", "value": "MonitorRegistry" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\MonitorRegistry" } ], "repeated": 0, "id": 26194 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002490" } ], "repeated": 0, "id": 26195 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d1e5c", "parentcaller": "0x7fff58090a54", "category": "filesystem", "api": "NtQueryFullAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Users\\Public\\Desktop\\Microsoft Edge.lnk" } ], "repeated": 0, "id": 26196 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff557b4361", "parentcaller": "0x7fff557b3e47", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26197 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58080032", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000023a0" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 26198 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff580912fe", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000023a0" } ], "repeated": 0, "id": 26199 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff5807aeaa", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08b10000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 26200 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5807af2c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 26201 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58080032", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 26202 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5807fd7f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" } ], "repeated": 0, "id": 26203 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5807fdaa", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" } ], "repeated": 0, "id": 26204 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5807fdca", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" } ], "repeated": 0, "id": 26205 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5807ea94", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002524" } ], "repeated": 0, "id": 26206 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5807eabd", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002414" } ], "repeated": 0, "id": 26207 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5807c972", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000023a0" } ], "repeated": 0, "id": 26208 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff59f5c23a", "parentcaller": "0x7fff59f5c30d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002450" } ], "repeated": 0, "id": 26209 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff558497da", "parentcaller": "0x7fff55849057", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000231a" } ], "repeated": 0, "id": 26210 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d07f5", "parentcaller": "0x7fff577cc03b", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" } ], "repeated": 0, "id": 26211 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff557c0016", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026fc" } ], "repeated": 0, "id": 26212 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26213 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000c7c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26214 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432cbf4b", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 26215 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff5807fb58", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" }, { "name": "MutexName", "value": "" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 26216 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000263c" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop\\Microsoft Edge.lnk" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 26217 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 26218 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26219 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26220 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" } ], "repeated": 0, "id": 26221 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d5783", "parentcaller": "0x7fff58090260", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000263c" }, { "name": "HandleName", "value": "C:\\Users\\Public\\Desktop\\Microsoft Edge.lnk" }, { "name": "Buffer", "value": "L\\x00\\x00\\x00\\x01\\x14\\x02\\x00\\x00\\x00\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00F\\xdf@\\x00\\x00 \\x00\\x00\\x00\\xac\\xbc|\\x12K\\x8a\\xd7\\x01,\\x01\\xfdS\\xb6\\xee\\xdc\\x01\\x1cK\\x06\\x9e\\xe8\\xe8\\xdc\\x01h\\xddN\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x001\\x02\\x14\\x00\\x1fP\\xe0O\\xd0 \\xea:i\\x10\\xa2\\xd8\\x08\\x00+00\\x9d\\x19\\x00/C:\\\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x98\\x001\\x00\\x00\\x00\\x00\\x00\\x84W\\x15\\x17\\x11\\x00PROGRA~2\\x00\\x00\\x80\\x00\t\\x00\\x04\\x00\\xef\\xbe\\x87O\\xdbI\\xbc\\I{.\\x00\\x00\\x00\\xc9\\x04\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00V\\x00\\x00\\x00\\x00\\x00\\x893\\x00\\x00P\\x00r\\x00o\\x00g\\x00r\\x00a\\x00m\\x00 \\x00F\\x00i\\x00l\\x00e\\x00s\\x00 \\x00(\\x00x\\x008\\x006\\x00)\\x00\\x00\\x00@\\x00s\\x00h\\x00e\\x00l\\x00l\\x003\\x002\\x00.\\x00d\\x00l\\x00l" }, { "name": "Length", "value": "2276" } ], "repeated": 0, "id": 26222 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26223 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26224 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" } ], "repeated": 1, "id": 26225 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 26226 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26227 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26228 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" } ], "repeated": 0, "id": 26229 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26230 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26231 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" } ], "repeated": 1, "id": 26232 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 26233 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26234 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26235 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" } ], "repeated": 0, "id": 26236 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26237 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26238 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" } ], "repeated": 1, "id": 26239 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 26240 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26241 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26242 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" } ], "repeated": 0, "id": 26243 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26244 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26245 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" } ], "repeated": 1, "id": 26246 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 26247 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 26248 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000026fc" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 26249 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000026fc" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 26250 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026fc" } ], "repeated": 0, "id": 26251 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 26252 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 26253 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000026fc" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 26254 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026fc" }, { "name": "ValueName", "value": "MonitorRegistry" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\MonitorRegistry" } ], "repeated": 0, "id": 26255 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026fc" } ], "repeated": 0, "id": 26256 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 26257 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 26258 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000026fc" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" } ], "repeated": 0, "id": 26259 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000026fc" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 26260 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026fc" } ], "repeated": 0, "id": 26261 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 26262 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 26263 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000026fc" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" } ], "repeated": 0, "id": 26264 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000026fc" }, { "name": "ValueName", "value": "MonitorRegistry" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\MonitorRegistry" } ], "repeated": 0, "id": 26265 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026fc" } ], "repeated": 0, "id": 26266 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 26267 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26268 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26269 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" } ], "repeated": 0, "id": 26270 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff5780b767", "parentcaller": "0x7fff58085024", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000263c" }, { "name": "HandleName", "value": "C:\\Users\\Public\\Desktop\\Microsoft Edge.lnk" }, { "name": "FileInformationClass", "value": "4", "pretty_value": "FileBasicInformation" }, { "name": "FileInformation", "value": "2h6\\xc6\\xf0\\xee\\xdc\\x01\\xf4\\xc0WK\\x07\\xef\\xdc\\x01\\xa8\\xdd\\x11T\\xb6\\xee\\xdc\\x01\\x15o\\xe7\\x9c\\xb6\\xee\\xdc\\x01 \\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 26271 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff5780b767", "parentcaller": "0x7fff5808504b", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000263c" }, { "name": "HandleName", "value": "C:\\Users\\Public\\Desktop\\Microsoft Edge.lnk" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xe4\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 26272 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26273 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26274 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" } ], "repeated": 1, "id": 26275 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 26276 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26277 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26278 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" } ], "repeated": 0, "id": 26279 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26280 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26281 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" } ], "repeated": 1, "id": 26282 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 26283 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26284 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26285 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" } ], "repeated": 0, "id": 26286 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26287 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26288 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" } ], "repeated": 1, "id": 26289 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 26290 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26291 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26292 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" } ], "repeated": 0, "id": 26293 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26294 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26295 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" } ], "repeated": 1, "id": 26296 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 26297 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26298 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26299 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" } ], "repeated": 0, "id": 26300 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26301 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26302 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" } ], "repeated": 1, "id": 26303 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 26304 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26305 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26306 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" } ], "repeated": 0, "id": 26307 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26308 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26309 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" } ], "repeated": 1, "id": 26310 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 26311 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26312 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26313 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" } ], "repeated": 0, "id": 26314 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26315 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26316 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" } ], "repeated": 1, "id": 26317 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 26318 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26319 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26320 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" } ], "repeated": 0, "id": 26321 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26322 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26323 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" } ], "repeated": 1, "id": 26324 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 26325 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26326 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26327 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" } ], "repeated": 0, "id": 26328 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26329 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26330 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" } ], "repeated": 1, "id": 26331 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 26332 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26333 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26334 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" } ], "repeated": 0, "id": 26335 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26336 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26337 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" } ], "repeated": 1, "id": 26338 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 26339 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26340 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26341 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" } ], "repeated": 0, "id": 26342 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26343 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26344 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" } ], "repeated": 1, "id": 26345 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 26346 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26347 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26348 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" } ], "repeated": 0, "id": 26349 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26350 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26351 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" } ], "repeated": 1, "id": 26352 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 26353 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26354 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26355 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" } ], "repeated": 0, "id": 26356 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26357 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26358 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" } ], "repeated": 1, "id": 26359 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 26360 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26361 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26362 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" } ], "repeated": 0, "id": 26363 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26364 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26365 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" } ], "repeated": 1, "id": 26366 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 26367 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26368 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26369 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" } ], "repeated": 0, "id": 26370 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26371 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26372 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" } ], "repeated": 1, "id": 26373 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 26374 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26375 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26376 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" } ], "repeated": 0, "id": 26377 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26378 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26379 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" } ], "repeated": 1, "id": 26380 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 26381 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26382 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26383 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" } ], "repeated": 0, "id": 26384 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26385 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26386 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" } ], "repeated": 1, "id": 26387 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 26388 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26389 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26390 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" } ], "repeated": 0, "id": 26391 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26392 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26393 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" } ], "repeated": 1, "id": 26394 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 26395 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26396 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26397 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" } ], "repeated": 0, "id": 26398 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26399 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26400 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" } ], "repeated": 1, "id": 26401 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 26402 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26403 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26404 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" } ], "repeated": 0, "id": 26405 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26406 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26407 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" } ], "repeated": 1, "id": 26408 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 26409 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26410 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26411 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" } ], "repeated": 0, "id": 26412 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26413 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26414 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" } ], "repeated": 1, "id": 26415 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 26416 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26417 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26418 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" } ], "repeated": 0, "id": 26419 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26420 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26421 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" } ], "repeated": 1, "id": 26422 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff557b4361", "parentcaller": "0x7fff557b3e47", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26423 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58080032", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 26424 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5807fd7f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 26425 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5807fdaa", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" } ], "repeated": 0, "id": 26426 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5807fdca", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" } ], "repeated": 0, "id": 26427 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 26428 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 26429 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000026ec" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 26430 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000026ec" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 26431 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" } ], "repeated": 0, "id": 26432 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 26433 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 26434 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000026ec" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 26435 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" }, { "name": "ValueName", "value": "MonitorRegistry" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\MonitorRegistry" } ], "repeated": 0, "id": 26436 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" } ], "repeated": 0, "id": 26437 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 26438 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 26439 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000026ec" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" } ], "repeated": 0, "id": 26440 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000026ec" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 26441 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" } ], "repeated": 0, "id": 26442 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 26443 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 26444 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000026ec" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" } ], "repeated": 0, "id": 26445 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000026ec" }, { "name": "ValueName", "value": "MonitorRegistry" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\MonitorRegistry" } ], "repeated": 0, "id": 26446 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" } ], "repeated": 0, "id": 26447 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff55848063", "parentcaller": "0x7fff55848ae6", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" }, { "name": "Handle", "value": "0x000026ec" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" } ], "repeated": 0, "id": 26448 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff558480b3", "parentcaller": "0x7fff55848ae6", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000026ec" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 26449 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff558480df", "parentcaller": "0x7fff55848ae6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" } ], "repeated": 0, "id": 26450 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff557c0016", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 26451 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff52874c3e", "parentcaller": "0x7fff52878a3f", "category": "system", "api": "GetUserDefaultLCID", "status": true, "return": "0x00000c09", "arguments": [ { "name": "SystemDefaultLangID", "value": "0x00000c09" }, { "name": "LanguageName", "value": "English (Australia)" } ], "repeated": 11, "id": 26452 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff432c690b", "parentcaller": "0x7fff432b67f7", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" }, { "name": "Handle", "value": "0x00002674" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" } ], "repeated": 0, "id": 26453 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff432c6964", "parentcaller": "0x7fff432b67f7", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002674" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 26454 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff432c6990", "parentcaller": "0x7fff432b67f7", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 26455 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432baa24", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26456 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432baa24", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 26457 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bc79b", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002674" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 26458 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bc7ca", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000026ec" } ], "repeated": 0, "id": 26459 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bc7fe", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "0\\xe7:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00`\\xda\\xd9\\xff\\xff\\xff\\xff\\xff\\xf4\\xc0WK\\x07\\xef\\xdc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xda\\xd9\\xff\\xff\\xff\\xff\\xffH\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 26460 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bc8d0", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 26461 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8e4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" } ], "repeated": 0, "id": 26462 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 26463 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432baa73", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 26464 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432b9503", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 26465 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b953e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 26466 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432b95a7", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000263c" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 26467 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432b95d8", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002674" } ], "repeated": 0, "id": 26468 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432b9610", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x10\\xe7:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00i\\xd5[\\x1a\\xff\\x7f\\x00\\x00\\xd0\\xe7:\\x03\\x00\\x00\\x00\\x00\\x10\r\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0fP\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9d|}\\x1a\\xff\\x7f\\x00\\x00(\\x8b}\\x1a\\xff\\x7f\\x00\\x00\\x10\r\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 26469 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432b96e3", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 26470 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b96f7", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 26471 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b9706", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 26472 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b9732", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" } ], "repeated": 0, "id": 26473 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432b9779", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 26474 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff432b9455", "parentcaller": "0x7fff432baae3", "category": "filesystem", "api": "GetDiskFreeSpaceExW", "status": true, "return": "0x00000001", "arguments": [ { "name": "DirectoryName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" } ], "repeated": 0, "id": 26475 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26476 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 26477 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000026ec" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 26478 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000263c" } ], "repeated": 0, "id": 26479 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe9:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00(\\xec:\\x03\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 26480 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 26481 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 26482 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" } ], "repeated": 0, "id": 26483 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 26484 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 26485 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 26486 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002674" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 26487 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000026ec" } ], "repeated": 0, "id": 26488 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xfft&\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\x98\\x080y^t\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 26489 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 26490 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" } ], "repeated": 0, "id": 26491 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 26492 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 26493 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 26494 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26495 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 26496 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000263c" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 26497 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002674" } ], "repeated": 0, "id": 26498 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe9:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00(\\xec:\\x03\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 26499 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 26500 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 26501 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 26502 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 26503 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 26504 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" } ], "repeated": 0, "id": 26505 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000026ec" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 26506 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000263c" } ], "repeated": 0, "id": 26507 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xfft&\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\x98\\x080y^t\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 26508 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 26509 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 26510 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" } ], "repeated": 0, "id": 26511 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 26512 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 26513 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26514 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 26515 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002674" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 26516 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000026ec" } ], "repeated": 0, "id": 26517 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe9:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00(\\xec:\\x03\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 26518 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 26519 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" } ], "repeated": 0, "id": 26520 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 26521 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 26522 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 26523 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 26524 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000263c" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 26525 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002674" } ], "repeated": 0, "id": 26526 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xfft&\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\x98\\x080y^t\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 26527 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 26528 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 26529 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 26530 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" } ], "repeated": 0, "id": 26531 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 26532 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26533 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 26534 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000026ec" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 26535 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000263c" } ], "repeated": 0, "id": 26536 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe9:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00(\\xec:\\x03\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 26537 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 26538 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 26539 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" } ], "repeated": 0, "id": 26540 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 26541 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 26542 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 26543 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002674" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 26544 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000026ec" } ], "repeated": 0, "id": 26545 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xfft&\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\x98\\x080y^t\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 26546 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 26547 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" } ], "repeated": 0, "id": 26548 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 26549 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 26550 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 26551 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26552 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 26553 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000263c" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 26554 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002674" } ], "repeated": 0, "id": 26555 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe9:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00(\\xec:\\x03\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 26556 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 26557 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 26558 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 26559 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 26560 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 26561 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" } ], "repeated": 0, "id": 26562 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000026ec" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 26563 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000263c" } ], "repeated": 0, "id": 26564 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xfft&\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\x98\\x080y^t\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 26565 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 26566 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 26567 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" } ], "repeated": 0, "id": 26568 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 26569 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 26570 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26571 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 26572 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002674" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 26573 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000026ec" } ], "repeated": 0, "id": 26574 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe9:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00(\\xec:\\x03\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 26575 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 26576 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" } ], "repeated": 0, "id": 26577 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 26578 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 26579 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 26580 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 26581 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000263c" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 26582 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002674" } ], "repeated": 0, "id": 26583 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xfft&\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\x98\\x080y^t\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 26584 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 26585 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 26586 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 26587 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" } ], "repeated": 0, "id": 26588 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 26589 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26590 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 26591 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000026ec" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 26592 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000263c" } ], "repeated": 0, "id": 26593 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe9:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00(\\xec:\\x03\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 26594 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 26595 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 26596 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" } ], "repeated": 0, "id": 26597 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 26598 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 26599 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 26600 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002674" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 26601 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000026ec" } ], "repeated": 0, "id": 26602 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xfft&\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\x98\\x080y^t\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 26603 }, { "timestamp": "2026-05-29 01:05:52,212", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 26604 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" } ], "repeated": 0, "id": 26605 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 26606 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 26607 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 26608 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26609 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 26610 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000263c" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 26611 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002674" } ], "repeated": 0, "id": 26612 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe9:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00(\\xec:\\x03\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 26613 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002278" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 26614 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 26615 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 26616 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 26617 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 26618 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002278" } ], "repeated": 0, "id": 26619 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002278" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 26620 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000263c" } ], "repeated": 0, "id": 26621 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xfft&\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\x98\\x080y^t\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 26622 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 26623 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 26624 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002278" } ], "repeated": 0, "id": 26625 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 26626 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 26627 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26628 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 26629 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002674" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 26630 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002278" } ], "repeated": 0, "id": 26631 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe9:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00(\\xec:\\x03\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 26632 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 26633 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002278" } ], "repeated": 0, "id": 26634 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 26635 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 26636 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 26637 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 26638 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000263c" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 26639 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002674" } ], "repeated": 0, "id": 26640 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xfft&\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\x98\\x080y^t\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 26641 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002278" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 26642 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 26643 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 26644 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002278" } ], "repeated": 0, "id": 26645 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 26646 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26647 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 26648 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002278" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 26649 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000263c" } ], "repeated": 0, "id": 26650 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe9:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00(\\xec:\\x03\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 26651 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 26652 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 26653 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002278" } ], "repeated": 0, "id": 26654 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 26655 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 26656 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 26657 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002674" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 26658 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002278" } ], "repeated": 0, "id": 26659 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xfft&\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\x98\\x080y^t\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 26660 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 26661 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002278" } ], "repeated": 0, "id": 26662 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 26663 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 26664 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 26665 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26666 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 26667 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000263c" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 26668 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002674" } ], "repeated": 0, "id": 26669 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe9:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00(\\xec:\\x03\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 26670 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002278" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 26671 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 26672 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 26673 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 26674 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 26675 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002278" } ], "repeated": 0, "id": 26676 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002278" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 26677 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000263c" } ], "repeated": 0, "id": 26678 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xfft&\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\x98\\x080y^t\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 26679 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 26680 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 26681 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002278" } ], "repeated": 0, "id": 26682 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 26683 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 26684 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26685 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 26686 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002674" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 26687 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002278" } ], "repeated": 0, "id": 26688 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe9:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00(\\xec:\\x03\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 26689 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 26690 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002278" } ], "repeated": 0, "id": 26691 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 26692 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 26693 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 26694 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 26695 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000263c" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 26696 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002674" } ], "repeated": 0, "id": 26697 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xfft&\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\x98\\x080y^t\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 26698 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002278" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 26699 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 26700 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 26701 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002278" } ], "repeated": 0, "id": 26702 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 26703 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26704 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 26705 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002278" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 26706 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000263c" } ], "repeated": 0, "id": 26707 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe9:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00(\\xec:\\x03\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 26708 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 26709 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 26710 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002278" } ], "repeated": 0, "id": 26711 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 26712 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 26713 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 26714 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002674" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 26715 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002278" } ], "repeated": 0, "id": 26716 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xfft&\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\x98\\x080y^t\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 26717 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 26718 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002278" } ], "repeated": 0, "id": 26719 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 26720 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 26721 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 26722 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff5780d897", "parentcaller": "0x7fff432b949c", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000d5c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00@\\x00\\x00\\x00\\x00\\x00\\x00`9\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 26723 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bc5ce", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26724 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bc5ce", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 26725 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bc79b", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000263c" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 26726 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bc7ca", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002674" } ], "repeated": 0, "id": 26727 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bc7fe", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xe0\\xe6:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00`\\xda\\xd9\\xff\\xff\\xff\\xff\\xff\\x17$ZK\\x07\\xef\\xdc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xda\\xd9\\xff\\xff\\xff\\xff\\xffH\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\r\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 26728 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bc8d0", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002278" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 26729 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8e4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 26730 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 26731 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bc61a", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 26732 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bc669", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 26733 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc691", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002278" } ], "repeated": 0, "id": 26734 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bc79b", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002278" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 26735 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bc7ca", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000263c" } ], "repeated": 0, "id": 26736 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bc7fe", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xe0\\xe6:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00x\"\\x00\\x00\\x00\\x00\\x00\\x00x\"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x81|}\\x1a\\xff\\x7f\\x00\\x00(\\x8b}\\x1a\\xff\\x7f\\x00\\x00x\"\\x00\\x00\\x00\\x00\\x00\\x00x\"\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x85g}W\\xff\\x7f\\x00\\x00x\"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 26737 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bc8d0", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 26738 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8e4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 26739 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002278" } ], "repeated": 0, "id": 26740 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc6d4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 26741 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bc6f9", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 26742 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432c08f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d84" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 26743 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff5780d897", "parentcaller": "0x7fff432c0a96", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001c54" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 26744 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bbc69", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 26745 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bc79b", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002674" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 26746 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bc7ca", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002278" } ], "repeated": 0, "id": 26747 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bc7fe", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xe8:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xf7\\x8b\\x10\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00T\\x1c\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 26748 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bc8d0", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 26749 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8e4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002278" } ], "repeated": 0, "id": 26750 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 26751 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bbccd", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 26752 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff5780d897", "parentcaller": "0x7fff432bd729", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000d5c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00@\\x00\\x00\\x00\\x00\\x00\\x00`9\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 26753 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432b9392", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 26754 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bc79b", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000263c" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 26755 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bc7ca", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002674" } ], "repeated": 0, "id": 26756 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bc7fe", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "p\\xe8:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00]\\xdd|W\\xff\\x7f\\x00\\x00a\\x000\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xab\\x9a\\x94rw\\x02\\xef~4\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x92\\x93+C\\xff\\x7f\\x00\\x00" } ], "repeated": 0, "id": 26757 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bc8d0", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002278" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!4a0" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 26758 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8e4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 26759 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 26760 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b6a3f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002278" } ], "repeated": 0, "id": 26761 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bbc69", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 26762 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bc79b", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002278" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 26763 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bc7ca", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000263c" } ], "repeated": 0, "id": 26764 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bc7fe", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x10\\xe7:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\x00&\\x13\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04m+C\\xff\\x7f\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 26765 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bc8d0", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 26766 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8e4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000263c" } ], "repeated": 0, "id": 26767 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002278" } ], "repeated": 0, "id": 26768 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bbccd", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002674" } ], "repeated": 0, "id": 26769 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff5780d897", "parentcaller": "0x7fff432bd729", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000d5c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00@\\x00\\x00\\x00\\x00\\x00\\x00`9\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 26770 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432c084a", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 26771 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432c0a05", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d84" } ], "repeated": 0, "id": 26772 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff558b2b5a", "parentcaller": "0x7fff558658f2", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001011c" }, { "name": "Message", "value": "0x000004b5" } ], "repeated": 0, "id": 26773 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bbd54", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 26774 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bc79b", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000026ec" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 26775 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bc7ca", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000026fc" } ], "repeated": 0, "id": 26776 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bc7fe", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "@\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00s\\xb3\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa1[\\xf7Y\\xff\\x7f\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\x92\\xaa\\x0c\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 26777 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bc8d0", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002318" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 26778 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8e4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026fc" } ], "repeated": 0, "id": 26779 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" } ], "repeated": 0, "id": 26780 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bbd99", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 26781 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff5780d897", "parentcaller": "0x7fff432bd729", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000d5c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00@\\x00\\x00\\x00\\x00\\x00\\x00`9\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 26782 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432b9503", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 26783 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b953e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002318" } ], "repeated": 0, "id": 26784 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432b95a7", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002318" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 26785 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432b95d8", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000024b8" } ], "repeated": 0, "id": 26786 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432b9610", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9d|}\\x1a\\xff\\x7f\\x00\\x00(\\x8b}\\x1a\\xff\\x7f\\x00\\x00\\x10\r\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\xf9\\x1d\\x01\\x00\\x00\\x00\\x00]\\xdd|W\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\x92\\xaa\\x0c\\x00\\x00\\x00\\x00\\xf9\\x7fN\\x0c\\xea[\\x00\\x00\\x18\\xf9\\x1d\\x01\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 26787 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432b96e3", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 26788 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b96f7", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b8" } ], "repeated": 0, "id": 26789 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b9706", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002318" } ], "repeated": 0, "id": 26790 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b9732", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" } ], "repeated": 0, "id": 26791 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432b9779", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 26792 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff432c690b", "parentcaller": "0x7fff432bb551", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" }, { "name": "Handle", "value": "0x00002450" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" } ], "repeated": 0, "id": 26793 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff432c6964", "parentcaller": "0x7fff432bb551", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002450" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 26794 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff432c6990", "parentcaller": "0x7fff432bb551", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002450" } ], "repeated": 0, "id": 26795 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff5807fb58", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "MutexName", "value": "" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 26796 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002344" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop\\Steam.lnk" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 26797 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 26798 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26799 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26800 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 26801 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d5783", "parentcaller": "0x7fff58090260", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002344" }, { "name": "HandleName", "value": "C:\\Users\\Public\\Desktop\\Steam.lnk" }, { "name": "Buffer", "value": "L\\x00\\x00\\x00\\x01\\x14\\x02\\x00\\x00\\x00\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00F\\x9b\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x92\\x8dw\\xff\\xaa\\xda\\x01\\x12(CC\\x00\\xef\\xdc\\x01\\x00\\x92\\x8dw\\xff\\xaa\\xda\\x01h\\xd3B\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00s\\x01\\x14\\x00\\x1fP\\xe0O\\xd0 \\xea:i\\x10\\xa2\\xd8\\x08\\x00+00\\x9d\\x19\\x00/C:\\\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x98\\x001\\x00\\x00\\x00\\x00\\x00\\xbd\\\\xf1\\x01\\x11\\x00PROGRA~2\\x00\\x00\\x80\\x00\t\\x00\\x04\\x00\\xef\\xbe\\x87O\\xdbI\\xbd\\\\xf1\\x01.\\x00\\x00\\x00\\xc9\\x04\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00V\\x00\\x00\\x00\\x00\\x00N\\x14)\\x01P\\x00r\\x00o\\x00g\\x00r\\x00a\\x00m\\x00 \\x00F\\x00i\\x00l\\x00e\\x00s\\x00 \\x00(\\x00x\\x008\\x006\\x00)\\x00\\x00\\x00@\\x00s\\x00h\\x00e\\x00l\\x00l\\x003\\x002\\x00.\\x00d\\x00l\\x00l" }, { "name": "Length", "value": "1032" } ], "repeated": 0, "id": 26802 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26803 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26804 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 1, "id": 26805 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 26806 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26807 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26808 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 26809 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26810 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26811 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 1, "id": 26812 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 26813 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26814 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26815 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 26816 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26817 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26818 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 1, "id": 26819 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 26820 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26821 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26822 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 26823 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26824 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26825 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 1, "id": 26826 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 26827 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 26828 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002318" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 26829 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002318" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 26830 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002318" } ], "repeated": 0, "id": 26831 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 26832 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 26833 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002318" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 26834 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002318" }, { "name": "ValueName", "value": "MonitorRegistry" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\MonitorRegistry" } ], "repeated": 0, "id": 26835 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002318" } ], "repeated": 0, "id": 26836 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 26837 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 26838 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002318" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" } ], "repeated": 0, "id": 26839 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002318" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 26840 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002318" } ], "repeated": 0, "id": 26841 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 26842 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 26843 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002318" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" } ], "repeated": 0, "id": 26844 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002318" }, { "name": "ValueName", "value": "MonitorRegistry" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\MonitorRegistry" } ], "repeated": 0, "id": 26845 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002318" } ], "repeated": 0, "id": 26846 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 26847 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26848 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26849 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 26850 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff5780b767", "parentcaller": "0x7fff58085024", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002344" }, { "name": "HandleName", "value": "C:\\Users\\Public\\Desktop\\Steam.lnk" }, { "name": "FileInformationClass", "value": "4", "pretty_value": "FileBasicInformation" }, { "name": "FileInformation", "value": "\\xfe\\x05OC\\x00\\xef\\xdc\\x01\\x17$ZK\\x07\\xef\\xdc\\x01\\xfe\\x05OC\\x00\\xef\\xdc\\x01\\xfe\\x05OC\\x00\\xef\\xdc\\x01 \\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 26851 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff5780b767", "parentcaller": "0x7fff5808504b", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002344" }, { "name": "HandleName", "value": "C:\\Users\\Public\\Desktop\\Steam.lnk" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 26852 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26853 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26854 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 1, "id": 26855 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 26856 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26857 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26858 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 26859 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26860 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26861 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 1, "id": 26862 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 26863 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26864 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26865 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 26866 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26867 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26868 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 1, "id": 26869 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 26870 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26871 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26872 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 26873 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26874 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26875 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 1, "id": 26876 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 26877 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26878 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26879 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 26880 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26881 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26882 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 1, "id": 26883 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 26884 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26885 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26886 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 26887 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26888 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26889 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 1, "id": 26890 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 26891 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26892 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26893 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 26894 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26895 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26896 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 1, "id": 26897 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 26898 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26899 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26900 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 26901 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26902 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26903 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 1, "id": 26904 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 26905 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26906 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26907 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 26908 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26909 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26910 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 1, "id": 26911 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 26912 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26913 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26914 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 26915 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26916 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26917 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 1, "id": 26918 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 26919 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26920 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26921 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 26922 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26923 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26924 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 1, "id": 26925 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 26926 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26927 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26928 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 26929 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26930 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26931 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 1, "id": 26932 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 26933 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26934 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26935 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 26936 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26937 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26938 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 1, "id": 26939 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 26940 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26941 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26942 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 26943 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26944 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26945 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 1, "id": 26946 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 26947 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26948 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26949 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 26950 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26951 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26952 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 1, "id": 26953 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 26954 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26955 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26956 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 26957 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26958 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 26959 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 1, "id": 26960 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff557b4361", "parentcaller": "0x7fff557b3e47", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26961 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58080032", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 26962 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5807fd7f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" } ], "repeated": 0, "id": 26963 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5807fdaa", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 26964 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5807fdca", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 26965 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 26966 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 26967 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000026ac" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 26968 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 26969 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 26970 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 26971 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 26972 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000026ac" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 26973 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "ValueName", "value": "MonitorRegistry" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\MonitorRegistry" } ], "repeated": 0, "id": 26974 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 26975 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 26976 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 26977 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000026ac" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" } ], "repeated": 0, "id": 26978 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 26979 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 26980 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 26981 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 26982 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000026ac" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" } ], "repeated": 0, "id": 26983 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "ValueName", "value": "MonitorRegistry" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\MonitorRegistry" } ], "repeated": 0, "id": 26984 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 26985 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff55848063", "parentcaller": "0x7fff55848ae6", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" }, { "name": "Handle", "value": "0x000026ac" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" } ], "repeated": 0, "id": 26986 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff558480b3", "parentcaller": "0x7fff55848ae6", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000026ac" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 26987 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff558480df", "parentcaller": "0x7fff55848ae6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 26988 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff557c0016", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002450" } ], "repeated": 0, "id": 26989 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff52874c3e", "parentcaller": "0x7fff52878a3f", "category": "system", "api": "GetUserDefaultLCID", "status": true, "return": "0x00000c09", "arguments": [ { "name": "SystemDefaultLangID", "value": "0x00000c09" }, { "name": "LanguageName", "value": "English (Australia)" } ], "repeated": 11, "id": 26990 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432c5686", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26991 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432c5686", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002450" }, { "name": "Milliseconds", "value": "600000" } ], "repeated": 0, "id": 26992 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 26993 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff432c5ded", "parentcaller": "0x7fff432c56be", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "AB8902B4-09CA-4BB6-B78D-A8F59079A8D5" }, { "name": "ClsContext", "value": "0x00004004", "pretty_value": "CLSCTX_LOCAL_SERVER|CLSCTX_NO_FAILURE_LOG" }, { "name": "riid", "value": "75121952-E0D0-43E5-9380-1D80483ACF72" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 26994 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff432c5d25", "parentcaller": "0x7fff432c56d1", "category": "system", "api": "CreateTimerQueueTimer", "status": true, "return": "0x00000001", "arguments": [ { "name": "phNewTimer", "value": "0x0cad5f70" }, { "name": "TimerQueue", "value": "0x00000000" }, { "name": "Callback", "value": "0x432ed350" }, { "name": "Parameter", "value": "0x033aea60" }, { "name": "DueTime", "value": "60000" }, { "name": "Period", "value": "1000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 26995 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff55848063", "parentcaller": "0x7fff55848ae6", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" }, { "name": "Handle", "value": "0x00001128" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" } ], "repeated": 0, "id": 26996 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff558480b3", "parentcaller": "0x7fff55848ae6", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001128" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 26997 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff558480df", "parentcaller": "0x7fff55848ae6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001128" } ], "repeated": 0, "id": 26998 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff558499ce", "parentcaller": "0x7fff558498a0", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "CLSID\\{00021401-0000-0000-C000-000000000046}" }, { "name": "Handle", "value": "0x0000112a" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\CLSID\\{00021401-0000-0000-C000-000000000046}" } ], "repeated": 0, "id": 26999 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff558498d6", "parentcaller": "0x7fff55849723", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000112a" }, { "name": "ValueName", "value": "EnableShareDenyNone" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{00021401-0000-0000-C000-000000000046}\\EnableShareDenyNone" } ], "repeated": 0, "id": 27000 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff5807c5e9", "parentcaller": "0x7fff5807fc58", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "E2EB4CA4-C96E-4DA4-94B1-673C8334A5BB" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "265CFCAA-9B0C-44CA-996F-4A6F6620C72D" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 27001 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff5807ce6f", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022ac" }, { "name": "MutexName", "value": "" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 27002 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff5781c37f", "parentcaller": "0x7fff5781c2fc", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 27003 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d6579", "parentcaller": "0x7fff5781c32f", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000267c" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop\\Steam.lnk" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 27004 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff58096fcb", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000267c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001af4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 27005 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff57fc5921", "parentcaller": "0x7fff58097162", "category": "device", "api": "DeviceIoControl", "status": false, "return": "0x00000000", "arguments": [ { "name": "DeviceHandle", "value": "0x00001af4" }, { "name": "IoControlCode", "value": "0x00090240" }, { "name": "InBuffer", "value": "\\x01\\x00\\x0c\\x00\\x03\\x00\\x00\\x00\\x01\\x00\\x00\\x00" }, { "name": "OutBuffer", "value": "" } ], "repeated": 0, "id": 27006 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5809bd52", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000267c" } ], "repeated": 0, "id": 27007 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58080032", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022ac" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 27008 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff5807d391", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000267c" }, { "name": "MutexName", "value": "" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 27009 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000026d4" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop\\Steam.lnk" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 27010 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5807d1cc", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022ac" } ], "repeated": 0, "id": 27011 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58080032", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022ac" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 27012 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5807905d", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022ac" } ], "repeated": 0, "id": 27013 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5809b0b5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022ac" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 27014 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000267c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 27015 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27016 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000267c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27017 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000267c" } ], "repeated": 0, "id": 27018 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5809b106", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27019 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5809b106", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022ac" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27020 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5809b122", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022ac" } ], "repeated": 0, "id": 27021 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff57814097", "parentcaller": "0x7fff5807a6a8", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000026d4" }, { "name": "HandleName", "value": "C:\\Users\\Public\\Desktop\\Steam.lnk" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 27022 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cf0e1", "parentcaller": "0x7fff577cef40", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000026d0" }, { "name": "DesiredAccess", "value": "0x000f0005", "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x000026d4" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop\\Steam.lnk" } ], "repeated": 0, "id": 27023 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000026d0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08b10000" }, { "name": "SectionOffset", "value": "0x033ad6f0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 27024 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5809abbd", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27025 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5809abbd", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022ac" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27026 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27027 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000267c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27028 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000267c" } ], "repeated": 1, "id": 27029 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5809ac06", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022ac" } ], "repeated": 1, "id": 27030 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 27031 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 27032 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000026cc" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 27033 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000026cc" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 27034 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026cc" } ], "repeated": 0, "id": 27035 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 27036 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 27037 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000026cc" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 27038 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026cc" }, { "name": "ValueName", "value": "MonitorRegistry" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\MonitorRegistry" } ], "repeated": 0, "id": 27039 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026cc" } ], "repeated": 0, "id": 27040 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 27041 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 27042 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000026cc" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" } ], "repeated": 0, "id": 27043 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000026cc" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 27044 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026cc" } ], "repeated": 0, "id": 27045 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 27046 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 27047 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000026cc" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" } ], "repeated": 0, "id": 27048 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000026cc" }, { "name": "ValueName", "value": "MonitorRegistry" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\MonitorRegistry" } ], "repeated": 0, "id": 27049 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026cc" } ], "repeated": 0, "id": 27050 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d1e5c", "parentcaller": "0x7fff58090a54", "category": "filesystem", "api": "NtQueryFullAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Users\\Public\\Desktop\\Steam.lnk" } ], "repeated": 0, "id": 27051 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff557b4361", "parentcaller": "0x7fff557b3e47", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27052 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58080032", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022ac" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 27053 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff580912fe", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022ac" } ], "repeated": 0, "id": 27054 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff5807aeaa", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08b10000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 27055 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5807af2c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026d0" } ], "repeated": 0, "id": 27056 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58080032", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000267c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 27057 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5807fd7f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026d4" } ], "repeated": 0, "id": 27058 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5807fdaa", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000267c" } ], "repeated": 0, "id": 27059 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5807fdca", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000267c" } ], "repeated": 0, "id": 27060 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5807ea94", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af4" } ], "repeated": 0, "id": 27061 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5807eabd", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002688" } ], "repeated": 0, "id": 27062 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5807c972", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022ac" } ], "repeated": 0, "id": 27063 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff59f5c23a", "parentcaller": "0x7fff59f5c30d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026d8" } ], "repeated": 0, "id": 27064 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff558497da", "parentcaller": "0x7fff55849057", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000112a" } ], "repeated": 0, "id": 27065 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff557c0016", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 27066 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27067 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000c7c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27068 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432cbf4b", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002450" } ], "repeated": 0, "id": 27069 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff5807fb58", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" }, { "name": "MutexName", "value": "" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 27070 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002518" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop\\Steam.lnk" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 27071 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 27072 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27073 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27074 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" } ], "repeated": 0, "id": 27075 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d5783", "parentcaller": "0x7fff58090260", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002518" }, { "name": "HandleName", "value": "C:\\Users\\Public\\Desktop\\Steam.lnk" }, { "name": "Buffer", "value": "L\\x00\\x00\\x00\\x01\\x14\\x02\\x00\\x00\\x00\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00F\\x9b\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x92\\x8dw\\xff\\xaa\\xda\\x01\\x12(CC\\x00\\xef\\xdc\\x01\\x00\\x92\\x8dw\\xff\\xaa\\xda\\x01h\\xd3B\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00s\\x01\\x14\\x00\\x1fP\\xe0O\\xd0 \\xea:i\\x10\\xa2\\xd8\\x08\\x00+00\\x9d\\x19\\x00/C:\\\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x98\\x001\\x00\\x00\\x00\\x00\\x00\\xbd\\\\xf1\\x01\\x11\\x00PROGRA~2\\x00\\x00\\x80\\x00\t\\x00\\x04\\x00\\xef\\xbe\\x87O\\xdbI\\xbd\\\\xf1\\x01.\\x00\\x00\\x00\\xc9\\x04\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00V\\x00\\x00\\x00\\x00\\x00N\\x14)\\x01P\\x00r\\x00o\\x00g\\x00r\\x00a\\x00m\\x00 \\x00F\\x00i\\x00l\\x00e\\x00s\\x00 \\x00(\\x00x\\x008\\x006\\x00)\\x00\\x00\\x00@\\x00s\\x00h\\x00e\\x00l\\x00l\\x003\\x002\\x00.\\x00d\\x00l\\x00l" }, { "name": "Length", "value": "1032" } ], "repeated": 0, "id": 27076 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27077 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27078 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" } ], "repeated": 1, "id": 27079 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 27080 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27081 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27082 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" } ], "repeated": 0, "id": 27083 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27084 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27085 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" } ], "repeated": 1, "id": 27086 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 27087 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27088 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27089 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" } ], "repeated": 0, "id": 27090 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27091 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27092 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" } ], "repeated": 1, "id": 27093 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 27094 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27095 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27096 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" } ], "repeated": 0, "id": 27097 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27098 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27099 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" } ], "repeated": 1, "id": 27100 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 27101 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 27102 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002584" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 27103 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002584" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 27104 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002584" } ], "repeated": 0, "id": 27105 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 27106 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 27107 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002584" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 27108 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002584" }, { "name": "ValueName", "value": "MonitorRegistry" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\MonitorRegistry" } ], "repeated": 0, "id": 27109 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002584" } ], "repeated": 0, "id": 27110 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 27111 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 27112 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002584" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" } ], "repeated": 0, "id": 27113 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002584" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 27114 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002584" } ], "repeated": 0, "id": 27115 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 27116 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 27117 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002584" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" } ], "repeated": 0, "id": 27118 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002584" }, { "name": "ValueName", "value": "MonitorRegistry" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\MonitorRegistry" } ], "repeated": 0, "id": 27119 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002584" } ], "repeated": 0, "id": 27120 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 27121 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27122 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27123 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" } ], "repeated": 0, "id": 27124 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff5780b767", "parentcaller": "0x7fff58085024", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002518" }, { "name": "HandleName", "value": "C:\\Users\\Public\\Desktop\\Steam.lnk" }, { "name": "FileInformationClass", "value": "4", "pretty_value": "FileBasicInformation" }, { "name": "FileInformation", "value": "\\xfe\\x05OC\\x00\\xef\\xdc\\x01\\x17$ZK\\x07\\xef\\xdc\\x01\\xfe\\x05OC\\x00\\xef\\xdc\\x01\\xfe\\x05OC\\x00\\xef\\xdc\\x01 \\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 27125 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff5780b767", "parentcaller": "0x7fff5808504b", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002518" }, { "name": "HandleName", "value": "C:\\Users\\Public\\Desktop\\Steam.lnk" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 27126 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27127 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27128 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" } ], "repeated": 1, "id": 27129 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 27130 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27131 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27132 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" } ], "repeated": 0, "id": 27133 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27134 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27135 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" } ], "repeated": 1, "id": 27136 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 27137 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27138 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27139 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" } ], "repeated": 0, "id": 27140 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27141 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27142 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" } ], "repeated": 1, "id": 27143 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 27144 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27145 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27146 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" } ], "repeated": 0, "id": 27147 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27148 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27149 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" } ], "repeated": 1, "id": 27150 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 27151 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27152 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27153 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" } ], "repeated": 0, "id": 27154 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27155 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27156 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" } ], "repeated": 1, "id": 27157 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 27158 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27159 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27160 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" } ], "repeated": 0, "id": 27161 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27162 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27163 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" } ], "repeated": 1, "id": 27164 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 27165 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27166 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27167 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" } ], "repeated": 0, "id": 27168 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27169 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27170 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" } ], "repeated": 1, "id": 27171 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 27172 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27173 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27174 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" } ], "repeated": 0, "id": 27175 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27176 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27177 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" } ], "repeated": 1, "id": 27178 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 27179 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27180 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27181 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" } ], "repeated": 0, "id": 27182 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27183 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27184 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" } ], "repeated": 1, "id": 27185 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 27186 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27187 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27188 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" } ], "repeated": 0, "id": 27189 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27190 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27191 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" } ], "repeated": 1, "id": 27192 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 27193 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27194 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27195 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" } ], "repeated": 0, "id": 27196 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27197 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27198 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" } ], "repeated": 1, "id": 27199 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 27200 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27201 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27202 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" } ], "repeated": 0, "id": 27203 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27204 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27205 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" } ], "repeated": 1, "id": 27206 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 27207 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27208 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27209 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" } ], "repeated": 0, "id": 27210 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27211 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27212 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" } ], "repeated": 1, "id": 27213 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 27214 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27215 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27216 }, { "timestamp": "2026-05-29 01:05:52,227", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" } ], "repeated": 0, "id": 27217 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27218 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27219 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" } ], "repeated": 1, "id": 27220 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 27221 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27222 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27223 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" } ], "repeated": 0, "id": 27224 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27225 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27226 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" } ], "repeated": 1, "id": 27227 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 27228 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27229 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27230 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" } ], "repeated": 0, "id": 27231 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27232 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27233 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" } ], "repeated": 1, "id": 27234 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff557b4361", "parentcaller": "0x7fff557b3e47", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27235 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58080032", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 27236 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5807fd7f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002518" } ], "repeated": 0, "id": 27237 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5807fdaa", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" } ], "repeated": 0, "id": 27238 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5807fdca", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" } ], "repeated": 0, "id": 27239 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 27240 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 27241 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002614" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 27242 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002614" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 27243 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" } ], "repeated": 0, "id": 27244 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 27245 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 27246 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002614" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 27247 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" }, { "name": "ValueName", "value": "MonitorRegistry" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\MonitorRegistry" } ], "repeated": 0, "id": 27248 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" } ], "repeated": 0, "id": 27249 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 27250 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 27251 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002614" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" } ], "repeated": 0, "id": 27252 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002614" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 27253 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" } ], "repeated": 0, "id": 27254 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 27255 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 27256 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002614" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" } ], "repeated": 0, "id": 27257 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002614" }, { "name": "ValueName", "value": "MonitorRegistry" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\MonitorRegistry" } ], "repeated": 0, "id": 27258 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" } ], "repeated": 0, "id": 27259 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff55848063", "parentcaller": "0x7fff55848ae6", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" }, { "name": "Handle", "value": "0x00002614" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" } ], "repeated": 0, "id": 27260 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff558480b3", "parentcaller": "0x7fff55848ae6", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002614" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 27261 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff558480df", "parentcaller": "0x7fff55848ae6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" } ], "repeated": 0, "id": 27262 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff557c0016", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002450" } ], "repeated": 0, "id": 27263 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff52874c3e", "parentcaller": "0x7fff52878a3f", "category": "system", "api": "GetUserDefaultLCID", "status": true, "return": "0x00000c09", "arguments": [ { "name": "SystemDefaultLangID", "value": "0x00000c09" }, { "name": "LanguageName", "value": "English (Australia)" } ], "repeated": 11, "id": 27264 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff432c690b", "parentcaller": "0x7fff432b67f7", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" }, { "name": "Handle", "value": "0x00002450" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" } ], "repeated": 0, "id": 27265 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff432c6964", "parentcaller": "0x7fff432b67f7", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002450" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 27266 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff432c6990", "parentcaller": "0x7fff432b67f7", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002450" } ], "repeated": 0, "id": 27267 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432baa24", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27268 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432baa24", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 27269 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bc79b", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002450" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 27270 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bc7ca", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002614" } ], "repeated": 0, "id": 27271 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bc7fe", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "0\\xe7:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00`\\xda\\xd9\\xff\\xff\\xff\\xff\\xffK\\x87\\K\\x07\\xef\\xdc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xda\\xd9\\xff\\xff\\xff\\xff\\xffH\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 27272 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bc8d0", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002518" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 27273 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8e4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" } ], "repeated": 0, "id": 27274 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002450" } ], "repeated": 0, "id": 27275 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432baa73", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 27276 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432b9503", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 27277 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b953e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002518" } ], "repeated": 0, "id": 27278 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432b95a7", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002518" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 27279 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432b95d8", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002450" } ], "repeated": 0, "id": 27280 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432b9610", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x10\\xe7:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00i\\xd5[\\x1a\\xff\\x7f\\x00\\x00\\xd0\\xe7:\\x03\\x00\\x00\\x00\\x00\\x10\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0fP\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9d|}\\x1a\\xff\\x7f\\x00\\x00(\\x8b}\\x1a\\xff\\x7f\\x00\\x00\\x10\r\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 27281 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432b96e3", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 27282 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b96f7", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002450" } ], "repeated": 0, "id": 27283 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b9706", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002518" } ], "repeated": 0, "id": 27284 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b9732", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" } ], "repeated": 0, "id": 27285 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432b9779", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 27286 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff432b9455", "parentcaller": "0x7fff432baae3", "category": "filesystem", "api": "GetDiskFreeSpaceExW", "status": true, "return": "0x00000001", "arguments": [ { "name": "DirectoryName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" } ], "repeated": 0, "id": 27287 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27288 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 27289 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002614" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 27290 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002518" } ], "repeated": 0, "id": 27291 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe9:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00(\\xec:\\x03\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 27292 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002450" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 27293 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002518" } ], "repeated": 0, "id": 27294 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" } ], "repeated": 0, "id": 27295 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 27296 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 27297 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002450" } ], "repeated": 0, "id": 27298 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002450" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 27299 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002614" } ], "repeated": 0, "id": 27300 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xffP$\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\x98\\x080y^t\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 27301 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002518" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 27302 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" } ], "repeated": 0, "id": 27303 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002450" } ], "repeated": 0, "id": 27304 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002518" } ], "repeated": 0, "id": 27305 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 27306 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27307 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 27308 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000023a0" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 27309 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002414" } ], "repeated": 0, "id": 27310 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe9:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00(\\xec:\\x03\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 27311 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002524" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 27312 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002414" } ], "repeated": 0, "id": 27313 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000023a0" } ], "repeated": 0, "id": 27314 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 27315 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 27316 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002524" } ], "repeated": 0, "id": 27317 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002524" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 27318 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000023a0" } ], "repeated": 0, "id": 27319 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xffP$\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\x98\\x080y^t\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 27320 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002414" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 27321 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000023a0" } ], "repeated": 0, "id": 27322 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002524" } ], "repeated": 0, "id": 27323 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002414" } ], "repeated": 0, "id": 27324 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 27325 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27326 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 27327 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002414" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 27328 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002518" } ], "repeated": 0, "id": 27329 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe9:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00(\\xec:\\x03\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 27330 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002450" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 27331 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002518" } ], "repeated": 0, "id": 27332 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002414" } ], "repeated": 0, "id": 27333 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 27334 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 27335 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002450" } ], "repeated": 0, "id": 27336 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002450" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 27337 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002414" } ], "repeated": 0, "id": 27338 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xffP$\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\x98\\x080y^t\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 27339 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002518" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 27340 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002414" } ], "repeated": 0, "id": 27341 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002450" } ], "repeated": 0, "id": 27342 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002518" } ], "repeated": 0, "id": 27343 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 27344 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27345 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 27346 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002518" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 27347 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002450" } ], "repeated": 0, "id": 27348 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe9:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00(\\xec:\\x03\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 27349 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002414" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 27350 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002450" } ], "repeated": 0, "id": 27351 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002518" } ], "repeated": 0, "id": 27352 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 27353 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 27354 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002414" } ], "repeated": 0, "id": 27355 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002414" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 27356 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002518" } ], "repeated": 0, "id": 27357 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xffP$\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\x98\\x080y^t\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 27358 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002450" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 27359 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002518" } ], "repeated": 0, "id": 27360 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002414" } ], "repeated": 0, "id": 27361 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002450" } ], "repeated": 0, "id": 27362 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 27363 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27364 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 27365 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002450" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 27366 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002414" } ], "repeated": 0, "id": 27367 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe9:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00(\\xec:\\x03\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 27368 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002518" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 27369 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002414" } ], "repeated": 0, "id": 27370 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002450" } ], "repeated": 0, "id": 27371 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 27372 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 27373 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002518" } ], "repeated": 0, "id": 27374 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002518" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 27375 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002450" } ], "repeated": 0, "id": 27376 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xffP$\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\x98\\x080y^t\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 27377 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002414" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 27378 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002450" } ], "repeated": 0, "id": 27379 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002518" } ], "repeated": 0, "id": 27380 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002414" } ], "repeated": 0, "id": 27381 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 27382 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27383 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 27384 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002414" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 27385 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002518" } ], "repeated": 0, "id": 27386 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe9:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00(\\xec:\\x03\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 27387 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002450" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 27388 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002518" } ], "repeated": 0, "id": 27389 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002414" } ], "repeated": 0, "id": 27390 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 27391 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 27392 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002450" } ], "repeated": 0, "id": 27393 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002450" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 27394 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002414" } ], "repeated": 0, "id": 27395 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xffP$\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\x98\\x080y^t\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 27396 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002518" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 27397 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002414" } ], "repeated": 0, "id": 27398 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002450" } ], "repeated": 0, "id": 27399 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002518" } ], "repeated": 0, "id": 27400 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 27401 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27402 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 27403 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002518" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 27404 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002450" } ], "repeated": 0, "id": 27405 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe9:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00(\\xec:\\x03\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 27406 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002414" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 27407 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002450" } ], "repeated": 0, "id": 27408 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002518" } ], "repeated": 0, "id": 27409 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 27410 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 27411 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002414" } ], "repeated": 0, "id": 27412 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002414" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 27413 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002518" } ], "repeated": 0, "id": 27414 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xffP$\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\x98\\x080y^t\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 27415 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002450" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 27416 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002518" } ], "repeated": 0, "id": 27417 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002414" } ], "repeated": 0, "id": 27418 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002450" } ], "repeated": 0, "id": 27419 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 27420 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27421 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 27422 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002450" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 27423 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002414" } ], "repeated": 0, "id": 27424 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe9:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00(\\xec:\\x03\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 27425 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002518" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 27426 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002414" } ], "repeated": 0, "id": 27427 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002450" } ], "repeated": 0, "id": 27428 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 27429 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 27430 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002518" } ], "repeated": 0, "id": 27431 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002518" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 27432 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002450" } ], "repeated": 0, "id": 27433 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xffP$\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\x98\\x080y^t\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 27434 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002414" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 27435 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002450" } ], "repeated": 0, "id": 27436 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002518" } ], "repeated": 0, "id": 27437 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002414" } ], "repeated": 0, "id": 27438 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 27439 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27440 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 27441 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002414" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 27442 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002518" } ], "repeated": 0, "id": 27443 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe9:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00(\\xec:\\x03\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 27444 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002450" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 27445 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002518" } ], "repeated": 0, "id": 27446 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002414" } ], "repeated": 0, "id": 27447 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 27448 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 27449 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002450" } ], "repeated": 0, "id": 27450 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002450" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 27451 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002414" } ], "repeated": 0, "id": 27452 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xffP$\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\x98\\x080y^t\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 27453 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002518" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 27454 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002414" } ], "repeated": 0, "id": 27455 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002450" } ], "repeated": 0, "id": 27456 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002518" } ], "repeated": 0, "id": 27457 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 27458 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27459 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 27460 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002518" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 27461 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002450" } ], "repeated": 0, "id": 27462 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe9:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00(\\xec:\\x03\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 27463 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002414" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 27464 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002450" } ], "repeated": 0, "id": 27465 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002518" } ], "repeated": 0, "id": 27466 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 27467 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 27468 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002414" } ], "repeated": 0, "id": 27469 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002414" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 27470 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002518" } ], "repeated": 0, "id": 27471 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xffP$\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\x98\\x080y^t\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 27472 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002450" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 27473 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002518" } ], "repeated": 0, "id": 27474 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002414" } ], "repeated": 0, "id": 27475 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002450" } ], "repeated": 0, "id": 27476 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 27477 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27478 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 27479 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002450" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 27480 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002414" } ], "repeated": 0, "id": 27481 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe9:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00(\\xec:\\x03\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 27482 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002518" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 27483 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002414" } ], "repeated": 0, "id": 27484 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002450" } ], "repeated": 0, "id": 27485 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 27486 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 27487 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002518" } ], "repeated": 0, "id": 27488 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002518" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 27489 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002450" } ], "repeated": 0, "id": 27490 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xffP$\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\x98\\x080y^t\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 27491 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002414" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 27492 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002450" } ], "repeated": 0, "id": 27493 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002518" } ], "repeated": 0, "id": 27494 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002414" } ], "repeated": 0, "id": 27495 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 27496 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27497 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 27498 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002414" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 27499 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002518" } ], "repeated": 0, "id": 27500 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe9:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00(\\xec:\\x03\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 27501 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002450" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 27502 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002518" } ], "repeated": 0, "id": 27503 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002414" } ], "repeated": 0, "id": 27504 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 27505 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 27506 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002450" } ], "repeated": 0, "id": 27507 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002450" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 27508 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002414" } ], "repeated": 0, "id": 27509 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xffP$\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\x98\\x080y^t\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 27510 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002518" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 27511 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002414" } ], "repeated": 0, "id": 27512 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002450" } ], "repeated": 0, "id": 27513 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002518" } ], "repeated": 0, "id": 27514 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 27515 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27516 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 27517 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002518" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 27518 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002450" } ], "repeated": 0, "id": 27519 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe9:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00(\\xec:\\x03\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 27520 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002414" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 27521 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002450" } ], "repeated": 0, "id": 27522 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002518" } ], "repeated": 0, "id": 27523 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 27524 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 27525 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002414" } ], "repeated": 0, "id": 27526 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002414" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 27527 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002518" } ], "repeated": 0, "id": 27528 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xffP$\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\x98\\x080y^t\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 27529 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002450" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 27530 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002518" } ], "repeated": 0, "id": 27531 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002414" } ], "repeated": 0, "id": 27532 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002450" } ], "repeated": 0, "id": 27533 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 27534 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff5780d897", "parentcaller": "0x7fff432b949c", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000d5c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00@\\x00\\x00\\x00\\x00\\x00\\x00`9\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 27535 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bc5ce", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27536 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bc5ce", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 27537 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bc79b", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002450" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 27538 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bc7ca", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002414" } ], "repeated": 0, "id": 27539 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bc7fe", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xe0\\xe6:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00`\\xda\\xd9\\xff\\xff\\xff\\xff\\xffK\\x87\\K\\x07\\xef\\xdc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xda\\xd9\\xff\\xff\\xff\\xff\\xffH\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\r\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 27540 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bc8d0", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002518" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 27541 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8e4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002414" } ], "repeated": 0, "id": 27542 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002450" } ], "repeated": 0, "id": 27543 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bc61a", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 27544 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bc669", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 27545 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc691", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002518" } ], "repeated": 0, "id": 27546 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bc79b", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002518" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 27547 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bc7ca", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002450" } ], "repeated": 0, "id": 27548 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bc7fe", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xe0\\xe6:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x18%\\x00\\x00\\x00\\x00\\x00\\x00\\x18%\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x81|}\\x1a\\xff\\x7f\\x00\\x00(\\x8b}\\x1a\\xff\\x7f\\x00\\x00\\x18%\\x00\\x00\\x00\\x00\\x00\\x00\\x18%\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x85g}W\\xff\\x7f\\x00\\x00\\x18%\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 27549 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bc8d0", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002414" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 27550 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8e4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002450" } ], "repeated": 0, "id": 27551 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002518" } ], "repeated": 0, "id": 27552 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc6d4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002414" } ], "repeated": 0, "id": 27553 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bc6f9", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 27554 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432c08f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d84" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 27555 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff5780d897", "parentcaller": "0x7fff432c0a96", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001c54" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 27556 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bbc69", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 27557 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bc79b", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002414" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 27558 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bc7ca", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002518" } ], "repeated": 0, "id": 27559 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bc7fe", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xe8:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xf7\\x8b\\x10\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00T\\x1c\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 27560 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bc8d0", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002450" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 27561 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8e4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002518" } ], "repeated": 0, "id": 27562 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002414" } ], "repeated": 0, "id": 27563 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bbccd", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002450" } ], "repeated": 0, "id": 27564 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff5780d897", "parentcaller": "0x7fff432bd729", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000d5c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00@\\x00\\x00\\x00\\x00\\x00\\x00`9\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 27565 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432b9392", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 27566 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bc79b", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002450" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 27567 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bc7ca", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002414" } ], "repeated": 0, "id": 27568 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bc7fe", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "p\\xe8:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00]\\xdd|W\\xff\\x7f\\x00\\x007\\x008\\x00c\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1aw\\x89\\x9d\\xday9,4\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x92\\x93+C\\xff\\x7f\\x00\\x00" } ], "repeated": 0, "id": 27569 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bc8d0", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002518" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!478c" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 27570 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8e4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002414" } ], "repeated": 0, "id": 27571 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002450" } ], "repeated": 0, "id": 27572 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b6a3f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002518" } ], "repeated": 0, "id": 27573 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bbc69", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 27574 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bc79b", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002518" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 27575 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bc7ca", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002450" } ], "repeated": 0, "id": 27576 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bc7fe", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x10\\xe7:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x8c\\x07&\\x13\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04m+C\\xff\\x7f\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 27577 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bc8d0", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002414" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 27578 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8e4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002450" } ], "repeated": 0, "id": 27579 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002518" } ], "repeated": 0, "id": 27580 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bbccd", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002414" } ], "repeated": 0, "id": 27581 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff5780d897", "parentcaller": "0x7fff432bd729", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000d5c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00@\\x00\\x00\\x00\\x00\\x00\\x00`9\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 27582 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432c084a", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 27583 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432c0a05", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d84" } ], "repeated": 0, "id": 27584 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff558b2b5a", "parentcaller": "0x7fff558658f2", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001011c" }, { "name": "Message", "value": "0x000004b5" } ], "repeated": 0, "id": 27585 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6bcf", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc00000ba", "pretty_return": "FILE_IS_A_DIRECTORY", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Desktop" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 27586 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002414" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Desktop\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 27587 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d5cfb", "parentcaller": "0x7fff577d6bfa", "category": "device", "api": "DeviceIoControl", "status": false, "return": "0x00000000", "arguments": [ { "name": "DeviceHandle", "value": "0x00002414" }, { "name": "IoControlCode", "value": "0x000900a8", "pretty_value": "FSCTL_GET_REPARSE_POINT" }, { "name": "InBuffer", "value": "" }, { "name": "OutBuffer", "value": "\\x00\\xd5:\\x03\\x00\\x00\\x00\\x000\\xd5:\\x03\\x00\\x00\\x00\\x00\\x80\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\xba\\x00\\x00\\xc0\\xff\\xff\\xff\\xff\\x86\r\\x05\\xe4\\x97\\x9c\\x00\\x00\\x08\\x82}\\x1a\\xff\\x7f\\x00\\x00\\xd0\\xca\\xc5\\x0b\\x00\\x00\\x00\\x00\\xba\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0u\\xb3\\x0c\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xd5:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfak}W\\xff\\x7f\\x00\\x00C\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xd5:\\x03\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x004\\x008\\x00\\xff\\x7f\\x00\\x00\\xd0\\xca\\xc5\\x0b\\x00\\x00\\x00\\x00\\xc0\\xd5:\\x03\\x00\\x00\\x00\\x00`\\xdc:\\x03\\x00\\x00\\x00\\x00$J\\x0cZ\\xff\\x7f\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\xd5:\\x03\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 27588 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff577d5d22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002414" } ], "repeated": 0, "id": 27589 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6c28", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000494" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Desktop" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 27590 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6cc4", "parentcaller": "0x7fff577d6f7c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 27591 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d4d82", "parentcaller": "0x7fff577d6fe6", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002414" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Desktop" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 27592 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d4dc6", "parentcaller": "0x7fff577d6fe6", "category": "device", "api": "DeviceIoControl", "status": false, "return": "0x00000000", "arguments": [ { "name": "DeviceHandle", "value": "0x00002414" }, { "name": "IoControlCode", "value": "0x004d0008", "pretty_value": "IOCTL_MOUNTDEV_QUERY_DEVICE_NAME" }, { "name": "InBuffer", "value": "" }, { "name": "OutBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xe0:\\x03\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xffF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x7f\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\x1f\\x00\\x00\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00k\\xb8\\xf7Y\\xff\\x7f\\x00\\x00\\x0f\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xc6j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00,\\x00.\\x00\\x00\\x00\\x00\\x00\\xd0\\xc8\\xc5\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x82%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\xa4\\x04%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10@\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\x0c%\\x01\\x00\\x00\\x00\\x00\\x16\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 27593 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d4dd4", "parentcaller": "0x7fff577d6fe6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002414" } ], "repeated": 0, "id": 27594 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000494" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Desktop\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 27595 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d5cfb", "parentcaller": "0x7fff577d7000", "category": "device", "api": "DeviceIoControl", "status": false, "return": "0x00000000", "arguments": [ { "name": "DeviceHandle", "value": "0x00000494" }, { "name": "IoControlCode", "value": "0x000900a8", "pretty_value": "FSCTL_GET_REPARSE_POINT" }, { "name": "InBuffer", "value": "" }, { "name": "OutBuffer", "value": "\\x98D\\xd4U\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd9:\\x03\\x00\\x00\\x00\\x00,\\x00.\\x00\\x00\\x00\\x00\\x00V\\x07\\x05\\xe4\\x97\\x9c\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0u\\xb3\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xdb:\\x03\\x00\\x00\\x00\\x00\\xe0\\xdf\\xbe\\x08\\x00\\x00\\x00\\x00\\xd0u\\xb3\\x0c\\x00\\x00\\x00\\x00y\\xda:\\x03\\x00\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00p}W\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\xd0u\\xb3\\x0c\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x01\\x00\\x00\\x00\\x00\\x00\\x00.\\x00.\\x00\\x00\\x00\\x00\\x00\\xd0u\\xb3\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00.\\x000\\x00\\x00\\x00\\x00\\x00\\xd0u\\xb3\\x0c\\x00\\x00\\x00\\x00\\x06\\x0b\\x05\\xe4\\x97\\x9c\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 27596 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff577d5d22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 27597 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6bcf", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc00000ba", "pretty_return": "FILE_IS_A_DIRECTORY", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 27598 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000494" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 27599 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d5cfb", "parentcaller": "0x7fff577d6bfa", "category": "device", "api": "DeviceIoControl", "status": false, "return": "0x00000000", "arguments": [ { "name": "DeviceHandle", "value": "0x00000494" }, { "name": "IoControlCode", "value": "0x000900a8", "pretty_value": "FSCTL_GET_REPARSE_POINT" }, { "name": "InBuffer", "value": "" }, { "name": "OutBuffer", "value": "\\x00\\xd5:\\x03\\x00\\x00\\x00\\x000\\xd5:\\x03\\x00\\x00\\x00\\x00\\x80\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\xba\\x00\\x00\\xc0\\xff\\xff\\xff\\xff\\x86\r\\x05\\xe4\\x97\\x9c\\x00\\x00\\x08\\x82}\\x1a\\xff\\x7f\\x00\\x00\\x00/\\xb2\\x0c\\x00\\x00\\x00\\x00\\xba\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0u\\xb3\\x0c\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xd5:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfak}W\\xff\\x7f\\x00\\x00C\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xd5:\\x03\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00$\\x00(\\x00\\x00\\x00\\x00\\x00\\x00/\\xb2\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\xd5:\\x03\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 27600 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff577d5d22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 27601 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6c28", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002450" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 27602 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6cc4", "parentcaller": "0x7fff577d6f7c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002450" } ], "repeated": 0, "id": 27603 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d4d82", "parentcaller": "0x7fff577d6fe6", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002614" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 27604 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d4dc6", "parentcaller": "0x7fff577d6fe6", "category": "device", "api": "DeviceIoControl", "status": false, "return": "0x00000000", "arguments": [ { "name": "DeviceHandle", "value": "0x00002614" }, { "name": "IoControlCode", "value": "0x004d0008", "pretty_value": "IOCTL_MOUNTDEV_QUERY_DEVICE_NAME" }, { "name": "InBuffer", "value": "" }, { "name": "OutBuffer", "value": "" } ], "repeated": 0, "id": 27605 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d4dd4", "parentcaller": "0x7fff577d6fe6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" } ], "repeated": 0, "id": 27606 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002614" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 27607 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d5cfb", "parentcaller": "0x7fff577d7000", "category": "device", "api": "DeviceIoControl", "status": false, "return": "0x00000000", "arguments": [ { "name": "DeviceHandle", "value": "0x00002614" }, { "name": "IoControlCode", "value": "0x000900a8", "pretty_value": "FSCTL_GET_REPARSE_POINT" }, { "name": "InBuffer", "value": "" }, { "name": "OutBuffer", "value": "\\x98D\\xd4U\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd9:\\x03\\x00\\x00\\x00\\x00,\\x00.\\x00\\x00\\x00\\x00\\x00V\\x07\\x05\\xe4\\x97\\x9c\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0u\\xb3\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xdb:\\x03\\x00\\x00\\x00\\x00\\xe0\\xdf\\xbe\\x08\\x00\\x00\\x00\\x00\\xd0u\\xb3\\x0c\\x00\\x00\\x00\\x00y\\xda:\\x03\\x00\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00p}W\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\xd0u\\xb3\\x0c\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00D\\x00\\x00\\x00\\x04\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x1e\\x00 \\x00\\x00\\x00\\x00\\x00\\xd0u\\xb3\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xeeu\\xb3\\x0c\\x00\\x00\\x00\\x00\\x1e\\x00 \\x00\\x00\\x00\\x00\\x00\\xd0u\\xb3\\x0c\\x00\\x00\\x00\\x00\\x06\\x0b\\x05\\xe4\\x97\\x9c\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 27608 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff577d5d22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" } ], "repeated": 0, "id": 27609 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6bcf", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc00000ba", "pretty_return": "FILE_IS_A_DIRECTORY", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 27610 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002614" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 27611 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d5cfb", "parentcaller": "0x7fff577d6bfa", "category": "device", "api": "DeviceIoControl", "status": false, "return": "0x00000000", "arguments": [ { "name": "DeviceHandle", "value": "0x00002614" }, { "name": "IoControlCode", "value": "0x000900a8", "pretty_value": "FSCTL_GET_REPARSE_POINT" }, { "name": "InBuffer", "value": "" }, { "name": "OutBuffer", "value": "\\x00\\xd5:\\x03\\x00\\x00\\x00\\x000\\xd5:\\x03\\x00\\x00\\x00\\x00\\x80\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\xba\\x00\\x00\\xc0\\xff\\xff\\xff\\xff\\x86\r\\x05\\xe4\\x97\\x9c\\x00\\x00\\x08\\x82}\\x1a\\xff\\x7f\\x00\\x00`,\\xb2\\x0c\\x00\\x00\\x00\\x00\\xba\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0u\\xb3\\x0c\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xd5:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfak}W\\xff\\x7f\\x00\\x00C\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xd5:\\x03\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x1c\\x00\\x00\\x00\\x00\\x00`,\\xb2\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\xd5:\\x03\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 27612 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff577d5d22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" } ], "repeated": 0, "id": 27613 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6c28", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002614" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 27614 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6cc4", "parentcaller": "0x7fff577d6f7c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" } ], "repeated": 0, "id": 27615 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d4d82", "parentcaller": "0x7fff577d6fe6", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002614" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 27616 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d4dc6", "parentcaller": "0x7fff577d6fe6", "category": "device", "api": "DeviceIoControl", "status": false, "return": "0x00000000", "arguments": [ { "name": "DeviceHandle", "value": "0x00002614" }, { "name": "IoControlCode", "value": "0x004d0008", "pretty_value": "IOCTL_MOUNTDEV_QUERY_DEVICE_NAME" }, { "name": "InBuffer", "value": "" }, { "name": "OutBuffer", "value": "" } ], "repeated": 0, "id": 27617 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d4dd4", "parentcaller": "0x7fff577d6fe6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" } ], "repeated": 0, "id": 27618 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002614" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 27619 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d5cfb", "parentcaller": "0x7fff577d7000", "category": "device", "api": "DeviceIoControl", "status": false, "return": "0x00000000", "arguments": [ { "name": "DeviceHandle", "value": "0x00002614" }, { "name": "IoControlCode", "value": "0x000900a8", "pretty_value": "FSCTL_GET_REPARSE_POINT" }, { "name": "InBuffer", "value": "" }, { "name": "OutBuffer", "value": "\\x98D\\xd4U\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd9:\\x03\\x00\\x00\\x00\\x00,\\x00.\\x00\\x00\\x00\\x00\\x00V\\x07\\x05\\xe4\\x97\\x9c\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0u\\xb3\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xdb:\\x03\\x00\\x00\\x00\\x00\\xe0\\xdf\\xbe\\x08\\x00\\x00\\x00\\x00\\xd0u\\xb3\\x0c\\x00\\x00\\x00\\x00y\\xda:\\x03\\x00\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00p}W\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\xd0u\\xb3\\x0c\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00a\\x00\\x00\\x00\\x04\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x12\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\xd0u\\xb3\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xe2u\\xb3\\x0c\\x00\\x00\\x00\\x00\\x12\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\xd0u\\xb3\\x0c\\x00\\x00\\x00\\x00\\x06\\x0b\\x05\\xe4\\x97\\x9c\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 27620 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff577d5d22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" } ], "repeated": 0, "id": 27621 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d4d82", "parentcaller": "0x7fff577d70c7", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002614" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 27622 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d4dc6", "parentcaller": "0x7fff577d70c7", "category": "device", "api": "DeviceIoControl", "status": true, "return": "0x00000001", "arguments": [ { "name": "DeviceHandle", "value": "0x00002614" }, { "name": "IoControlCode", "value": "0x004d0008", "pretty_value": "IOCTL_MOUNTDEV_QUERY_DEVICE_NAME" }, { "name": "InBuffer", "value": "" }, { "name": "OutBuffer", "value": ".\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00" } ], "repeated": 0, "id": 27623 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d4dd4", "parentcaller": "0x7fff577d70c7", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" } ], "repeated": 0, "id": 27624 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d4f8e", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002614" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\MountPointManager" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 27625 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d4fcf", "parentcaller": "0x7fff577d70c7", "category": "device", "api": "DeviceIoControl", "status": false, "return": "0x00000000", "arguments": [ { "name": "DeviceHandle", "value": "0x00002614" }, { "name": "IoControlCode", "value": "0x006d0008", "pretty_value": "IOCTL_MOUNTMGR_QUERY_POINTS" }, { "name": "InBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00.\\x00\\x00\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00" }, { "name": "OutBuffer", "value": "\\xee\\x00\\x00\\x00\\x02\\x00\\x00\\x00" } ], "repeated": 0, "id": 27626 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d4fcf", "parentcaller": "0x7fff577d70c7", "category": "device", "api": "DeviceIoControl", "status": true, "return": "0x00000001", "arguments": [ { "name": "DeviceHandle", "value": "0x00002614" }, { "name": "IoControlCode", "value": "0x006d0008", "pretty_value": "IOCTL_MOUNTMGR_QUERY_POINTS" }, { "name": "InBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00.\\x00\\x00\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00" }, { "name": "OutBuffer", "value": "\\xee\\x00\\x00\\x00\\x02\\x00\\x00\\x00r\\x00\\x00\\x00\\x1c\\x00\\x00\\x008\\x00\\x00\\x00\\x0c\\x00\\x00\\x00D\\x00\\x00\\x00.\\x00\\x00\\x00\\x8e\\x00\\x00\\x00`\\x00\\x00\\x008\\x00\\x00\\x00\\x0c\\x00\\x00\\x00D\\x00\\x00\\x00.\\x00\\x00\\x00/\\x10\\x8cR\\x00\\x000\\x03\\x00\\x00\\x00\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00\\\\x00D\\x00o\\x00s\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00s\\x00\\\\x00C\\x00:\\x00\\\\x00?\\x00?\\x00\\\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00{\\x005\\x002\\x008\\x00c\\x001\\x000\\x002\\x00f\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x003\\x000\\x000\\x003\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x00}\\x00" } ], "repeated": 0, "id": 27627 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff577d4fe3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" } ], "repeated": 0, "id": 27628 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bbd54", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 27629 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bc79b", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002614" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 27630 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bc7ca", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000026ac" } ], "repeated": 0, "id": 27631 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bc7fe", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "@\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00s\\xb3\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa1[\\xf7Y\\xff\\x7f\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x83\\xaa\\x0c\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 27632 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bc8d0", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 27633 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8e4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 27634 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" } ], "repeated": 0, "id": 27635 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bbd99", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 27636 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff5780d897", "parentcaller": "0x7fff432bd729", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000d5c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00@\\x00\\x00\\x00\\x00\\x00\\x00`9\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 27637 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432b9503", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 27638 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b953e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" } ], "repeated": 0, "id": 27639 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432b95a7", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002344" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 27640 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432b95d8", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002614" } ], "repeated": 0, "id": 27641 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432b9610", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9d|}\\x1a\\xff\\x7f\\x00\\x00(\\x8b}\\x1a\\xff\\x7f\\x00\\x00\\x10\r\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\xf9\\x1d\\x01\\x00\\x00\\x00\\x00]\\xdd|W\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x83\\xaa\\x0c\\x00\\x00\\x00\\x00\\xf9\\x7fN\\x0c\\xea[\\x00\\x00\\x18\\xf9\\x1d\\x01\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 27642 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432b96e3", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 27643 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b96f7", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" } ], "repeated": 0, "id": 27644 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b9706", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" } ], "repeated": 0, "id": 27645 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b9732", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 27646 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432b9779", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 27647 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff432b643e", "parentcaller": "0x7fff432b8101", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "DE77BA04-3C92-4D11-A1A5-42352A53E0E3" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "7A3BD1D9-35A9-4FB3-A467-F48CAC35E2D0" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 27648 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff40f3155d", "parentcaller": "0x7fff432b645e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "System\\CurrentControlSet\\Services\\HomeGroupProvider\\ServiceData" }, { "name": "Handle", "value": "0x000026ac" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\HomeGroupProvider\\ServiceData" } ], "repeated": 0, "id": 27649 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff40f315b1", "parentcaller": "0x7fff432b645e", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000026ac" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 27650 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff40f315e2", "parentcaller": "0x7fff432b645e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 27651 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff432c690b", "parentcaller": "0x7fff432bb551", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" }, { "name": "Handle", "value": "0x000026ac" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" } ], "repeated": 0, "id": 27652 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff432c6964", "parentcaller": "0x7fff432bb551", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000026ac" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 27653 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff432c6990", "parentcaller": "0x7fff432bb551", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 27654 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff5807fb58", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "MutexName", "value": "" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 27655 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002614" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Desktop\\Discord.lnk" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 27656 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 27657 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27658 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27659 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" } ], "repeated": 0, "id": 27660 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d5783", "parentcaller": "0x7fff58090260", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002614" }, { "name": "HandleName", "value": "C:\\Users\\admin\\Desktop\\Discord.lnk" }, { "name": "Buffer", "value": "L\\x00\\x00\\x00\\x01\\x14\\x02\\x00\\x00\\x00\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00F\\xff@\\x00\\x00 \\x00\\x00\\x00\\x15oH-\\x00\\xef\\xdc\\x01,\\xed\\xf90\\x00\\xef\\xdc\\x01\\x00\\x83\\x8dR\t\\xe7\\xdc\\x01\\xb8[\\x18\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc4\\x01:\\x00\\x1fDG\\x1a\\x03Yr?\\xa7D\\x89\\xc5U\\x95\\xfek0\\xee&\\x00\\x01\\x00&\\x00\\xef\\xbe\\x10\\x00\\x00\\x00\\xf4a\\xd0\\x9c\\xb6\\xee\\xdc\\x01I\\x8f\\xf6K\\xf7\\xee\\xdc\\x01\\xed\\xef\r1\\x00\\xef\\xdc\\x01\\x14\\x00\\x82\\x00t\\x00\\x1c\\x00CFSF\\x16\\x001\\x00\\x00\\x00\\x00\\x00\\xbc\\\\x8a{\\x12\\x00AppData\\x00\\x00\\x00t\\x1aY^\\x96\\xdf\\xd3H\\x8dg\\x173\\xbc\\xee(\\xba\\xc5\\xcd\\xfa\\xdf\\x9fgVA\\x89G\\xc5\\xc7k\\xc0\\xb6\\x7f@\\x00\t\\x00\\x04\\x00\\xef\\xbe\\xbc\\\\x8a{\\xbd\\k\\x01.\\x00\\x00\\x00\\x1c\\xa5\\x01\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x92\\x05!\\x00A\\x00p\\x00p\\x00D\\x00" }, { "name": "Length", "value": "2243" } ], "repeated": 0, "id": 27661 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27662 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27663 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" } ], "repeated": 1, "id": 27664 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 27665 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27666 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27667 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" } ], "repeated": 0, "id": 27668 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27669 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27670 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" } ], "repeated": 1, "id": 27671 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 27672 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27673 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27674 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" } ], "repeated": 0, "id": 27675 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27676 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27677 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" } ], "repeated": 1, "id": 27678 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 27679 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27680 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27681 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" } ], "repeated": 0, "id": 27682 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27683 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27684 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" } ], "repeated": 1, "id": 27685 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 27686 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 27687 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002318" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 27688 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002318" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 27689 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002318" } ], "repeated": 0, "id": 27690 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 27691 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 27692 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002318" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 27693 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002318" }, { "name": "ValueName", "value": "MonitorRegistry" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\MonitorRegistry" } ], "repeated": 0, "id": 27694 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002318" } ], "repeated": 0, "id": 27695 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 27696 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 27697 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002318" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UsersFiles\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UsersFiles\\NameSpace" } ], "repeated": 0, "id": 27698 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002318" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UsersFiles\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 27699 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002318" } ], "repeated": 0, "id": 27700 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 27701 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 27702 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002318" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UsersFiles\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UsersFiles\\NameSpace" } ], "repeated": 0, "id": 27703 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002318" }, { "name": "ValueName", "value": "MonitorRegistry" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UsersFiles\\NameSpace\\MonitorRegistry" } ], "repeated": 0, "id": 27704 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002318" } ], "repeated": 0, "id": 27705 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff5587d014", "parentcaller": "0x7fff558252c1", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance" }, { "name": "Handle", "value": "0x0000231a" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance" } ], "repeated": 0, "id": 27706 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000231a" }, { "name": "ValueName", "value": "CLSID" }, { "name": "Data", "value": "{0E5AAE11-A475-4c5b-AB00-C66DE400274E}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance\\CLSID" } ], "repeated": 0, "id": 27707 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff558635fc", "parentcaller": "0x7fff55825399", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000024b8" } ], "repeated": 0, "id": 27708 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff55863669", "parentcaller": "0x7fff55825399", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "18" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 27709 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff558636a1", "parentcaller": "0x7fff55825399", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "20" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 27710 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff558636e3", "parentcaller": "0x7fff55825399", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b8" } ], "repeated": 0, "id": 27711 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff558638e8", "parentcaller": "0x7fff55825399", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Classes\\CLSID\\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\\InProcServer32" }, { "name": "Handle", "value": "0x000024b8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\\InProcServer32" } ], "repeated": 0, "id": 27712 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b8" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "%SystemRoot%\\system32\\Windows.Storage.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{0E5AAE11-A475-4c5b-AB00-C66DE400274E}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 27713 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000024b8" }, { "name": "ValueName", "value": "LoadWithoutCOM" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{0E5AAE11-A475-4c5b-AB00-C66DE400274E}\\InProcServer32\\LoadWithoutCOM" } ], "repeated": 0, "id": 27714 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff5586397c", "parentcaller": "0x7fff55825399", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b8" } ], "repeated": 0, "id": 27715 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff558259d3", "parentcaller": "0x7fff55896922", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0E5AAE11-A475-4C5B-AB00-C66DE400274E" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 27716 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff58ac4404", "parentcaller": "0x7fff55896973", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000231a" }, { "name": "SubKey", "value": "InitPropertyBag" }, { "name": "Handle", "value": "0x000024ba" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance\\InitPropertyBag" } ], "repeated": 0, "id": 27717 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024ba" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance\\InitPropertyBag\\Attributes" } ], "repeated": 0, "id": 27718 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024ba" }, { "name": "ValueName", "value": "Attributes" }, { "name": "Data", "value": "17" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance\\InitPropertyBag\\Attributes" } ], "repeated": 0, "id": 27719 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000024ba" }, { "name": "ValueName", "value": "DescriptionID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance\\InitPropertyBag\\DescriptionID" } ], "repeated": 0, "id": 27720 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000024ba" }, { "name": "ValueName", "value": "HelpTopic" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance\\InitPropertyBag\\HelpTopic" } ], "repeated": 0, "id": 27721 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000024ba" }, { "name": "ValueName", "value": "AllowChildAliasRegistration" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance\\InitPropertyBag\\AllowChildAliasRegistration" } ], "repeated": 0, "id": 27722 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000024ba" }, { "name": "ValueName", "value": "RecursiveSearch" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance\\InitPropertyBag\\RecursiveSearch" } ], "repeated": 0, "id": 27723 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024ba" }, { "name": "ValueName", "value": "TargetKnownFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance\\InitPropertyBag\\TargetKnownFolder" } ], "repeated": 0, "id": 27724 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024ba" }, { "name": "ValueName", "value": "TargetKnownFolder" }, { "name": "Data", "value": "{5E6C858F-0E22-4760-9AFE-EA3317B67173}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance\\InitPropertyBag\\TargetKnownFolder" } ], "repeated": 0, "id": 27725 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff557c62cb", "parentcaller": "0x7fff558ac7c5", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance" } ], "repeated": 0, "id": 27726 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff557c6313", "parentcaller": "0x7fff558ac7c5", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance" }, { "name": "Handle", "value": "0x000026ec" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance" } ], "repeated": 0, "id": 27727 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff557c6354", "parentcaller": "0x7fff558ac7c5", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000026ec" }, { "name": "SubKey", "value": "" }, { "name": "Handle", "value": "0x000026fc" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance\\" } ], "repeated": 0, "id": 27728 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff557c63da", "parentcaller": "0x7fff558ac7c5", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" } ], "repeated": 0, "id": 27729 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff557c6396", "parentcaller": "0x7fff558ac7c5", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000026fc" }, { "name": "SubKey", "value": "" }, { "name": "Handle", "value": "0x000026ec" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance\\" } ], "repeated": 0, "id": 27730 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff58ac4304", "parentcaller": "0x7fff58ac665a", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024ba" } ], "repeated": 0, "id": 27731 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff5587d159", "parentcaller": "0x7fff5582531b", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026fc" } ], "repeated": 0, "id": 27732 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff5587d14b", "parentcaller": "0x7fff5582531b", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000231a" } ], "repeated": 0, "id": 27733 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff557b6c7e", "parentcaller": "0x7fff557b4414", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 27734 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff5582a695", "parentcaller": "0x7fff5582a024", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ec" } ], "repeated": 0, "id": 27735 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 27736 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27737 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27738 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" } ], "repeated": 0, "id": 27739 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff5780b767", "parentcaller": "0x7fff58085024", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002614" }, { "name": "HandleName", "value": "C:\\Users\\admin\\Desktop\\Discord.lnk" }, { "name": "FileInformationClass", "value": "4", "pretty_value": "FileBasicInformation" }, { "name": "FileInformation", "value": "2);0\\x00\\xef\\xdc\\x01K\\x87\\K\\x07\\xef\\xdc\\x01j\\xcc\\x121\\x00\\xef\\xdc\\x01j\\xcc\\x121\\x00\\xef\\xdc\\x01 \\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 27740 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff5780b767", "parentcaller": "0x7fff5808504b", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002614" }, { "name": "HandleName", "value": "C:\\Users\\admin\\Desktop\\Discord.lnk" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xc3\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 27741 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27742 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27743 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" } ], "repeated": 1, "id": 27744 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 27745 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27746 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27747 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" } ], "repeated": 0, "id": 27748 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27749 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27750 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" } ], "repeated": 1, "id": 27751 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 27752 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27753 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27754 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" } ], "repeated": 0, "id": 27755 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27756 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27757 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" } ], "repeated": 1, "id": 27758 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 27759 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27760 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27761 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" } ], "repeated": 0, "id": 27762 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27763 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27764 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" } ], "repeated": 1, "id": 27765 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 27766 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27767 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27768 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" } ], "repeated": 0, "id": 27769 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27770 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27771 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" } ], "repeated": 1, "id": 27772 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 27773 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27774 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27775 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" } ], "repeated": 0, "id": 27776 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27777 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27778 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" } ], "repeated": 1, "id": 27779 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 27780 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27781 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27782 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" } ], "repeated": 0, "id": 27783 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27784 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27785 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" } ], "repeated": 1, "id": 27786 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 27787 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27788 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27789 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" } ], "repeated": 0, "id": 27790 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27791 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27792 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" } ], "repeated": 1, "id": 27793 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 27794 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27795 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27796 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" } ], "repeated": 0, "id": 27797 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27798 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27799 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" } ], "repeated": 1, "id": 27800 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 27801 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27802 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27803 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" } ], "repeated": 0, "id": 27804 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27805 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27806 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" } ], "repeated": 1, "id": 27807 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 27808 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27809 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27810 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" } ], "repeated": 0, "id": 27811 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27812 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27813 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" } ], "repeated": 1, "id": 27814 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 27815 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27816 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27817 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" } ], "repeated": 0, "id": 27818 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27819 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27820 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" } ], "repeated": 1, "id": 27821 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 27822 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27823 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27824 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" } ], "repeated": 0, "id": 27825 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27826 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27827 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" } ], "repeated": 1, "id": 27828 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 27829 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27830 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27831 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" } ], "repeated": 0, "id": 27832 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27833 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27834 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" } ], "repeated": 1, "id": 27835 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 27836 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27837 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27838 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" } ], "repeated": 0, "id": 27839 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27840 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27841 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" } ], "repeated": 1, "id": 27842 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 27843 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27844 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27845 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" } ], "repeated": 0, "id": 27846 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27847 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27848 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" } ], "repeated": 1, "id": 27849 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 27850 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27851 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27852 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" } ], "repeated": 0, "id": 27853 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27854 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27855 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" } ], "repeated": 1, "id": 27856 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 27857 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27858 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27859 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" } ], "repeated": 0, "id": 27860 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27861 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27862 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" } ], "repeated": 1, "id": 27863 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 27864 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27865 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27866 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" } ], "repeated": 0, "id": 27867 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27868 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27869 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" } ], "repeated": 1, "id": 27870 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 27871 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27872 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27873 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" } ], "repeated": 0, "id": 27874 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27875 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27876 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" } ], "repeated": 1, "id": 27877 }, { "timestamp": "2026-05-29 01:05:52,243", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 27878 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27879 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27880 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" } ], "repeated": 0, "id": 27881 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27882 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27883 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" } ], "repeated": 1, "id": 27884 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 27885 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27886 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27887 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" } ], "repeated": 0, "id": 27888 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27889 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27890 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" } ], "repeated": 1, "id": 27891 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 27892 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27893 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27894 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" } ], "repeated": 0, "id": 27895 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27896 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27897 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" } ], "repeated": 1, "id": 27898 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 27899 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27900 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27901 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" } ], "repeated": 0, "id": 27902 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27903 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 27904 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" } ], "repeated": 1, "id": 27905 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b4361", "parentcaller": "0x7fff557b3e47", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 2, "id": 27906 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557c4d64", "parentcaller": "0x7fff557c526d", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" } ], "repeated": 0, "id": 27907 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557c530a", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 27908 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557c53f2", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 27909 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000bb4" }, { "name": "ValueName", "value": "ThisPCPolicy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\PropertyBag\\ThisPCPolicy" } ], "repeated": 0, "id": 27910 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000bb4" }, { "name": "ValueName", "value": "ThisPCPolicy" }, { "name": "Data", "value": "Hide" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\PropertyBag\\ThisPCPolicy" } ], "repeated": 0, "id": 27911 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff557b167c", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002518" } ], "repeated": 0, "id": 27912 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b16bb", "parentcaller": "0x7fff557b207c", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 27913 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff557b16e2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002518" } ], "repeated": 0, "id": 27914 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff59f667b5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xbf:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00<\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x8c{\\xb3\\x0c\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 27915 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff59f667ec", "parentcaller": "0x7fff577b5140", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002518" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 27916 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002518" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 27917 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00002518" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 27918 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff557b2291", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x0000000c" }, { "name": "TokenHandle", "value": "0x00002414" } ], "repeated": 0, "id": 27919 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b1fd8", "parentcaller": "0x7fff557b1782", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" }, { "name": "Handle", "value": "0x000025c4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" } ], "repeated": 0, "id": 27920 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b201a", "parentcaller": "0x7fff557b1782", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000025c4" }, { "name": "ValueName", "value": "RDVirtualizationPool" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\RDVirtualizationPool" } ], "repeated": 0, "id": 27921 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b2034", "parentcaller": "0x7fff557b1782", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025c4" } ], "repeated": 0, "id": 27922 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b17b9", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" }, { "name": "Handle", "value": "0x000025c4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" } ], "repeated": 0, "id": 27923 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b17fc", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000025c4" }, { "name": "ValueName", "value": "RDVirtualizationPool" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\RDVirtualizationPool" } ], "repeated": 0, "id": 27924 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b1816", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025c4" } ], "repeated": 0, "id": 27925 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff557b1849", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "0\\xc0:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xa0\\xbd}\\x1a\\xff\\x7f\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xf8\\x81}\\x1a" } ], "repeated": 0, "id": 27926 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b1ec7", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\fdeploy" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\fdeploy" } ], "repeated": 0, "id": 27927 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff557b2322", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002414" } ], "repeated": 0, "id": 27928 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b2374", "parentcaller": "0x7fff557c5a72", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002518" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" }, { "name": "Handle", "value": "0x00002414" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" } ], "repeated": 0, "id": 27929 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b239d", "parentcaller": "0x7fff557c5a72", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002414" } ], "repeated": 0, "id": 27930 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b23bf", "parentcaller": "0x7fff557c5a72", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002518" } ], "repeated": 0, "id": 27931 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557c4d64", "parentcaller": "0x7fff557c526d", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" } ], "repeated": 0, "id": 27932 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557c530a", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 27933 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557c53f2", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 27934 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000bb0" }, { "name": "ValueName", "value": "ThisPCPolicy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{33E28130-4E1E-4676-835A-98395C3BC3BB}\\PropertyBag\\ThisPCPolicy" } ], "repeated": 0, "id": 27935 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000bb0" }, { "name": "ValueName", "value": "ThisPCPolicy" }, { "name": "Data", "value": "Hide" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{33E28130-4E1E-4676-835A-98395C3BC3BB}\\PropertyBag\\ThisPCPolicy" } ], "repeated": 0, "id": 27936 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff557b167c", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002518" } ], "repeated": 0, "id": 27937 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b16bb", "parentcaller": "0x7fff557b207c", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 27938 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff557b16e2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002518" } ], "repeated": 0, "id": 27939 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff59f667b5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xbf:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00<\\x00\\x00\\x00\\x00\\x00\\x00\\x00|w\\xb3\\x0c\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 27940 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff59f667ec", "parentcaller": "0x7fff577b5140", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002518" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 27941 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002518" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 27942 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00002518" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 27943 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff557b2291", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x0000000c" }, { "name": "TokenHandle", "value": "0x00002414" } ], "repeated": 0, "id": 27944 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b1fd8", "parentcaller": "0x7fff557b1782", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" }, { "name": "Handle", "value": "0x000025c4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" } ], "repeated": 0, "id": 27945 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b201a", "parentcaller": "0x7fff557b1782", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000025c4" }, { "name": "ValueName", "value": "RDVirtualizationPool" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\RDVirtualizationPool" } ], "repeated": 0, "id": 27946 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b2034", "parentcaller": "0x7fff557b1782", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025c4" } ], "repeated": 0, "id": 27947 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b17b9", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" }, { "name": "Handle", "value": "0x000025c4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" } ], "repeated": 0, "id": 27948 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b17fc", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000025c4" }, { "name": "ValueName", "value": "RDVirtualizationPool" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\RDVirtualizationPool" } ], "repeated": 0, "id": 27949 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b1816", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025c4" } ], "repeated": 0, "id": 27950 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff557b1849", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "0\\xc0:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xa0\\xbd}\\x1a\\xff\\x7f\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xf8\\x81}\\x1a" } ], "repeated": 0, "id": 27951 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b1ec7", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\fdeploy" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\fdeploy" } ], "repeated": 0, "id": 27952 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff557b2322", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002414" } ], "repeated": 0, "id": 27953 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b2374", "parentcaller": "0x7fff557c5a72", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002518" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" }, { "name": "Handle", "value": "0x00002414" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" } ], "repeated": 0, "id": 27954 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b239d", "parentcaller": "0x7fff557c5a72", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002414" } ], "repeated": 0, "id": 27955 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b23bf", "parentcaller": "0x7fff557c5a72", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002518" } ], "repeated": 0, "id": 27956 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003a4" }, { "name": "ValueName", "value": "ThisPCPolicy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\\PropertyBag\\ThisPCPolicy" } ], "repeated": 0, "id": 27957 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557c4d64", "parentcaller": "0x7fff557c526d", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" } ], "repeated": 0, "id": 27958 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557c530a", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 27959 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557c53f2", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 27960 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b831a", "parentcaller": "0x7fff557b8fd2", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x00002518" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 27961 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b836d", "parentcaller": "0x7fff557b8fd2", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00002518" }, { "name": "SubKey", "value": "{C4900540-2379-4C75-844B-64E6FAF8716B}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C4900540-2379-4C75-844B-64E6FAF8716B}" } ], "repeated": 0, "id": 27962 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b8396", "parentcaller": "0x7fff557b8fd2", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002518" } ], "repeated": 0, "id": 27963 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557c4d64", "parentcaller": "0x7fff557c526d", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" } ], "repeated": 0, "id": 27964 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557c530a", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 27965 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557c53f2", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 27966 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000bb8" }, { "name": "ValueName", "value": "ThisPCPolicy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{56784854-C6CB-462B-8169-88E350ACB882}\\PropertyBag\\ThisPCPolicy" } ], "repeated": 0, "id": 27967 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557c4d64", "parentcaller": "0x7fff557c526d", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" } ], "repeated": 0, "id": 27968 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557c530a", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 27969 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557c53f2", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 27970 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "ThisPCPolicy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0ddd015d-b06c-45d5-8c4c-f59713854639}\\PropertyBag\\ThisPCPolicy" } ], "repeated": 0, "id": 27971 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "ThisPCPolicy" }, { "name": "Data", "value": "Show" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0ddd015d-b06c-45d5-8c4c-f59713854639}\\PropertyBag\\ThisPCPolicy" } ], "repeated": 0, "id": 27972 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "BaseFolderId" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0ddd015d-b06c-45d5-8c4c-f59713854639}\\PropertyBag\\BaseFolderId" } ], "repeated": 0, "id": 27973 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "BaseFolderId" }, { "name": "Data", "value": "{33E28130-4E1E-4676-835A-98395C3BC3BB}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0ddd015d-b06c-45d5-8c4c-f59713854639}\\PropertyBag\\BaseFolderId" } ], "repeated": 0, "id": 27974 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff557b167c", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002518" } ], "repeated": 0, "id": 27975 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b16bb", "parentcaller": "0x7fff557b207c", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 27976 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff557b16e2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002518" } ], "repeated": 0, "id": 27977 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff59f667b5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xbf:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00<\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0cy\\xb3\\x0c\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 27978 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff59f667ec", "parentcaller": "0x7fff577b5140", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002518" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 27979 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002518" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 27980 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00002518" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 27981 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff557b2291", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x0000000c" }, { "name": "TokenHandle", "value": "0x00002414" } ], "repeated": 0, "id": 27982 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b1fd8", "parentcaller": "0x7fff557b1782", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" }, { "name": "Handle", "value": "0x000025c4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" } ], "repeated": 0, "id": 27983 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b201a", "parentcaller": "0x7fff557b1782", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000025c4" }, { "name": "ValueName", "value": "RDVirtualizationPool" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\RDVirtualizationPool" } ], "repeated": 0, "id": 27984 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b2034", "parentcaller": "0x7fff557b1782", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025c4" } ], "repeated": 0, "id": 27985 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b17b9", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" }, { "name": "Handle", "value": "0x000025c4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" } ], "repeated": 0, "id": 27986 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b17fc", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000025c4" }, { "name": "ValueName", "value": "RDVirtualizationPool" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\RDVirtualizationPool" } ], "repeated": 0, "id": 27987 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b1816", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025c4" } ], "repeated": 0, "id": 27988 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff557b1849", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "0\\xc0:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xa0\\xbd}\\x1a\\xff\\x7f\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xf8\\x81}\\x1a" } ], "repeated": 0, "id": 27989 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b1ec7", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\fdeploy" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\fdeploy" } ], "repeated": 0, "id": 27990 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff557b2322", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002414" } ], "repeated": 0, "id": 27991 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b2374", "parentcaller": "0x7fff557c5a19", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002518" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" }, { "name": "Handle", "value": "0x00002414" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" } ], "repeated": 0, "id": 27992 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b239d", "parentcaller": "0x7fff557c5a19", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002414" } ], "repeated": 0, "id": 27993 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b23bf", "parentcaller": "0x7fff557c5a19", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002518" } ], "repeated": 0, "id": 27994 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557c4d64", "parentcaller": "0x7fff557c526d", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" } ], "repeated": 0, "id": 27995 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557c530a", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 27996 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557c53f2", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 27997 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557c4d64", "parentcaller": "0x7fff557c526d", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" } ], "repeated": 0, "id": 27998 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557c530a", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 27999 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557c53f2", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 28000 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "ThisPCPolicy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\\PropertyBag\\ThisPCPolicy" } ], "repeated": 0, "id": 28001 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "ThisPCPolicy" }, { "name": "Data", "value": "Show" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\\PropertyBag\\ThisPCPolicy" } ], "repeated": 0, "id": 28002 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "BaseFolderId" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\\PropertyBag\\BaseFolderId" } ], "repeated": 0, "id": 28003 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "BaseFolderId" }, { "name": "Data", "value": "{18989B1D-99B5-455B-841C-AB7C74E4DDFC}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\\PropertyBag\\BaseFolderId" } ], "repeated": 0, "id": 28004 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff557b167c", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002518" } ], "repeated": 0, "id": 28005 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b16bb", "parentcaller": "0x7fff557b207c", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 28006 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff557b16e2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002518" } ], "repeated": 0, "id": 28007 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff59f667b5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xbf:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00<\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xccw\\xb3\\x0c\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 28008 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff59f667ec", "parentcaller": "0x7fff577b5140", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002518" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 28009 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002518" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 28010 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00002518" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 28011 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff557b2291", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x0000000c" }, { "name": "TokenHandle", "value": "0x00002414" } ], "repeated": 0, "id": 28012 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b1fd8", "parentcaller": "0x7fff557b1782", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" }, { "name": "Handle", "value": "0x000025c4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" } ], "repeated": 0, "id": 28013 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b201a", "parentcaller": "0x7fff557b1782", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000025c4" }, { "name": "ValueName", "value": "RDVirtualizationPool" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\RDVirtualizationPool" } ], "repeated": 0, "id": 28014 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b2034", "parentcaller": "0x7fff557b1782", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025c4" } ], "repeated": 0, "id": 28015 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b17b9", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" }, { "name": "Handle", "value": "0x000025c4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" } ], "repeated": 0, "id": 28016 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b17fc", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000025c4" }, { "name": "ValueName", "value": "RDVirtualizationPool" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\RDVirtualizationPool" } ], "repeated": 0, "id": 28017 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b1816", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025c4" } ], "repeated": 0, "id": 28018 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff557b1849", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "0\\xc0:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xa0\\xbd}\\x1a\\xff\\x7f\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xf8\\x81}\\x1a" } ], "repeated": 0, "id": 28019 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b1ec7", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\fdeploy" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\fdeploy" } ], "repeated": 0, "id": 28020 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff557b2322", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002414" } ], "repeated": 0, "id": 28021 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b2374", "parentcaller": "0x7fff557c5a19", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002518" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" }, { "name": "Handle", "value": "0x00002414" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" } ], "repeated": 0, "id": 28022 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b239d", "parentcaller": "0x7fff557c5a19", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002414" } ], "repeated": 0, "id": 28023 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b23bf", "parentcaller": "0x7fff557c5a19", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002518" } ], "repeated": 0, "id": 28024 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557c4d64", "parentcaller": "0x7fff557c526d", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" } ], "repeated": 0, "id": 28025 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557c530a", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 28026 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557c53f2", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 28027 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b831a", "parentcaller": "0x7fff557b8fd2", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x00002518" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 28028 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b836d", "parentcaller": "0x7fff557b8fd2", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00002518" }, { "name": "SubKey", "value": "{B250C668-F57D-4EE1-A63C-290EE7D1AA1F}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B250C668-F57D-4EE1-A63C-290EE7D1AA1F}" } ], "repeated": 0, "id": 28029 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b8396", "parentcaller": "0x7fff557b8fd2", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002518" } ], "repeated": 0, "id": 28030 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000bf4" }, { "name": "ValueName", "value": "ThisPCPolicy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\PropertyBag\\ThisPCPolicy" } ], "repeated": 0, "id": 28031 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000bf4" }, { "name": "ValueName", "value": "ThisPCPolicy" }, { "name": "Data", "value": "Hide" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\PropertyBag\\ThisPCPolicy" } ], "repeated": 0, "id": 28032 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff557b167c", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002518" } ], "repeated": 0, "id": 28033 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b16bb", "parentcaller": "0x7fff557b207c", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 28034 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff557b16e2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002518" } ], "repeated": 0, "id": 28035 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff59f667b5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xbf:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00<\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xcc\\x81\\xb3\\x0c\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 28036 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff59f667ec", "parentcaller": "0x7fff577b5140", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002518" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 28037 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002518" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 28038 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00002518" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 28039 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff557b2291", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x0000000c" }, { "name": "TokenHandle", "value": "0x00002414" } ], "repeated": 0, "id": 28040 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b1fd8", "parentcaller": "0x7fff557b1782", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" }, { "name": "Handle", "value": "0x000025c4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" } ], "repeated": 0, "id": 28041 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b201a", "parentcaller": "0x7fff557b1782", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000025c4" }, { "name": "ValueName", "value": "RDVirtualizationPool" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\RDVirtualizationPool" } ], "repeated": 0, "id": 28042 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b2034", "parentcaller": "0x7fff557b1782", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025c4" } ], "repeated": 0, "id": 28043 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b17b9", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" }, { "name": "Handle", "value": "0x000025c4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" } ], "repeated": 0, "id": 28044 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b17fc", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000025c4" }, { "name": "ValueName", "value": "RDVirtualizationPool" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\RDVirtualizationPool" } ], "repeated": 0, "id": 28045 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b1816", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025c4" } ], "repeated": 0, "id": 28046 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff557b1849", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "0\\xc0:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xa0\\xbd}\\x1a\\xff\\x7f\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xf8\\x81}\\x1a" } ], "repeated": 0, "id": 28047 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b1ec7", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\fdeploy" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\fdeploy" } ], "repeated": 0, "id": 28048 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff557b2322", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002414" } ], "repeated": 0, "id": 28049 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b2374", "parentcaller": "0x7fff557c5a72", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002518" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" }, { "name": "Handle", "value": "0x00002414" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" } ], "repeated": 0, "id": 28050 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b239d", "parentcaller": "0x7fff557c5a72", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002414" } ], "repeated": 0, "id": 28051 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b23bf", "parentcaller": "0x7fff557c5a72", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002518" } ], "repeated": 0, "id": 28052 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557c4d64", "parentcaller": "0x7fff557c526d", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" } ], "repeated": 0, "id": 28053 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557c530a", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 28054 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557c53f2", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 28055 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000b4c" }, { "name": "ValueName", "value": "ThisPCPolicy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{374DE290-123F-4565-9164-39C4925E467B}\\PropertyBag\\ThisPCPolicy" } ], "repeated": 0, "id": 28056 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000b4c" }, { "name": "ValueName", "value": "ThisPCPolicy" }, { "name": "Data", "value": "Hide" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{374DE290-123F-4565-9164-39C4925E467B}\\PropertyBag\\ThisPCPolicy" } ], "repeated": 0, "id": 28057 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff557b167c", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002518" } ], "repeated": 0, "id": 28058 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b16bb", "parentcaller": "0x7fff557b207c", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 28059 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff557b16e2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002518" } ], "repeated": 0, "id": 28060 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff59f667b5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xbf:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00<\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xbcs\\xb3\\x0c\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 28061 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff59f667ec", "parentcaller": "0x7fff577b5140", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002518" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 28062 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002518" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 28063 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00002518" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 28064 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff557b2291", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x0000000c" }, { "name": "TokenHandle", "value": "0x00002414" } ], "repeated": 0, "id": 28065 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b1fd8", "parentcaller": "0x7fff557b1782", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" }, { "name": "Handle", "value": "0x000025c4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" } ], "repeated": 0, "id": 28066 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b201a", "parentcaller": "0x7fff557b1782", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000025c4" }, { "name": "ValueName", "value": "RDVirtualizationPool" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\RDVirtualizationPool" } ], "repeated": 0, "id": 28067 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b2034", "parentcaller": "0x7fff557b1782", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025c4" } ], "repeated": 0, "id": 28068 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b17b9", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" }, { "name": "Handle", "value": "0x000025c4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" } ], "repeated": 0, "id": 28069 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b17fc", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000025c4" }, { "name": "ValueName", "value": "RDVirtualizationPool" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\RDVirtualizationPool" } ], "repeated": 0, "id": 28070 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b1816", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025c4" } ], "repeated": 0, "id": 28071 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff557b1849", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "0\\xc0:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xa0\\xbd}\\x1a\\xff\\x7f\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xf8\\x81}\\x1a" } ], "repeated": 0, "id": 28072 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b1ec7", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\fdeploy" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\fdeploy" } ], "repeated": 0, "id": 28073 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff557b2322", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002414" } ], "repeated": 0, "id": 28074 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b2374", "parentcaller": "0x7fff557c5a72", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002518" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" }, { "name": "Handle", "value": "0x00002414" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" } ], "repeated": 0, "id": 28075 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b239d", "parentcaller": "0x7fff557c5a72", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002414" } ], "repeated": 0, "id": 28076 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b23bf", "parentcaller": "0x7fff557c5a72", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002518" } ], "repeated": 0, "id": 28077 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b831a", "parentcaller": "0x7fff557b8fd2", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x00002518" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 28078 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b836d", "parentcaller": "0x7fff557b8fd2", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00002518" }, { "name": "SubKey", "value": "{859EAD94-2E85-48AD-A71A-0969CB56A6CD}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{859EAD94-2E85-48AD-A71A-0969CB56A6CD}" } ], "repeated": 0, "id": 28079 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b8396", "parentcaller": "0x7fff557b8fd2", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002518" } ], "repeated": 0, "id": 28080 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557c4d64", "parentcaller": "0x7fff557c526d", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" } ], "repeated": 0, "id": 28081 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557c530a", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 28082 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557c53f2", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 28083 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b4" }, { "name": "ValueName", "value": "ThisPCPolicy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{a0c69a99-21c8-4671-8703-7934162fcf1d}\\PropertyBag\\ThisPCPolicy" } ], "repeated": 0, "id": 28084 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b4" }, { "name": "ValueName", "value": "ThisPCPolicy" }, { "name": "Data", "value": "Show" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{a0c69a99-21c8-4671-8703-7934162fcf1d}\\PropertyBag\\ThisPCPolicy" } ], "repeated": 0, "id": 28085 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b4" }, { "name": "ValueName", "value": "BaseFolderId" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{a0c69a99-21c8-4671-8703-7934162fcf1d}\\PropertyBag\\BaseFolderId" } ], "repeated": 0, "id": 28086 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b4" }, { "name": "ValueName", "value": "BaseFolderId" }, { "name": "Data", "value": "{4BD8D571-6D19-48D3-BE97-422220080E43}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{a0c69a99-21c8-4671-8703-7934162fcf1d}\\PropertyBag\\BaseFolderId" } ], "repeated": 0, "id": 28087 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff557b167c", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002518" } ], "repeated": 0, "id": 28088 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b16bb", "parentcaller": "0x7fff557b207c", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 28089 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff557b16e2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002518" } ], "repeated": 0, "id": 28090 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff59f667b5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xbf:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00<\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0cy\\xb3\\x0c\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 28091 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff59f667ec", "parentcaller": "0x7fff577b5140", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002518" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 28092 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002518" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 28093 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00002518" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 28094 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff557b2291", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x0000000c" }, { "name": "TokenHandle", "value": "0x00002414" } ], "repeated": 0, "id": 28095 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b1fd8", "parentcaller": "0x7fff557b1782", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" }, { "name": "Handle", "value": "0x000025c4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" } ], "repeated": 0, "id": 28096 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b201a", "parentcaller": "0x7fff557b1782", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000025c4" }, { "name": "ValueName", "value": "RDVirtualizationPool" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\RDVirtualizationPool" } ], "repeated": 0, "id": 28097 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b2034", "parentcaller": "0x7fff557b1782", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025c4" } ], "repeated": 0, "id": 28098 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b17b9", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" }, { "name": "Handle", "value": "0x000025c4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" } ], "repeated": 0, "id": 28099 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b17fc", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000025c4" }, { "name": "ValueName", "value": "RDVirtualizationPool" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\RDVirtualizationPool" } ], "repeated": 0, "id": 28100 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b1816", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025c4" } ], "repeated": 0, "id": 28101 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff557b1849", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "0\\xc0:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xa0\\xbd}\\x1a\\xff\\x7f\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xf8\\x81}\\x1a" } ], "repeated": 0, "id": 28102 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b1ec7", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\fdeploy" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\fdeploy" } ], "repeated": 0, "id": 28103 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff557b2322", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002414" } ], "repeated": 0, "id": 28104 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b2374", "parentcaller": "0x7fff557c5a19", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002518" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" }, { "name": "Handle", "value": "0x00002414" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" } ], "repeated": 0, "id": 28105 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b239d", "parentcaller": "0x7fff557c5a19", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002414" } ], "repeated": 0, "id": 28106 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b23bf", "parentcaller": "0x7fff557c5a19", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002518" } ], "repeated": 0, "id": 28107 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557c4d64", "parentcaller": "0x7fff557c526d", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" } ], "repeated": 0, "id": 28108 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557c530a", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 28109 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557c53f2", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 28110 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003c4" }, { "name": "ValueName", "value": "ThisPCPolicy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7d83ee9b-2244-4e70-b1f5-5393042af1e4}\\PropertyBag\\ThisPCPolicy" } ], "repeated": 0, "id": 28111 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003c4" }, { "name": "ValueName", "value": "ThisPCPolicy" }, { "name": "Data", "value": "Show" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7d83ee9b-2244-4e70-b1f5-5393042af1e4}\\PropertyBag\\ThisPCPolicy" } ], "repeated": 0, "id": 28112 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003c4" }, { "name": "ValueName", "value": "BaseFolderId" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7d83ee9b-2244-4e70-b1f5-5393042af1e4}\\PropertyBag\\BaseFolderId" } ], "repeated": 0, "id": 28113 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003c4" }, { "name": "ValueName", "value": "BaseFolderId" }, { "name": "Data", "value": "{374DE290-123F-4565-9164-39C4925E467B}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7d83ee9b-2244-4e70-b1f5-5393042af1e4}\\PropertyBag\\BaseFolderId" } ], "repeated": 0, "id": 28114 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff557b167c", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002518" } ], "repeated": 0, "id": 28115 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b16bb", "parentcaller": "0x7fff557b207c", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 28116 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff557b16e2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002518" } ], "repeated": 0, "id": 28117 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff59f667b5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xbf:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00<\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9cz\\xb3\\x0c\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 28118 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff59f667ec", "parentcaller": "0x7fff577b5140", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002518" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 28119 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002518" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 28120 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00002518" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 28121 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff557b2291", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x0000000c" }, { "name": "TokenHandle", "value": "0x00002414" } ], "repeated": 0, "id": 28122 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b1fd8", "parentcaller": "0x7fff557b1782", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" }, { "name": "Handle", "value": "0x000025c4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" } ], "repeated": 0, "id": 28123 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b201a", "parentcaller": "0x7fff557b1782", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000025c4" }, { "name": "ValueName", "value": "RDVirtualizationPool" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\RDVirtualizationPool" } ], "repeated": 0, "id": 28124 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b2034", "parentcaller": "0x7fff557b1782", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025c4" } ], "repeated": 0, "id": 28125 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b17b9", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" }, { "name": "Handle", "value": "0x000025c4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" } ], "repeated": 0, "id": 28126 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b17fc", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000025c4" }, { "name": "ValueName", "value": "RDVirtualizationPool" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\RDVirtualizationPool" } ], "repeated": 0, "id": 28127 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b1816", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025c4" } ], "repeated": 0, "id": 28128 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff557b1849", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "0\\xc0:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xa0\\xbd}\\x1a\\xff\\x7f\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xf8\\x81}\\x1a" } ], "repeated": 0, "id": 28129 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b1ec7", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\fdeploy" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\fdeploy" } ], "repeated": 0, "id": 28130 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff557b2322", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002414" } ], "repeated": 0, "id": 28131 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b2374", "parentcaller": "0x7fff557c5a19", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002518" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" }, { "name": "Handle", "value": "0x00002414" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" } ], "repeated": 0, "id": 28132 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b239d", "parentcaller": "0x7fff557c5a19", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002414" } ], "repeated": 0, "id": 28133 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b23bf", "parentcaller": "0x7fff557c5a19", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002518" } ], "repeated": 0, "id": 28134 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557c4d64", "parentcaller": "0x7fff557c526d", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" } ], "repeated": 0, "id": 28135 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557c530a", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 28136 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557c53f2", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 28137 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557c4d64", "parentcaller": "0x7fff557c526d", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" } ], "repeated": 0, "id": 28138 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557c530a", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 28139 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557c53f2", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 28140 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006ec" }, { "name": "ValueName", "value": "ThisPCPolicy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\PropertyBag\\ThisPCPolicy" } ], "repeated": 0, "id": 28141 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006ec" }, { "name": "ValueName", "value": "ThisPCPolicy" }, { "name": "Data", "value": "Hide" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\PropertyBag\\ThisPCPolicy" } ], "repeated": 0, "id": 28142 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff557b167c", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002518" } ], "repeated": 0, "id": 28143 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b16bb", "parentcaller": "0x7fff557b207c", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 28144 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff557b16e2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002518" } ], "repeated": 0, "id": 28145 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff59f667b5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xbf:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00<\\x00\\x00\\x00\\x00\\x00\\x00\\x00|w\\xb3\\x0c\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 28146 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff59f667ec", "parentcaller": "0x7fff577b5140", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002518" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 28147 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002518" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 28148 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00002518" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 28149 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff557b2291", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x0000000c" }, { "name": "TokenHandle", "value": "0x00002414" } ], "repeated": 0, "id": 28150 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b1fd8", "parentcaller": "0x7fff557b1782", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" }, { "name": "Handle", "value": "0x000025c4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" } ], "repeated": 0, "id": 28151 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b201a", "parentcaller": "0x7fff557b1782", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000025c4" }, { "name": "ValueName", "value": "RDVirtualizationPool" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\RDVirtualizationPool" } ], "repeated": 0, "id": 28152 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b2034", "parentcaller": "0x7fff557b1782", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025c4" } ], "repeated": 0, "id": 28153 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b17b9", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" }, { "name": "Handle", "value": "0x000025c4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" } ], "repeated": 0, "id": 28154 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b17fc", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000025c4" }, { "name": "ValueName", "value": "RDVirtualizationPool" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\RDVirtualizationPool" } ], "repeated": 0, "id": 28155 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b1816", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025c4" } ], "repeated": 0, "id": 28156 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff557b1849", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "0\\xc0:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xa0\\xbd}\\x1a\\xff\\x7f\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xf8\\x81}\\x1a" } ], "repeated": 0, "id": 28157 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b1ec7", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\fdeploy" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\fdeploy" } ], "repeated": 0, "id": 28158 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff557b2322", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002414" } ], "repeated": 0, "id": 28159 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b2374", "parentcaller": "0x7fff557c5a72", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002518" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" }, { "name": "Handle", "value": "0x00002414" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" } ], "repeated": 0, "id": 28160 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b239d", "parentcaller": "0x7fff557c5a72", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002414" } ], "repeated": 0, "id": 28161 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b23bf", "parentcaller": "0x7fff557c5a72", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002518" } ], "repeated": 0, "id": 28162 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b0" }, { "name": "ValueName", "value": "ThisPCPolicy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{f42ee2d3-909f-4907-8871-4c22fc0bf756}\\PropertyBag\\ThisPCPolicy" } ], "repeated": 0, "id": 28163 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b0" }, { "name": "ValueName", "value": "ThisPCPolicy" }, { "name": "Data", "value": "Show" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{f42ee2d3-909f-4907-8871-4c22fc0bf756}\\PropertyBag\\ThisPCPolicy" } ], "repeated": 0, "id": 28164 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b0" }, { "name": "ValueName", "value": "BaseFolderId" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{f42ee2d3-909f-4907-8871-4c22fc0bf756}\\PropertyBag\\BaseFolderId" } ], "repeated": 0, "id": 28165 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b0" }, { "name": "ValueName", "value": "BaseFolderId" }, { "name": "Data", "value": "{FDD39AD0-238F-46AF-ADB4-6C85480369C7}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{f42ee2d3-909f-4907-8871-4c22fc0bf756}\\PropertyBag\\BaseFolderId" } ], "repeated": 0, "id": 28166 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff557b167c", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002518" } ], "repeated": 0, "id": 28167 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b16bb", "parentcaller": "0x7fff557b207c", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 28168 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff557b16e2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002518" } ], "repeated": 0, "id": 28169 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff59f667b5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xbf:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00<\\x00\\x00\\x00\\x00\\x00\\x00\\x00l\\x82\\xb3\\x0c\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 28170 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff59f667ec", "parentcaller": "0x7fff577b5140", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002518" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 28171 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002518" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 28172 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00002518" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 28173 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff557b2291", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x0000000c" }, { "name": "TokenHandle", "value": "0x00002414" } ], "repeated": 0, "id": 28174 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b1fd8", "parentcaller": "0x7fff557b1782", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" }, { "name": "Handle", "value": "0x000025c4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" } ], "repeated": 0, "id": 28175 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b201a", "parentcaller": "0x7fff557b1782", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000025c4" }, { "name": "ValueName", "value": "RDVirtualizationPool" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\RDVirtualizationPool" } ], "repeated": 0, "id": 28176 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b2034", "parentcaller": "0x7fff557b1782", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025c4" } ], "repeated": 0, "id": 28177 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b17b9", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" }, { "name": "Handle", "value": "0x000025c4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" } ], "repeated": 0, "id": 28178 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b17fc", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000025c4" }, { "name": "ValueName", "value": "RDVirtualizationPool" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\RDVirtualizationPool" } ], "repeated": 0, "id": 28179 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b1816", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025c4" } ], "repeated": 0, "id": 28180 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff557b1849", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "0\\xc0:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xa0\\xbd}\\x1a\\xff\\x7f\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xf8\\x81}\\x1a" } ], "repeated": 0, "id": 28181 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b1ec7", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\fdeploy" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\fdeploy" } ], "repeated": 0, "id": 28182 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff557b2322", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002414" } ], "repeated": 0, "id": 28183 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b2374", "parentcaller": "0x7fff557c5a19", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002518" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" }, { "name": "Handle", "value": "0x00002414" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" } ], "repeated": 0, "id": 28184 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b239d", "parentcaller": "0x7fff557c5a19", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002414" } ], "repeated": 0, "id": 28185 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b23bf", "parentcaller": "0x7fff557c5a19", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002518" } ], "repeated": 0, "id": 28186 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557c4d64", "parentcaller": "0x7fff557c526d", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" } ], "repeated": 0, "id": 28187 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557c530a", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 28188 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557c53f2", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 28189 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557c4d64", "parentcaller": "0x7fff557c526d", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" } ], "repeated": 0, "id": 28190 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557c530a", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 28191 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557c53f2", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 28192 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557c4d64", "parentcaller": "0x7fff557c526d", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" } ], "repeated": 0, "id": 28193 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557c530a", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 28194 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557c53f2", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 28195 }, { "timestamp": "2026-05-29 01:05:52,258", "thread_id": "4668", "caller": "0x7fff557b6c7e", "parentcaller": "0x7fff557b4414", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 11, "id": 28196 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff55824fbc", "parentcaller": "0x7fff5581f4db", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000323-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000146-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 28197 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff5581d809", "parentcaller": "0x7fff5581d730", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0340F119-A598-4ED9-B0AC-6F6A12D3E755" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "7F73BE3F-FB79-493C-A6C7-7EE14E245841" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 28198 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff584cf303", "parentcaller": "0x7fff584ce7f3", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 28199 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58080032", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 28200 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5807fd7f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" } ], "repeated": 0, "id": 28201 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5807fdaa", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" } ], "repeated": 0, "id": 28202 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5807fdca", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" } ], "repeated": 0, "id": 28203 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 28204 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 28205 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002344" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 28206 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 28207 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" } ], "repeated": 0, "id": 28208 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 28209 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 28210 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002344" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 28211 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "ValueName", "value": "MonitorRegistry" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\MonitorRegistry" } ], "repeated": 0, "id": 28212 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" } ], "repeated": 0, "id": 28213 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 28214 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 28215 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002344" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UsersFiles\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UsersFiles\\NameSpace" } ], "repeated": 0, "id": 28216 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UsersFiles\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 28217 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" } ], "repeated": 0, "id": 28218 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 28219 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 28220 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002344" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UsersFiles\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UsersFiles\\NameSpace" } ], "repeated": 0, "id": 28221 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "ValueName", "value": "MonitorRegistry" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UsersFiles\\NameSpace\\MonitorRegistry" } ], "repeated": 0, "id": 28222 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" } ], "repeated": 0, "id": 28223 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff5587d014", "parentcaller": "0x7fff558252c1", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance" }, { "name": "Handle", "value": "0x00002346" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance" } ], "repeated": 0, "id": 28224 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002346" }, { "name": "ValueName", "value": "CLSID" }, { "name": "Data", "value": "{0E5AAE11-A475-4c5b-AB00-C66DE400274E}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance\\CLSID" } ], "repeated": 0, "id": 28225 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff558635fc", "parentcaller": "0x7fff55825399", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002614" } ], "repeated": 0, "id": 28226 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff55863669", "parentcaller": "0x7fff55825399", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "18" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 28227 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff558636a1", "parentcaller": "0x7fff55825399", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "20" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 28228 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff558636e3", "parentcaller": "0x7fff55825399", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" } ], "repeated": 0, "id": 28229 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff558638e8", "parentcaller": "0x7fff55825399", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Classes\\CLSID\\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\\InProcServer32" }, { "name": "Handle", "value": "0x00002614" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\\InProcServer32" } ], "repeated": 0, "id": 28230 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "%SystemRoot%\\system32\\Windows.Storage.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{0E5AAE11-A475-4c5b-AB00-C66DE400274E}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 28231 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002614" }, { "name": "ValueName", "value": "LoadWithoutCOM" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{0E5AAE11-A475-4c5b-AB00-C66DE400274E}\\InProcServer32\\LoadWithoutCOM" } ], "repeated": 0, "id": 28232 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff5586397c", "parentcaller": "0x7fff55825399", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002614" } ], "repeated": 0, "id": 28233 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff558259d3", "parentcaller": "0x7fff55896922", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0E5AAE11-A475-4C5B-AB00-C66DE400274E" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 28234 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff58ac4404", "parentcaller": "0x7fff55896973", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002346" }, { "name": "SubKey", "value": "InitPropertyBag" }, { "name": "Handle", "value": "0x00002616" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance\\InitPropertyBag" } ], "repeated": 0, "id": 28235 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002616" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance\\InitPropertyBag\\Attributes" } ], "repeated": 0, "id": 28236 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002616" }, { "name": "ValueName", "value": "Attributes" }, { "name": "Data", "value": "17" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance\\InitPropertyBag\\Attributes" } ], "repeated": 0, "id": 28237 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002616" }, { "name": "ValueName", "value": "DescriptionID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance\\InitPropertyBag\\DescriptionID" } ], "repeated": 0, "id": 28238 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002616" }, { "name": "ValueName", "value": "HelpTopic" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance\\InitPropertyBag\\HelpTopic" } ], "repeated": 0, "id": 28239 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002616" }, { "name": "ValueName", "value": "AllowChildAliasRegistration" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance\\InitPropertyBag\\AllowChildAliasRegistration" } ], "repeated": 0, "id": 28240 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002616" }, { "name": "ValueName", "value": "RecursiveSearch" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance\\InitPropertyBag\\RecursiveSearch" } ], "repeated": 0, "id": 28241 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002616" }, { "name": "ValueName", "value": "TargetKnownFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance\\InitPropertyBag\\TargetKnownFolder" } ], "repeated": 0, "id": 28242 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002616" }, { "name": "ValueName", "value": "TargetKnownFolder" }, { "name": "Data", "value": "{5E6C858F-0E22-4760-9AFE-EA3317B67173}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance\\InitPropertyBag\\TargetKnownFolder" } ], "repeated": 0, "id": 28243 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557c62cb", "parentcaller": "0x7fff558ac7c5", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance" } ], "repeated": 0, "id": 28244 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557c6313", "parentcaller": "0x7fff558ac7c5", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance" }, { "name": "Handle", "value": "0x000026c4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance" } ], "repeated": 0, "id": 28245 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557c6354", "parentcaller": "0x7fff558ac7c5", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000026c4" }, { "name": "SubKey", "value": "" }, { "name": "Handle", "value": "0x0000270c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance\\" } ], "repeated": 0, "id": 28246 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557c63da", "parentcaller": "0x7fff558ac7c5", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026c4" } ], "repeated": 0, "id": 28247 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557c6396", "parentcaller": "0x7fff558ac7c5", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000270c" }, { "name": "SubKey", "value": "" }, { "name": "Handle", "value": "0x000026c4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance\\" } ], "repeated": 0, "id": 28248 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff58ac4304", "parentcaller": "0x7fff58ac665a", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002616" } ], "repeated": 0, "id": 28249 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff5587d159", "parentcaller": "0x7fff5582531b", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000270c" } ], "repeated": 0, "id": 28250 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff5587d14b", "parentcaller": "0x7fff5582531b", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002346" } ], "repeated": 0, "id": 28251 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b6c7e", "parentcaller": "0x7fff557b4414", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 28252 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff5582a695", "parentcaller": "0x7fff5582a024", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026c4" } ], "repeated": 0, "id": 28253 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff55848063", "parentcaller": "0x7fff55848ae6", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" }, { "name": "Handle", "value": "0x000026c4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" } ], "repeated": 0, "id": 28254 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff558480b3", "parentcaller": "0x7fff55848ae6", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000026c4" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 28255 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff558480df", "parentcaller": "0x7fff55848ae6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026c4" } ], "repeated": 0, "id": 28256 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b6c7e", "parentcaller": "0x7fff557b4414", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 3, "id": 28257 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff557c0016", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 28258 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff52874c3e", "parentcaller": "0x7fff52878a3f", "category": "system", "api": "GetUserDefaultLCID", "status": true, "return": "0x00000c09", "arguments": [ { "name": "SystemDefaultLangID", "value": "0x00000c09" }, { "name": "LanguageName", "value": "English (Australia)" } ], "repeated": 11, "id": 28259 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432c5686", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 28260 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432c5686", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "Milliseconds", "value": "600000" } ], "repeated": 0, "id": 28261 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 28262 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff432c5ded", "parentcaller": "0x7fff432c56be", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "AB8902B4-09CA-4BB6-B78D-A8F59079A8D5" }, { "name": "ClsContext", "value": "0x00004004", "pretty_value": "CLSCTX_LOCAL_SERVER|CLSCTX_NO_FAILURE_LOG" }, { "name": "riid", "value": "75121952-E0D0-43E5-9380-1D80483ACF72" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 28263 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff432c5d25", "parentcaller": "0x7fff432c56d1", "category": "system", "api": "CreateTimerQueueTimer", "status": true, "return": "0x00000001", "arguments": [ { "name": "phNewTimer", "value": "0x0cad51e0" }, { "name": "TimerQueue", "value": "0x00000000" }, { "name": "Callback", "value": "0x432ed350" }, { "name": "Parameter", "value": "0x033aea60" }, { "name": "DueTime", "value": "60000" }, { "name": "Period", "value": "1000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 28264 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff55848063", "parentcaller": "0x7fff55848ae6", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" }, { "name": "Handle", "value": "0x00002584" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" } ], "repeated": 0, "id": 28265 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff558480b3", "parentcaller": "0x7fff55848ae6", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002584" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 28266 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff558480df", "parentcaller": "0x7fff55848ae6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002584" } ], "repeated": 0, "id": 28267 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff558499ce", "parentcaller": "0x7fff558498a0", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "CLSID\\{00021401-0000-0000-C000-000000000046}" }, { "name": "Handle", "value": "0x00002586" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\CLSID\\{00021401-0000-0000-C000-000000000046}" } ], "repeated": 0, "id": 28268 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff558498d6", "parentcaller": "0x7fff55849723", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002586" }, { "name": "ValueName", "value": "EnableShareDenyNone" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{00021401-0000-0000-C000-000000000046}\\EnableShareDenyNone" } ], "repeated": 0, "id": 28269 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff5807c5e9", "parentcaller": "0x7fff5807fc58", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "E2EB4CA4-C96E-4DA4-94B1-673C8334A5BB" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "265CFCAA-9B0C-44CA-996F-4A6F6620C72D" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 28270 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff5807ce6f", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022b0" }, { "name": "MutexName", "value": "" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 28271 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff5781c37f", "parentcaller": "0x7fff5781c2fc", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 28272 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577d6579", "parentcaller": "0x7fff5781c32f", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002168" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Desktop\\Discord.lnk" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 28273 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff58096fcb", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002168" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002160" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 28274 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff57fc5921", "parentcaller": "0x7fff58097162", "category": "device", "api": "DeviceIoControl", "status": false, "return": "0x00000000", "arguments": [ { "name": "DeviceHandle", "value": "0x00002160" }, { "name": "IoControlCode", "value": "0x00090240" }, { "name": "InBuffer", "value": "\\x01\\x00\\x0c\\x00\\x03\\x00\\x00\\x00\\x01\\x00\\x00\\x00" }, { "name": "OutBuffer", "value": "" } ], "repeated": 0, "id": 28275 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5809bd52", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002168" } ], "repeated": 0, "id": 28276 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58080032", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022b0" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 28277 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff5807d391", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002168" }, { "name": "MutexName", "value": "" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 28278 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002374" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Desktop\\Discord.lnk" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 28279 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5807d1cc", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022b0" } ], "repeated": 0, "id": 28280 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58080032", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022b0" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 28281 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5807905d", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022b0" } ], "repeated": 0, "id": 28282 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5809b0b5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022b0" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 28283 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002168" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 28284 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 28285 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002168" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 28286 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002168" } ], "repeated": 0, "id": 28287 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5809b106", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 28288 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5809b106", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022b0" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 28289 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5809b122", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022b0" } ], "repeated": 0, "id": 28290 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff57814097", "parentcaller": "0x7fff5807a6a8", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002374" }, { "name": "HandleName", "value": "C:\\Users\\admin\\Desktop\\Discord.lnk" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xc3\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 28291 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577cf0e1", "parentcaller": "0x7fff577cef40", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001170" }, { "name": "DesiredAccess", "value": "0x000f0005", "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x00002374" }, { "name": "FileName", "value": "C:\\Users\\admin\\Desktop\\Discord.lnk" } ], "repeated": 0, "id": 28292 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001170" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08b10000" }, { "name": "SectionOffset", "value": "0x033ad6f0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 28293 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5809abbd", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 28294 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5809abbd", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022b0" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 28295 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 28296 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002168" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 28297 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002168" } ], "repeated": 1, "id": 28298 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5809ac06", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022b0" } ], "repeated": 1, "id": 28299 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 28300 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 28301 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002718" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 28302 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002718" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 28303 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002718" } ], "repeated": 0, "id": 28304 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 28305 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 28306 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002718" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 28307 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002718" }, { "name": "ValueName", "value": "MonitorRegistry" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\MonitorRegistry" } ], "repeated": 0, "id": 28308 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002718" } ], "repeated": 0, "id": 28309 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 28310 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 28311 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002718" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UsersFiles\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UsersFiles\\NameSpace" } ], "repeated": 0, "id": 28312 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002718" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UsersFiles\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 28313 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002718" } ], "repeated": 0, "id": 28314 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 28315 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 28316 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002718" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UsersFiles\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UsersFiles\\NameSpace" } ], "repeated": 0, "id": 28317 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002718" }, { "name": "ValueName", "value": "MonitorRegistry" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UsersFiles\\NameSpace\\MonitorRegistry" } ], "repeated": 0, "id": 28318 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002718" } ], "repeated": 0, "id": 28319 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff5587d014", "parentcaller": "0x7fff558252c1", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance" }, { "name": "Handle", "value": "0x0000271a" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance" } ], "repeated": 0, "id": 28320 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000271a" }, { "name": "ValueName", "value": "CLSID" }, { "name": "Data", "value": "{0E5AAE11-A475-4c5b-AB00-C66DE400274E}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance\\CLSID" } ], "repeated": 0, "id": 28321 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff558635fc", "parentcaller": "0x7fff55825399", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002710" } ], "repeated": 0, "id": 28322 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff55863669", "parentcaller": "0x7fff55825399", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "18" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 28323 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff558636a1", "parentcaller": "0x7fff55825399", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "20" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 28324 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff558636e3", "parentcaller": "0x7fff55825399", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002710" } ], "repeated": 0, "id": 28325 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff558638e8", "parentcaller": "0x7fff55825399", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Classes\\CLSID\\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\\InProcServer32" }, { "name": "Handle", "value": "0x00002710" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\\InProcServer32" } ], "repeated": 0, "id": 28326 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002710" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "%SystemRoot%\\system32\\Windows.Storage.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{0E5AAE11-A475-4c5b-AB00-C66DE400274E}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 28327 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002710" }, { "name": "ValueName", "value": "LoadWithoutCOM" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{0E5AAE11-A475-4c5b-AB00-C66DE400274E}\\InProcServer32\\LoadWithoutCOM" } ], "repeated": 0, "id": 28328 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff5586397c", "parentcaller": "0x7fff55825399", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002710" } ], "repeated": 0, "id": 28329 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff558259d3", "parentcaller": "0x7fff55896922", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0E5AAE11-A475-4C5B-AB00-C66DE400274E" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 28330 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff58ac4404", "parentcaller": "0x7fff55896973", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000271a" }, { "name": "SubKey", "value": "InitPropertyBag" }, { "name": "Handle", "value": "0x00002712" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance\\InitPropertyBag" } ], "repeated": 0, "id": 28331 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002712" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance\\InitPropertyBag\\Attributes" } ], "repeated": 0, "id": 28332 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002712" }, { "name": "ValueName", "value": "Attributes" }, { "name": "Data", "value": "17" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance\\InitPropertyBag\\Attributes" } ], "repeated": 0, "id": 28333 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002712" }, { "name": "ValueName", "value": "DescriptionID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance\\InitPropertyBag\\DescriptionID" } ], "repeated": 0, "id": 28334 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002712" }, { "name": "ValueName", "value": "HelpTopic" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance\\InitPropertyBag\\HelpTopic" } ], "repeated": 0, "id": 28335 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002712" }, { "name": "ValueName", "value": "AllowChildAliasRegistration" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance\\InitPropertyBag\\AllowChildAliasRegistration" } ], "repeated": 0, "id": 28336 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002712" }, { "name": "ValueName", "value": "RecursiveSearch" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance\\InitPropertyBag\\RecursiveSearch" } ], "repeated": 0, "id": 28337 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002712" }, { "name": "ValueName", "value": "TargetKnownFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance\\InitPropertyBag\\TargetKnownFolder" } ], "repeated": 0, "id": 28338 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002712" }, { "name": "ValueName", "value": "TargetKnownFolder" }, { "name": "Data", "value": "{5E6C858F-0E22-4760-9AFE-EA3317B67173}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance\\InitPropertyBag\\TargetKnownFolder" } ], "repeated": 0, "id": 28339 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557c62cb", "parentcaller": "0x7fff558ac7c5", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance" } ], "repeated": 0, "id": 28340 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557c6313", "parentcaller": "0x7fff558ac7c5", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance" }, { "name": "Handle", "value": "0x00002714" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance" } ], "repeated": 0, "id": 28341 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557c6354", "parentcaller": "0x7fff558ac7c5", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002714" }, { "name": "SubKey", "value": "" }, { "name": "Handle", "value": "0x000024b4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance\\" } ], "repeated": 0, "id": 28342 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557c63da", "parentcaller": "0x7fff558ac7c5", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002714" } ], "repeated": 0, "id": 28343 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557c6396", "parentcaller": "0x7fff558ac7c5", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000024b4" }, { "name": "SubKey", "value": "" }, { "name": "Handle", "value": "0x00002714" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance\\" } ], "repeated": 0, "id": 28344 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff58ac4304", "parentcaller": "0x7fff58ac665a", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002712" } ], "repeated": 0, "id": 28345 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff5587d159", "parentcaller": "0x7fff5582531b", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" } ], "repeated": 0, "id": 28346 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff5587d14b", "parentcaller": "0x7fff5582531b", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000271a" } ], "repeated": 0, "id": 28347 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b6c7e", "parentcaller": "0x7fff557b4414", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 28348 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff5582a695", "parentcaller": "0x7fff5582a024", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002714" } ], "repeated": 0, "id": 28349 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577d1e5c", "parentcaller": "0x7fff58090a54", "category": "filesystem", "api": "NtQueryFullAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Users\\admin\\Desktop\\Discord.lnk" } ], "repeated": 0, "id": 28350 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b4361", "parentcaller": "0x7fff557b3e47", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 2, "id": 28351 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557c4d64", "parentcaller": "0x7fff557c526d", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" } ], "repeated": 0, "id": 28352 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557c530a", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 28353 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557c53f2", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 28354 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000bb4" }, { "name": "ValueName", "value": "ThisPCPolicy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\PropertyBag\\ThisPCPolicy" } ], "repeated": 0, "id": 28355 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000bb4" }, { "name": "ValueName", "value": "ThisPCPolicy" }, { "name": "Data", "value": "Hide" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\PropertyBag\\ThisPCPolicy" } ], "repeated": 0, "id": 28356 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff557b167c", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002714" } ], "repeated": 0, "id": 28357 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b16bb", "parentcaller": "0x7fff557b207c", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 28358 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff557b16e2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002714" } ], "repeated": 0, "id": 28359 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff59f667b5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xa0\\xc0:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00<\\x00\\x00\\x00\\x00\\x00\\x00\\x00Lz\\xb3\\x0c\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 28360 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff59f667ec", "parentcaller": "0x7fff577b5140", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002714" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 28361 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002714" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 28362 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00002714" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 28363 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff557b2291", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x0000000c" }, { "name": "TokenHandle", "value": "0x00002718" } ], "repeated": 0, "id": 28364 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b1fd8", "parentcaller": "0x7fff557b1782", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" }, { "name": "Handle", "value": "0x000024b4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" } ], "repeated": 0, "id": 28365 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b201a", "parentcaller": "0x7fff557b1782", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000024b4" }, { "name": "ValueName", "value": "RDVirtualizationPool" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\RDVirtualizationPool" } ], "repeated": 0, "id": 28366 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b2034", "parentcaller": "0x7fff557b1782", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" } ], "repeated": 0, "id": 28367 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b17b9", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" }, { "name": "Handle", "value": "0x000024b4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" } ], "repeated": 0, "id": 28368 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b17fc", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000024b4" }, { "name": "ValueName", "value": "RDVirtualizationPool" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\RDVirtualizationPool" } ], "repeated": 0, "id": 28369 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b1816", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" } ], "repeated": 0, "id": 28370 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff557b1849", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xc1:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xa0\\xbd}\\x1a\\xff\\x7f\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xf8\\x81}\\x1a" } ], "repeated": 0, "id": 28371 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b1ec7", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\fdeploy" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\fdeploy" } ], "repeated": 0, "id": 28372 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff557b2322", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002718" } ], "repeated": 0, "id": 28373 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b2374", "parentcaller": "0x7fff557c5a72", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002714" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" }, { "name": "Handle", "value": "0x00002718" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" } ], "repeated": 0, "id": 28374 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b239d", "parentcaller": "0x7fff557c5a72", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002718" } ], "repeated": 0, "id": 28375 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b23bf", "parentcaller": "0x7fff557c5a72", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002714" } ], "repeated": 0, "id": 28376 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557c4d64", "parentcaller": "0x7fff557c526d", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" } ], "repeated": 0, "id": 28377 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557c530a", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 28378 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557c53f2", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 28379 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000bb0" }, { "name": "ValueName", "value": "ThisPCPolicy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{33E28130-4E1E-4676-835A-98395C3BC3BB}\\PropertyBag\\ThisPCPolicy" } ], "repeated": 0, "id": 28380 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000bb0" }, { "name": "ValueName", "value": "ThisPCPolicy" }, { "name": "Data", "value": "Hide" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{33E28130-4E1E-4676-835A-98395C3BC3BB}\\PropertyBag\\ThisPCPolicy" } ], "repeated": 0, "id": 28381 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff557b167c", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002714" } ], "repeated": 0, "id": 28382 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b16bb", "parentcaller": "0x7fff557b207c", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 28383 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff557b16e2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002714" } ], "repeated": 0, "id": 28384 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff59f667b5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xa0\\xc0:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00<\\x00\\x00\\x00\\x00\\x00\\x00\\x00Lz\\xb3\\x0c\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 28385 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff59f667ec", "parentcaller": "0x7fff577b5140", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002714" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 28386 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002714" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 28387 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00002714" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 28388 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff557b2291", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x0000000c" }, { "name": "TokenHandle", "value": "0x00002718" } ], "repeated": 0, "id": 28389 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b1fd8", "parentcaller": "0x7fff557b1782", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" }, { "name": "Handle", "value": "0x000024b4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" } ], "repeated": 0, "id": 28390 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b201a", "parentcaller": "0x7fff557b1782", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000024b4" }, { "name": "ValueName", "value": "RDVirtualizationPool" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\RDVirtualizationPool" } ], "repeated": 0, "id": 28391 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b2034", "parentcaller": "0x7fff557b1782", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" } ], "repeated": 0, "id": 28392 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b17b9", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" }, { "name": "Handle", "value": "0x000024b4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" } ], "repeated": 0, "id": 28393 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b17fc", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000024b4" }, { "name": "ValueName", "value": "RDVirtualizationPool" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\RDVirtualizationPool" } ], "repeated": 0, "id": 28394 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b1816", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" } ], "repeated": 0, "id": 28395 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff557b1849", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xc1:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xa0\\xbd}\\x1a\\xff\\x7f\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xf8\\x81}\\x1a" } ], "repeated": 0, "id": 28396 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b1ec7", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\fdeploy" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\fdeploy" } ], "repeated": 0, "id": 28397 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff557b2322", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002718" } ], "repeated": 0, "id": 28398 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b2374", "parentcaller": "0x7fff557c5a72", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002714" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" }, { "name": "Handle", "value": "0x00002718" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" } ], "repeated": 0, "id": 28399 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b239d", "parentcaller": "0x7fff557c5a72", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002718" } ], "repeated": 0, "id": 28400 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b23bf", "parentcaller": "0x7fff557c5a72", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002714" } ], "repeated": 0, "id": 28401 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003a4" }, { "name": "ValueName", "value": "ThisPCPolicy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\\PropertyBag\\ThisPCPolicy" } ], "repeated": 0, "id": 28402 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557c4d64", "parentcaller": "0x7fff557c526d", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" } ], "repeated": 0, "id": 28403 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557c530a", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 28404 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557c53f2", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 28405 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b831a", "parentcaller": "0x7fff557b8fd2", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x00002714" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 28406 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b836d", "parentcaller": "0x7fff557b8fd2", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00002714" }, { "name": "SubKey", "value": "{C4900540-2379-4C75-844B-64E6FAF8716B}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C4900540-2379-4C75-844B-64E6FAF8716B}" } ], "repeated": 0, "id": 28407 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b8396", "parentcaller": "0x7fff557b8fd2", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002714" } ], "repeated": 0, "id": 28408 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557c4d64", "parentcaller": "0x7fff557c526d", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" } ], "repeated": 0, "id": 28409 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557c530a", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 28410 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557c53f2", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 28411 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000bb8" }, { "name": "ValueName", "value": "ThisPCPolicy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{56784854-C6CB-462B-8169-88E350ACB882}\\PropertyBag\\ThisPCPolicy" } ], "repeated": 0, "id": 28412 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557c4d64", "parentcaller": "0x7fff557c526d", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" } ], "repeated": 0, "id": 28413 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557c530a", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 28414 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557c53f2", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 28415 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "ThisPCPolicy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0ddd015d-b06c-45d5-8c4c-f59713854639}\\PropertyBag\\ThisPCPolicy" } ], "repeated": 0, "id": 28416 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "ThisPCPolicy" }, { "name": "Data", "value": "Show" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0ddd015d-b06c-45d5-8c4c-f59713854639}\\PropertyBag\\ThisPCPolicy" } ], "repeated": 0, "id": 28417 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "BaseFolderId" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0ddd015d-b06c-45d5-8c4c-f59713854639}\\PropertyBag\\BaseFolderId" } ], "repeated": 0, "id": 28418 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "BaseFolderId" }, { "name": "Data", "value": "{33E28130-4E1E-4676-835A-98395C3BC3BB}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0ddd015d-b06c-45d5-8c4c-f59713854639}\\PropertyBag\\BaseFolderId" } ], "repeated": 0, "id": 28419 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff557b167c", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002714" } ], "repeated": 0, "id": 28420 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b16bb", "parentcaller": "0x7fff557b207c", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 28421 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff557b16e2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002714" } ], "repeated": 0, "id": 28422 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff59f667b5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xa0\\xc0:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00<\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xcc\\x81\\xb3\\x0c\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 28423 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff59f667ec", "parentcaller": "0x7fff577b5140", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002714" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 28424 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002714" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 28425 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00002714" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 28426 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff557b2291", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x0000000c" }, { "name": "TokenHandle", "value": "0x00002718" } ], "repeated": 0, "id": 28427 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b1fd8", "parentcaller": "0x7fff557b1782", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" }, { "name": "Handle", "value": "0x000024b4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" } ], "repeated": 0, "id": 28428 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b201a", "parentcaller": "0x7fff557b1782", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000024b4" }, { "name": "ValueName", "value": "RDVirtualizationPool" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\RDVirtualizationPool" } ], "repeated": 0, "id": 28429 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b2034", "parentcaller": "0x7fff557b1782", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" } ], "repeated": 0, "id": 28430 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b17b9", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" }, { "name": "Handle", "value": "0x000024b4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" } ], "repeated": 0, "id": 28431 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b17fc", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000024b4" }, { "name": "ValueName", "value": "RDVirtualizationPool" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\RDVirtualizationPool" } ], "repeated": 0, "id": 28432 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b1816", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" } ], "repeated": 0, "id": 28433 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff557b1849", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xc1:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xa0\\xbd}\\x1a\\xff\\x7f\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xf8\\x81}\\x1a" } ], "repeated": 0, "id": 28434 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b1ec7", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\fdeploy" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\fdeploy" } ], "repeated": 0, "id": 28435 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff557b2322", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002718" } ], "repeated": 0, "id": 28436 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b2374", "parentcaller": "0x7fff557c5a19", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002714" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" }, { "name": "Handle", "value": "0x00002718" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" } ], "repeated": 0, "id": 28437 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b239d", "parentcaller": "0x7fff557c5a19", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002718" } ], "repeated": 0, "id": 28438 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b23bf", "parentcaller": "0x7fff557c5a19", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002714" } ], "repeated": 0, "id": 28439 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557c4d64", "parentcaller": "0x7fff557c526d", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" } ], "repeated": 0, "id": 28440 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557c530a", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 28441 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557c53f2", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 28442 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557c4d64", "parentcaller": "0x7fff557c526d", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" } ], "repeated": 0, "id": 28443 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557c530a", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 28444 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557c53f2", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 28445 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "ThisPCPolicy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\\PropertyBag\\ThisPCPolicy" } ], "repeated": 0, "id": 28446 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "ThisPCPolicy" }, { "name": "Data", "value": "Show" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\\PropertyBag\\ThisPCPolicy" } ], "repeated": 0, "id": 28447 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "BaseFolderId" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\\PropertyBag\\BaseFolderId" } ], "repeated": 0, "id": 28448 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "BaseFolderId" }, { "name": "Data", "value": "{18989B1D-99B5-455B-841C-AB7C74E4DDFC}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\\PropertyBag\\BaseFolderId" } ], "repeated": 0, "id": 28449 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff557b167c", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002714" } ], "repeated": 0, "id": 28450 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b16bb", "parentcaller": "0x7fff557b207c", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 28451 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff557b16e2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002714" } ], "repeated": 0, "id": 28452 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff59f667b5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xa0\\xc0:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00<\\x00\\x00\\x00\\x00\\x00\\x00\\x00L\\x7f\\xb3\\x0c\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 28453 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff59f667ec", "parentcaller": "0x7fff577b5140", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002714" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 28454 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002714" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 28455 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00002714" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 28456 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff557b2291", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x0000000c" }, { "name": "TokenHandle", "value": "0x00002718" } ], "repeated": 0, "id": 28457 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b1fd8", "parentcaller": "0x7fff557b1782", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" }, { "name": "Handle", "value": "0x000024b4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" } ], "repeated": 0, "id": 28458 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b201a", "parentcaller": "0x7fff557b1782", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000024b4" }, { "name": "ValueName", "value": "RDVirtualizationPool" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\RDVirtualizationPool" } ], "repeated": 0, "id": 28459 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b2034", "parentcaller": "0x7fff557b1782", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" } ], "repeated": 0, "id": 28460 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b17b9", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" }, { "name": "Handle", "value": "0x000024b4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" } ], "repeated": 0, "id": 28461 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b17fc", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000024b4" }, { "name": "ValueName", "value": "RDVirtualizationPool" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\RDVirtualizationPool" } ], "repeated": 0, "id": 28462 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b1816", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" } ], "repeated": 0, "id": 28463 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff557b1849", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xc1:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xa0\\xbd}\\x1a\\xff\\x7f\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xf8\\x81}\\x1a" } ], "repeated": 0, "id": 28464 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b1ec7", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\fdeploy" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\fdeploy" } ], "repeated": 0, "id": 28465 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff557b2322", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002718" } ], "repeated": 0, "id": 28466 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b2374", "parentcaller": "0x7fff557c5a19", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002714" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" }, { "name": "Handle", "value": "0x00002718" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" } ], "repeated": 0, "id": 28467 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b239d", "parentcaller": "0x7fff557c5a19", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002718" } ], "repeated": 0, "id": 28468 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b23bf", "parentcaller": "0x7fff557c5a19", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002714" } ], "repeated": 0, "id": 28469 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557c4d64", "parentcaller": "0x7fff557c526d", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" } ], "repeated": 0, "id": 28470 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557c530a", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 28471 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557c53f2", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 28472 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b831a", "parentcaller": "0x7fff557b8fd2", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x00002714" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 28473 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b836d", "parentcaller": "0x7fff557b8fd2", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00002714" }, { "name": "SubKey", "value": "{B250C668-F57D-4EE1-A63C-290EE7D1AA1F}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B250C668-F57D-4EE1-A63C-290EE7D1AA1F}" } ], "repeated": 0, "id": 28474 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b8396", "parentcaller": "0x7fff557b8fd2", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002714" } ], "repeated": 0, "id": 28475 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000bf4" }, { "name": "ValueName", "value": "ThisPCPolicy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\PropertyBag\\ThisPCPolicy" } ], "repeated": 0, "id": 28476 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000bf4" }, { "name": "ValueName", "value": "ThisPCPolicy" }, { "name": "Data", "value": "Hide" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\PropertyBag\\ThisPCPolicy" } ], "repeated": 0, "id": 28477 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff557b167c", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002714" } ], "repeated": 0, "id": 28478 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b16bb", "parentcaller": "0x7fff557b207c", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 28479 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff557b16e2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002714" } ], "repeated": 0, "id": 28480 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff59f667b5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xa0\\xc0:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00<\\x00\\x00\\x00\\x00\\x00\\x00\\x00L\\x7f\\xb3\\x0c\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 28481 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff59f667ec", "parentcaller": "0x7fff577b5140", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002714" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 28482 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002714" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 28483 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00002714" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 28484 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff557b2291", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x0000000c" }, { "name": "TokenHandle", "value": "0x00002718" } ], "repeated": 0, "id": 28485 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b1fd8", "parentcaller": "0x7fff557b1782", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" }, { "name": "Handle", "value": "0x000024b4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" } ], "repeated": 0, "id": 28486 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b201a", "parentcaller": "0x7fff557b1782", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000024b4" }, { "name": "ValueName", "value": "RDVirtualizationPool" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\RDVirtualizationPool" } ], "repeated": 0, "id": 28487 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b2034", "parentcaller": "0x7fff557b1782", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" } ], "repeated": 0, "id": 28488 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b17b9", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" }, { "name": "Handle", "value": "0x000024b4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" } ], "repeated": 0, "id": 28489 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b17fc", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000024b4" }, { "name": "ValueName", "value": "RDVirtualizationPool" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\RDVirtualizationPool" } ], "repeated": 0, "id": 28490 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b1816", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" } ], "repeated": 0, "id": 28491 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff557b1849", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xc1:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xa0\\xbd}\\x1a\\xff\\x7f\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xf8\\x81}\\x1a" } ], "repeated": 0, "id": 28492 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b1ec7", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\fdeploy" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\fdeploy" } ], "repeated": 0, "id": 28493 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff557b2322", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002718" } ], "repeated": 0, "id": 28494 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b2374", "parentcaller": "0x7fff557c5a72", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002714" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" }, { "name": "Handle", "value": "0x00002718" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" } ], "repeated": 0, "id": 28495 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b239d", "parentcaller": "0x7fff557c5a72", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002718" } ], "repeated": 0, "id": 28496 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b23bf", "parentcaller": "0x7fff557c5a72", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002714" } ], "repeated": 0, "id": 28497 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557c4d64", "parentcaller": "0x7fff557c526d", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" } ], "repeated": 0, "id": 28498 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557c530a", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 28499 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557c53f2", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 28500 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000b4c" }, { "name": "ValueName", "value": "ThisPCPolicy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{374DE290-123F-4565-9164-39C4925E467B}\\PropertyBag\\ThisPCPolicy" } ], "repeated": 0, "id": 28501 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000b4c" }, { "name": "ValueName", "value": "ThisPCPolicy" }, { "name": "Data", "value": "Hide" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{374DE290-123F-4565-9164-39C4925E467B}\\PropertyBag\\ThisPCPolicy" } ], "repeated": 0, "id": 28502 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff557b167c", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002714" } ], "repeated": 0, "id": 28503 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b16bb", "parentcaller": "0x7fff557b207c", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 28504 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff557b16e2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002714" } ], "repeated": 0, "id": 28505 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff59f667b5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xa0\\xc0:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00<\\x00\\x00\\x00\\x00\\x00\\x00\\x00Lz\\xb3\\x0c\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 28506 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff59f667ec", "parentcaller": "0x7fff577b5140", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002714" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 28507 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002714" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 28508 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00002714" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 28509 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff557b2291", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x0000000c" }, { "name": "TokenHandle", "value": "0x00002718" } ], "repeated": 0, "id": 28510 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b1fd8", "parentcaller": "0x7fff557b1782", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" }, { "name": "Handle", "value": "0x000024b4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" } ], "repeated": 0, "id": 28511 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b201a", "parentcaller": "0x7fff557b1782", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000024b4" }, { "name": "ValueName", "value": "RDVirtualizationPool" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\RDVirtualizationPool" } ], "repeated": 0, "id": 28512 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b2034", "parentcaller": "0x7fff557b1782", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" } ], "repeated": 0, "id": 28513 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b17b9", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" }, { "name": "Handle", "value": "0x000024b4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" } ], "repeated": 0, "id": 28514 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b17fc", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000024b4" }, { "name": "ValueName", "value": "RDVirtualizationPool" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\RDVirtualizationPool" } ], "repeated": 0, "id": 28515 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b1816", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" } ], "repeated": 0, "id": 28516 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff557b1849", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xc1:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xa0\\xbd}\\x1a\\xff\\x7f\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xf8\\x81}\\x1a" } ], "repeated": 0, "id": 28517 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b1ec7", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\fdeploy" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\fdeploy" } ], "repeated": 0, "id": 28518 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff557b2322", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002718" } ], "repeated": 0, "id": 28519 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b2374", "parentcaller": "0x7fff557c5a72", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002714" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" }, { "name": "Handle", "value": "0x00002718" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" } ], "repeated": 0, "id": 28520 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b239d", "parentcaller": "0x7fff557c5a72", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002718" } ], "repeated": 0, "id": 28521 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b23bf", "parentcaller": "0x7fff557c5a72", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002714" } ], "repeated": 0, "id": 28522 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b831a", "parentcaller": "0x7fff557b8fd2", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x00002714" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 28523 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b836d", "parentcaller": "0x7fff557b8fd2", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00002714" }, { "name": "SubKey", "value": "{859EAD94-2E85-48AD-A71A-0969CB56A6CD}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{859EAD94-2E85-48AD-A71A-0969CB56A6CD}" } ], "repeated": 0, "id": 28524 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b8396", "parentcaller": "0x7fff557b8fd2", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002714" } ], "repeated": 0, "id": 28525 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557c4d64", "parentcaller": "0x7fff557c526d", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" } ], "repeated": 0, "id": 28526 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557c530a", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 28527 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557c53f2", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 28528 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b4" }, { "name": "ValueName", "value": "ThisPCPolicy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{a0c69a99-21c8-4671-8703-7934162fcf1d}\\PropertyBag\\ThisPCPolicy" } ], "repeated": 0, "id": 28529 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b4" }, { "name": "ValueName", "value": "ThisPCPolicy" }, { "name": "Data", "value": "Show" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{a0c69a99-21c8-4671-8703-7934162fcf1d}\\PropertyBag\\ThisPCPolicy" } ], "repeated": 0, "id": 28530 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b4" }, { "name": "ValueName", "value": "BaseFolderId" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{a0c69a99-21c8-4671-8703-7934162fcf1d}\\PropertyBag\\BaseFolderId" } ], "repeated": 0, "id": 28531 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b4" }, { "name": "ValueName", "value": "BaseFolderId" }, { "name": "Data", "value": "{4BD8D571-6D19-48D3-BE97-422220080E43}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{a0c69a99-21c8-4671-8703-7934162fcf1d}\\PropertyBag\\BaseFolderId" } ], "repeated": 0, "id": 28532 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff557b167c", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002714" } ], "repeated": 0, "id": 28533 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b16bb", "parentcaller": "0x7fff557b207c", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 28534 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff557b16e2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002714" } ], "repeated": 0, "id": 28535 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff59f667b5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xa0\\xc0:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00<\\x00\\x00\\x00\\x00\\x00\\x00\\x00<\\x80\\xb3\\x0c\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 28536 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff59f667ec", "parentcaller": "0x7fff577b5140", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002714" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 28537 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002714" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 28538 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00002714" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 28539 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff557b2291", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x0000000c" }, { "name": "TokenHandle", "value": "0x00002718" } ], "repeated": 0, "id": 28540 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b1fd8", "parentcaller": "0x7fff557b1782", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" }, { "name": "Handle", "value": "0x000024b4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" } ], "repeated": 0, "id": 28541 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b201a", "parentcaller": "0x7fff557b1782", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000024b4" }, { "name": "ValueName", "value": "RDVirtualizationPool" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\RDVirtualizationPool" } ], "repeated": 0, "id": 28542 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b2034", "parentcaller": "0x7fff557b1782", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" } ], "repeated": 0, "id": 28543 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b17b9", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" }, { "name": "Handle", "value": "0x000024b4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" } ], "repeated": 0, "id": 28544 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b17fc", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000024b4" }, { "name": "ValueName", "value": "RDVirtualizationPool" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\RDVirtualizationPool" } ], "repeated": 0, "id": 28545 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b1816", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" } ], "repeated": 0, "id": 28546 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff557b1849", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xc1:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xa0\\xbd}\\x1a\\xff\\x7f\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xf8\\x81}\\x1a" } ], "repeated": 0, "id": 28547 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b1ec7", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\fdeploy" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\fdeploy" } ], "repeated": 0, "id": 28548 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff557b2322", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002718" } ], "repeated": 0, "id": 28549 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b2374", "parentcaller": "0x7fff557c5a19", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002714" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" }, { "name": "Handle", "value": "0x00002718" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" } ], "repeated": 0, "id": 28550 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b239d", "parentcaller": "0x7fff557c5a19", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002718" } ], "repeated": 0, "id": 28551 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b23bf", "parentcaller": "0x7fff557c5a19", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002714" } ], "repeated": 0, "id": 28552 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557c4d64", "parentcaller": "0x7fff557c526d", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" } ], "repeated": 0, "id": 28553 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557c530a", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 28554 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557c53f2", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 28555 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003c4" }, { "name": "ValueName", "value": "ThisPCPolicy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7d83ee9b-2244-4e70-b1f5-5393042af1e4}\\PropertyBag\\ThisPCPolicy" } ], "repeated": 0, "id": 28556 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003c4" }, { "name": "ValueName", "value": "ThisPCPolicy" }, { "name": "Data", "value": "Show" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7d83ee9b-2244-4e70-b1f5-5393042af1e4}\\PropertyBag\\ThisPCPolicy" } ], "repeated": 0, "id": 28557 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003c4" }, { "name": "ValueName", "value": "BaseFolderId" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7d83ee9b-2244-4e70-b1f5-5393042af1e4}\\PropertyBag\\BaseFolderId" } ], "repeated": 0, "id": 28558 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003c4" }, { "name": "ValueName", "value": "BaseFolderId" }, { "name": "Data", "value": "{374DE290-123F-4565-9164-39C4925E467B}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7d83ee9b-2244-4e70-b1f5-5393042af1e4}\\PropertyBag\\BaseFolderId" } ], "repeated": 0, "id": 28559 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff557b167c", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002714" } ], "repeated": 0, "id": 28560 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b16bb", "parentcaller": "0x7fff557b207c", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 28561 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff557b16e2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002714" } ], "repeated": 0, "id": 28562 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff59f667b5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xa0\\xc0:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00<\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9cz\\xb3\\x0c\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 28563 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff59f667ec", "parentcaller": "0x7fff577b5140", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002714" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 28564 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002714" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 28565 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00002714" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 28566 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff557b2291", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x0000000c" }, { "name": "TokenHandle", "value": "0x00002718" } ], "repeated": 0, "id": 28567 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b1fd8", "parentcaller": "0x7fff557b1782", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" }, { "name": "Handle", "value": "0x000024b4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" } ], "repeated": 0, "id": 28568 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b201a", "parentcaller": "0x7fff557b1782", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000024b4" }, { "name": "ValueName", "value": "RDVirtualizationPool" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\RDVirtualizationPool" } ], "repeated": 0, "id": 28569 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b2034", "parentcaller": "0x7fff557b1782", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" } ], "repeated": 0, "id": 28570 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b17b9", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" }, { "name": "Handle", "value": "0x000024b4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" } ], "repeated": 0, "id": 28571 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b17fc", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000024b4" }, { "name": "ValueName", "value": "RDVirtualizationPool" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\RDVirtualizationPool" } ], "repeated": 0, "id": 28572 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b1816", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" } ], "repeated": 0, "id": 28573 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff557b1849", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xc1:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xa0\\xbd}\\x1a\\xff\\x7f\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xf8\\x81}\\x1a" } ], "repeated": 0, "id": 28574 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b1ec7", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\fdeploy" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\fdeploy" } ], "repeated": 0, "id": 28575 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff557b2322", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002718" } ], "repeated": 0, "id": 28576 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b2374", "parentcaller": "0x7fff557c5a19", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002714" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" }, { "name": "Handle", "value": "0x00002718" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" } ], "repeated": 0, "id": 28577 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b239d", "parentcaller": "0x7fff557c5a19", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002718" } ], "repeated": 0, "id": 28578 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b23bf", "parentcaller": "0x7fff557c5a19", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002714" } ], "repeated": 0, "id": 28579 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557c4d64", "parentcaller": "0x7fff557c526d", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" } ], "repeated": 0, "id": 28580 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557c530a", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 28581 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557c53f2", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 28582 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557c4d64", "parentcaller": "0x7fff557c526d", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" } ], "repeated": 0, "id": 28583 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557c530a", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 28584 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557c53f2", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 28585 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006ec" }, { "name": "ValueName", "value": "ThisPCPolicy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\PropertyBag\\ThisPCPolicy" } ], "repeated": 0, "id": 28586 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006ec" }, { "name": "ValueName", "value": "ThisPCPolicy" }, { "name": "Data", "value": "Hide" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\PropertyBag\\ThisPCPolicy" } ], "repeated": 0, "id": 28587 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff557b167c", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002714" } ], "repeated": 0, "id": 28588 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b16bb", "parentcaller": "0x7fff557b207c", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 28589 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff557b16e2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002714" } ], "repeated": 0, "id": 28590 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff59f667b5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xa0\\xc0:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00<\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9cz\\xb3\\x0c\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 28591 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff59f667ec", "parentcaller": "0x7fff577b5140", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002714" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 28592 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002714" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 28593 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00002714" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 28594 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff557b2291", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x0000000c" }, { "name": "TokenHandle", "value": "0x00002718" } ], "repeated": 0, "id": 28595 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b1fd8", "parentcaller": "0x7fff557b1782", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" }, { "name": "Handle", "value": "0x000024b4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" } ], "repeated": 0, "id": 28596 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b201a", "parentcaller": "0x7fff557b1782", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000024b4" }, { "name": "ValueName", "value": "RDVirtualizationPool" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\RDVirtualizationPool" } ], "repeated": 0, "id": 28597 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b2034", "parentcaller": "0x7fff557b1782", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" } ], "repeated": 0, "id": 28598 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b17b9", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" }, { "name": "Handle", "value": "0x000024b4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" } ], "repeated": 0, "id": 28599 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b17fc", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000024b4" }, { "name": "ValueName", "value": "RDVirtualizationPool" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\RDVirtualizationPool" } ], "repeated": 0, "id": 28600 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b1816", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" } ], "repeated": 0, "id": 28601 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff557b1849", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xc1:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xa0\\xbd}\\x1a\\xff\\x7f\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xf8\\x81}\\x1a" } ], "repeated": 0, "id": 28602 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b1ec7", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\fdeploy" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\fdeploy" } ], "repeated": 0, "id": 28603 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff557b2322", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002718" } ], "repeated": 0, "id": 28604 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b2374", "parentcaller": "0x7fff557c5a72", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002714" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" }, { "name": "Handle", "value": "0x00002718" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" } ], "repeated": 0, "id": 28605 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b239d", "parentcaller": "0x7fff557c5a72", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002718" } ], "repeated": 0, "id": 28606 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b23bf", "parentcaller": "0x7fff557c5a72", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002714" } ], "repeated": 0, "id": 28607 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b0" }, { "name": "ValueName", "value": "ThisPCPolicy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{f42ee2d3-909f-4907-8871-4c22fc0bf756}\\PropertyBag\\ThisPCPolicy" } ], "repeated": 0, "id": 28608 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b0" }, { "name": "ValueName", "value": "ThisPCPolicy" }, { "name": "Data", "value": "Show" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{f42ee2d3-909f-4907-8871-4c22fc0bf756}\\PropertyBag\\ThisPCPolicy" } ], "repeated": 0, "id": 28609 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b0" }, { "name": "ValueName", "value": "BaseFolderId" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{f42ee2d3-909f-4907-8871-4c22fc0bf756}\\PropertyBag\\BaseFolderId" } ], "repeated": 0, "id": 28610 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b0" }, { "name": "ValueName", "value": "BaseFolderId" }, { "name": "Data", "value": "{FDD39AD0-238F-46AF-ADB4-6C85480369C7}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{f42ee2d3-909f-4907-8871-4c22fc0bf756}\\PropertyBag\\BaseFolderId" } ], "repeated": 0, "id": 28611 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff557b167c", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002714" } ], "repeated": 0, "id": 28612 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff557b16bb", "parentcaller": "0x7fff557b207c", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 28613 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff557b16e2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002714" } ], "repeated": 0, "id": 28614 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff59f667b5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xa0\\xc0:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00<\\x00\\x00\\x00\\x00\\x00\\x00\\x00ls\\xb3\\x0c\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 28615 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff59f667ec", "parentcaller": "0x7fff577b5140", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002714" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 28616 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002714" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 28617 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00002714" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 28618 }, { "timestamp": "2026-05-29 01:05:52,274", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff557b2291", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x0000000c" }, { "name": "TokenHandle", "value": "0x00002718" } ], "repeated": 0, "id": 28619 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557b1fd8", "parentcaller": "0x7fff557b1782", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" }, { "name": "Handle", "value": "0x000024b4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" } ], "repeated": 0, "id": 28620 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557b201a", "parentcaller": "0x7fff557b1782", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000024b4" }, { "name": "ValueName", "value": "RDVirtualizationPool" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\RDVirtualizationPool" } ], "repeated": 0, "id": 28621 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557b2034", "parentcaller": "0x7fff557b1782", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" } ], "repeated": 0, "id": 28622 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557b17b9", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" }, { "name": "Handle", "value": "0x000024b4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" } ], "repeated": 0, "id": 28623 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557b17fc", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000024b4" }, { "name": "ValueName", "value": "RDVirtualizationPool" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\RDVirtualizationPool" } ], "repeated": 0, "id": 28624 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557b1816", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" } ], "repeated": 0, "id": 28625 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff557b1849", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xc1:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xa0\\xbd}\\x1a\\xff\\x7f\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xf8\\x81}\\x1a" } ], "repeated": 0, "id": 28626 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557b1ec7", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\fdeploy" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\fdeploy" } ], "repeated": 0, "id": 28627 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff557b2322", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002718" } ], "repeated": 0, "id": 28628 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557b2374", "parentcaller": "0x7fff557c5a19", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002714" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" }, { "name": "Handle", "value": "0x00002718" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" } ], "repeated": 0, "id": 28629 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557b239d", "parentcaller": "0x7fff557c5a19", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002718" } ], "repeated": 0, "id": 28630 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557b23bf", "parentcaller": "0x7fff557c5a19", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002714" } ], "repeated": 0, "id": 28631 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557c4d64", "parentcaller": "0x7fff557c526d", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" } ], "repeated": 0, "id": 28632 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557c530a", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 28633 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557c53f2", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 28634 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557c4d64", "parentcaller": "0x7fff557c526d", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" } ], "repeated": 0, "id": 28635 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557c530a", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 28636 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557c53f2", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 28637 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557c4d64", "parentcaller": "0x7fff557c526d", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" } ], "repeated": 0, "id": 28638 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557c530a", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 28639 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557c53f2", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 28640 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557b6c7e", "parentcaller": "0x7fff557b4414", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 11, "id": 28641 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff55824fbc", "parentcaller": "0x7fff5581f4db", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000323-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000146-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 28642 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff5581d809", "parentcaller": "0x7fff5581d730", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0340F119-A598-4ED9-B0AC-6F6A12D3E755" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "7F73BE3F-FB79-493C-A6C7-7EE14E245841" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 28643 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff584cf303", "parentcaller": "0x7fff584ce7f3", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 28644 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58080032", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022b0" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 28645 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff580912fe", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022b0" } ], "repeated": 0, "id": 28646 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff5807aeaa", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08b10000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 28647 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5807af2c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001170" } ], "repeated": 0, "id": 28648 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58080032", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002168" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 28649 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5807fd7f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002374" } ], "repeated": 0, "id": 28650 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5807fdaa", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002168" } ], "repeated": 0, "id": 28651 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5807fdca", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002168" } ], "repeated": 0, "id": 28652 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5807ea94", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002160" } ], "repeated": 0, "id": 28653 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5807eabd", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000229c" } ], "repeated": 0, "id": 28654 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5807c972", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022b0" } ], "repeated": 0, "id": 28655 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff59f5c23a", "parentcaller": "0x7fff59f5c30d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000468" } ], "repeated": 0, "id": 28656 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff558497da", "parentcaller": "0x7fff55849057", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002586" } ], "repeated": 0, "id": 28657 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577d07f5", "parentcaller": "0x7fff577cc03b", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Discord\\app.ico" } ], "repeated": 0, "id": 28658 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557b6c7e", "parentcaller": "0x7fff557b4414", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 3, "id": 28659 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff557c0016", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002450" } ], "repeated": 0, "id": 28660 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 28661 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000c7c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 28662 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432cbf4b", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 28663 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff5807fb58", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "MutexName", "value": "" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 28664 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002524" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Desktop\\Discord.lnk" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 28665 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 28666 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 28667 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 28668 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 28669 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577d5783", "parentcaller": "0x7fff58090260", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002524" }, { "name": "HandleName", "value": "C:\\Users\\admin\\Desktop\\Discord.lnk" }, { "name": "Buffer", "value": "L\\x00\\x00\\x00\\x01\\x14\\x02\\x00\\x00\\x00\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00F\\xff@\\x00\\x00 \\x00\\x00\\x00\\x15oH-\\x00\\xef\\xdc\\x01,\\xed\\xf90\\x00\\xef\\xdc\\x01\\x00\\x83\\x8dR\t\\xe7\\xdc\\x01\\xb8[\\x18\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc4\\x01:\\x00\\x1fDG\\x1a\\x03Yr?\\xa7D\\x89\\xc5U\\x95\\xfek0\\xee&\\x00\\x01\\x00&\\x00\\xef\\xbe\\x10\\x00\\x00\\x00\\xf4a\\xd0\\x9c\\xb6\\xee\\xdc\\x01I\\x8f\\xf6K\\xf7\\xee\\xdc\\x01\\xed\\xef\r1\\x00\\xef\\xdc\\x01\\x14\\x00\\x82\\x00t\\x00\\x1c\\x00CFSF\\x16\\x001\\x00\\x00\\x00\\x00\\x00\\xbc\\\\x8a{\\x12\\x00AppData\\x00\\x00\\x00t\\x1aY^\\x96\\xdf\\xd3H\\x8dg\\x173\\xbc\\xee(\\xba\\xc5\\xcd\\xfa\\xdf\\x9fgVA\\x89G\\xc5\\xc7k\\xc0\\xb6\\x7f@\\x00\t\\x00\\x04\\x00\\xef\\xbe\\xbc\\\\x8a{\\xbd\\k\\x01.\\x00\\x00\\x00\\x1c\\xa5\\x01\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x92\\x05!\\x00A\\x00p\\x00p\\x00D\\x00" }, { "name": "Length", "value": "2243" } ], "repeated": 0, "id": 28670 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 28671 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 28672 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 1, "id": 28673 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 28674 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 28675 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 28676 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 28677 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 28678 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 28679 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 1, "id": 28680 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 28681 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 28682 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 28683 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 28684 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 28685 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 28686 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 1, "id": 28687 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 28688 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 28689 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 28690 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 28691 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 28692 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 28693 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 1, "id": 28694 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 28695 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 28696 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000023a0" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 28697 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000023a0" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 28698 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000023a0" } ], "repeated": 0, "id": 28699 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 28700 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 28701 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000023a0" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 28702 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000023a0" }, { "name": "ValueName", "value": "MonitorRegistry" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\MonitorRegistry" } ], "repeated": 0, "id": 28703 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000023a0" } ], "repeated": 0, "id": 28704 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 28705 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 28706 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000023a0" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UsersFiles\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UsersFiles\\NameSpace" } ], "repeated": 0, "id": 28707 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000023a0" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UsersFiles\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 28708 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000023a0" } ], "repeated": 0, "id": 28709 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 28710 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 28711 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000023a0" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UsersFiles\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UsersFiles\\NameSpace" } ], "repeated": 0, "id": 28712 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000023a0" }, { "name": "ValueName", "value": "MonitorRegistry" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UsersFiles\\NameSpace\\MonitorRegistry" } ], "repeated": 0, "id": 28713 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000023a0" } ], "repeated": 0, "id": 28714 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff5587d014", "parentcaller": "0x7fff558252c1", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance" }, { "name": "Handle", "value": "0x000023a2" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance" } ], "repeated": 0, "id": 28715 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000023a2" }, { "name": "ValueName", "value": "CLSID" }, { "name": "Data", "value": "{0E5AAE11-A475-4c5b-AB00-C66DE400274E}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance\\CLSID" } ], "repeated": 0, "id": 28716 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff558635fc", "parentcaller": "0x7fff55825399", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000022e4" } ], "repeated": 0, "id": 28717 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff55863669", "parentcaller": "0x7fff55825399", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "18" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 28718 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff558636a1", "parentcaller": "0x7fff55825399", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "20" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 28719 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff558636e3", "parentcaller": "0x7fff55825399", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" } ], "repeated": 0, "id": 28720 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff558638e8", "parentcaller": "0x7fff55825399", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Classes\\CLSID\\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\\InProcServer32" }, { "name": "Handle", "value": "0x000022e4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\\InProcServer32" } ], "repeated": 0, "id": 28721 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "%SystemRoot%\\system32\\Windows.Storage.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{0E5AAE11-A475-4c5b-AB00-C66DE400274E}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 28722 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "ValueName", "value": "LoadWithoutCOM" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{0E5AAE11-A475-4c5b-AB00-C66DE400274E}\\InProcServer32\\LoadWithoutCOM" } ], "repeated": 0, "id": 28723 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff5586397c", "parentcaller": "0x7fff55825399", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" } ], "repeated": 0, "id": 28724 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff558259d3", "parentcaller": "0x7fff55896922", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0E5AAE11-A475-4C5B-AB00-C66DE400274E" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 28725 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff58ac4404", "parentcaller": "0x7fff55896973", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000023a2" }, { "name": "SubKey", "value": "InitPropertyBag" }, { "name": "Handle", "value": "0x000022e6" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance\\InitPropertyBag" } ], "repeated": 0, "id": 28726 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e6" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance\\InitPropertyBag\\Attributes" } ], "repeated": 0, "id": 28727 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e6" }, { "name": "ValueName", "value": "Attributes" }, { "name": "Data", "value": "17" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance\\InitPropertyBag\\Attributes" } ], "repeated": 0, "id": 28728 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000022e6" }, { "name": "ValueName", "value": "DescriptionID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance\\InitPropertyBag\\DescriptionID" } ], "repeated": 0, "id": 28729 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000022e6" }, { "name": "ValueName", "value": "HelpTopic" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance\\InitPropertyBag\\HelpTopic" } ], "repeated": 0, "id": 28730 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000022e6" }, { "name": "ValueName", "value": "AllowChildAliasRegistration" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance\\InitPropertyBag\\AllowChildAliasRegistration" } ], "repeated": 0, "id": 28731 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000022e6" }, { "name": "ValueName", "value": "RecursiveSearch" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance\\InitPropertyBag\\RecursiveSearch" } ], "repeated": 0, "id": 28732 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e6" }, { "name": "ValueName", "value": "TargetKnownFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance\\InitPropertyBag\\TargetKnownFolder" } ], "repeated": 0, "id": 28733 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e6" }, { "name": "ValueName", "value": "TargetKnownFolder" }, { "name": "Data", "value": "{5E6C858F-0E22-4760-9AFE-EA3317B67173}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance\\InitPropertyBag\\TargetKnownFolder" } ], "repeated": 0, "id": 28734 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557c62cb", "parentcaller": "0x7fff558ac7c5", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance" } ], "repeated": 0, "id": 28735 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557c6313", "parentcaller": "0x7fff558ac7c5", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance" }, { "name": "Handle", "value": "0x00002488" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance" } ], "repeated": 0, "id": 28736 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557c6354", "parentcaller": "0x7fff558ac7c5", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002488" }, { "name": "SubKey", "value": "" }, { "name": "Handle", "value": "0x00001af0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance\\" } ], "repeated": 0, "id": 28737 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557c63da", "parentcaller": "0x7fff558ac7c5", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" } ], "repeated": 0, "id": 28738 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557c6396", "parentcaller": "0x7fff558ac7c5", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00001af0" }, { "name": "SubKey", "value": "" }, { "name": "Handle", "value": "0x00002488" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance\\" } ], "repeated": 0, "id": 28739 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff58ac4304", "parentcaller": "0x7fff58ac665a", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e6" } ], "repeated": 0, "id": 28740 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff5587d159", "parentcaller": "0x7fff5582531b", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 28741 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff5587d14b", "parentcaller": "0x7fff5582531b", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000023a2" } ], "repeated": 0, "id": 28742 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557b6c7e", "parentcaller": "0x7fff557b4414", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 28743 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff5582a695", "parentcaller": "0x7fff5582a024", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" } ], "repeated": 0, "id": 28744 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 28745 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 28746 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 28747 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 28748 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff5780b767", "parentcaller": "0x7fff58085024", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002524" }, { "name": "HandleName", "value": "C:\\Users\\admin\\Desktop\\Discord.lnk" }, { "name": "FileInformationClass", "value": "4", "pretty_value": "FileBasicInformation" }, { "name": "FileInformation", "value": "2);0\\x00\\xef\\xdc\\x01\\xb3\\xb1cK\\x07\\xef\\xdc\\x01j\\xcc\\x121\\x00\\xef\\xdc\\x01j\\xcc\\x121\\x00\\xef\\xdc\\x01 \\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 28749 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff5780b767", "parentcaller": "0x7fff5808504b", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002524" }, { "name": "HandleName", "value": "C:\\Users\\admin\\Desktop\\Discord.lnk" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xc3\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 28750 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 28751 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 28752 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 1, "id": 28753 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 28754 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 28755 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 28756 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 28757 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 28758 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 28759 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 1, "id": 28760 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 28761 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 28762 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 28763 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 28764 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 28765 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 28766 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 1, "id": 28767 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 28768 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 28769 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 28770 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 28771 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 28772 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 28773 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 1, "id": 28774 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 28775 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 28776 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 28777 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 28778 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 28779 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 28780 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 1, "id": 28781 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 28782 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 28783 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 28784 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 28785 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 28786 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 28787 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 1, "id": 28788 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 28789 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 28790 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 28791 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 28792 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 28793 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 28794 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 1, "id": 28795 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 28796 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 28797 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 28798 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 28799 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 28800 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 28801 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 1, "id": 28802 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 28803 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 28804 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 28805 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 28806 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 28807 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 28808 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 1, "id": 28809 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 28810 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 28811 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 28812 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 28813 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 28814 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 28815 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 1, "id": 28816 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 28817 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 28818 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 28819 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 28820 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 28821 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 28822 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 1, "id": 28823 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 28824 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 28825 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 28826 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 28827 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 28828 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 28829 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 1, "id": 28830 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 28831 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 28832 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 28833 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 28834 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 28835 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 28836 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 1, "id": 28837 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 28838 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 28839 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 28840 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 28841 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 28842 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 28843 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 1, "id": 28844 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 28845 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 28846 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 28847 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 28848 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 28849 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 28850 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 1, "id": 28851 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 28852 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 28853 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 28854 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 28855 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 28856 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 28857 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 1, "id": 28858 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 28859 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 28860 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 28861 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 28862 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 28863 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 28864 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 1, "id": 28865 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 28866 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 28867 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 28868 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 28869 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 28870 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 28871 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 1, "id": 28872 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 28873 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 28874 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 28875 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 28876 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 28877 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 28878 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 1, "id": 28879 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 28880 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 28881 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 28882 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 28883 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 28884 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 28885 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 1, "id": 28886 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 28887 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 28888 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 28889 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 28890 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 28891 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 28892 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 1, "id": 28893 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 28894 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 28895 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 28896 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 28897 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 28898 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 28899 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 1, "id": 28900 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 28901 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 28902 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 28903 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 28904 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 28905 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 28906 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 1, "id": 28907 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3c0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 28908 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 28909 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f3f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 28910 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f411", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 28911 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 28912 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5808f47d", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 28913 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5808f4a2", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 1, "id": 28914 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557b4361", "parentcaller": "0x7fff557b3e47", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 2, "id": 28915 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557c4d64", "parentcaller": "0x7fff557c526d", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" } ], "repeated": 0, "id": 28916 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557c530a", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 28917 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557c53f2", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 28918 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000bb4" }, { "name": "ValueName", "value": "ThisPCPolicy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\PropertyBag\\ThisPCPolicy" } ], "repeated": 0, "id": 28919 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000bb4" }, { "name": "ValueName", "value": "ThisPCPolicy" }, { "name": "Data", "value": "Hide" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\PropertyBag\\ThisPCPolicy" } ], "repeated": 0, "id": 28920 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff557b167c", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002488" } ], "repeated": 0, "id": 28921 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557b16bb", "parentcaller": "0x7fff557b207c", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 28922 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff557b16e2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" } ], "repeated": 0, "id": 28923 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff59f667b5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x90\\xbe:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00<\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xcc|\\xb3\\x0c\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 28924 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff59f667ec", "parentcaller": "0x7fff577b5140", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002488" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 28925 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002488" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 28926 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00002488" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 28927 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff557b2291", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x0000000c" }, { "name": "TokenHandle", "value": "0x000023a0" } ], "repeated": 0, "id": 28928 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557b1fd8", "parentcaller": "0x7fff557b1782", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" }, { "name": "Handle", "value": "0x00001af0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" } ], "repeated": 0, "id": 28929 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557b201a", "parentcaller": "0x7fff557b1782", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "ValueName", "value": "RDVirtualizationPool" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\RDVirtualizationPool" } ], "repeated": 0, "id": 28930 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557b2034", "parentcaller": "0x7fff557b1782", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 28931 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557b17b9", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" }, { "name": "Handle", "value": "0x00001af0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" } ], "repeated": 0, "id": 28932 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557b17fc", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "ValueName", "value": "RDVirtualizationPool" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\RDVirtualizationPool" } ], "repeated": 0, "id": 28933 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557b1816", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 28934 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff557b1849", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x10\\xbf:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xa0\\xbd}\\x1a\\xff\\x7f\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xf8\\x81}\\x1a" } ], "repeated": 0, "id": 28935 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557b1ec7", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\fdeploy" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\fdeploy" } ], "repeated": 0, "id": 28936 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff557b2322", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000023a0" } ], "repeated": 0, "id": 28937 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557b2374", "parentcaller": "0x7fff557c5a72", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002488" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" }, { "name": "Handle", "value": "0x000023a0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" } ], "repeated": 0, "id": 28938 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557b239d", "parentcaller": "0x7fff557c5a72", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000023a0" } ], "repeated": 0, "id": 28939 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557b23bf", "parentcaller": "0x7fff557c5a72", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" } ], "repeated": 0, "id": 28940 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557c4d64", "parentcaller": "0x7fff557c526d", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" } ], "repeated": 0, "id": 28941 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557c530a", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 28942 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557c53f2", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 28943 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000bb0" }, { "name": "ValueName", "value": "ThisPCPolicy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{33E28130-4E1E-4676-835A-98395C3BC3BB}\\PropertyBag\\ThisPCPolicy" } ], "repeated": 0, "id": 28944 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000bb0" }, { "name": "ValueName", "value": "ThisPCPolicy" }, { "name": "Data", "value": "Hide" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{33E28130-4E1E-4676-835A-98395C3BC3BB}\\PropertyBag\\ThisPCPolicy" } ], "repeated": 0, "id": 28945 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff557b167c", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002488" } ], "repeated": 0, "id": 28946 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557b16bb", "parentcaller": "0x7fff557b207c", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 28947 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff557b16e2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" } ], "repeated": 0, "id": 28948 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff59f667b5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x90\\xbe:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00<\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xdc{\\xb3\\x0c\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 28949 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff59f667ec", "parentcaller": "0x7fff577b5140", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002488" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 28950 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002488" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 28951 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00002488" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 28952 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff557b2291", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x0000000c" }, { "name": "TokenHandle", "value": "0x000023a0" } ], "repeated": 0, "id": 28953 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557b1fd8", "parentcaller": "0x7fff557b1782", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" }, { "name": "Handle", "value": "0x00001af0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" } ], "repeated": 0, "id": 28954 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557b201a", "parentcaller": "0x7fff557b1782", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "ValueName", "value": "RDVirtualizationPool" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\RDVirtualizationPool" } ], "repeated": 0, "id": 28955 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557b2034", "parentcaller": "0x7fff557b1782", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 28956 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557b17b9", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" }, { "name": "Handle", "value": "0x00001af0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" } ], "repeated": 0, "id": 28957 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557b17fc", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "ValueName", "value": "RDVirtualizationPool" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\RDVirtualizationPool" } ], "repeated": 0, "id": 28958 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557b1816", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 28959 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff557b1849", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x10\\xbf:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xa0\\xbd}\\x1a\\xff\\x7f\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xf8\\x81}\\x1a" } ], "repeated": 0, "id": 28960 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557b1ec7", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\fdeploy" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\fdeploy" } ], "repeated": 0, "id": 28961 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff557b2322", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000023a0" } ], "repeated": 0, "id": 28962 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557b2374", "parentcaller": "0x7fff557c5a72", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002488" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" }, { "name": "Handle", "value": "0x000023a0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" } ], "repeated": 0, "id": 28963 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557b239d", "parentcaller": "0x7fff557c5a72", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000023a0" } ], "repeated": 0, "id": 28964 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557b23bf", "parentcaller": "0x7fff557c5a72", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" } ], "repeated": 0, "id": 28965 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003a4" }, { "name": "ValueName", "value": "ThisPCPolicy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\\PropertyBag\\ThisPCPolicy" } ], "repeated": 0, "id": 28966 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557c4d64", "parentcaller": "0x7fff557c526d", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" } ], "repeated": 0, "id": 28967 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557c530a", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 28968 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557c53f2", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 28969 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557b831a", "parentcaller": "0x7fff557b8fd2", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x00002488" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 28970 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557b836d", "parentcaller": "0x7fff557b8fd2", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00002488" }, { "name": "SubKey", "value": "{C4900540-2379-4C75-844B-64E6FAF8716B}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C4900540-2379-4C75-844B-64E6FAF8716B}" } ], "repeated": 0, "id": 28971 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557b8396", "parentcaller": "0x7fff557b8fd2", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" } ], "repeated": 0, "id": 28972 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557c4d64", "parentcaller": "0x7fff557c526d", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" } ], "repeated": 0, "id": 28973 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557c530a", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 28974 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557c53f2", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 28975 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000bb8" }, { "name": "ValueName", "value": "ThisPCPolicy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{56784854-C6CB-462B-8169-88E350ACB882}\\PropertyBag\\ThisPCPolicy" } ], "repeated": 0, "id": 28976 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557c4d64", "parentcaller": "0x7fff557c526d", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" } ], "repeated": 0, "id": 28977 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557c530a", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 28978 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557c53f2", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 28979 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "ThisPCPolicy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0ddd015d-b06c-45d5-8c4c-f59713854639}\\PropertyBag\\ThisPCPolicy" } ], "repeated": 0, "id": 28980 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "ThisPCPolicy" }, { "name": "Data", "value": "Show" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0ddd015d-b06c-45d5-8c4c-f59713854639}\\PropertyBag\\ThisPCPolicy" } ], "repeated": 0, "id": 28981 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "BaseFolderId" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0ddd015d-b06c-45d5-8c4c-f59713854639}\\PropertyBag\\BaseFolderId" } ], "repeated": 0, "id": 28982 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "BaseFolderId" }, { "name": "Data", "value": "{33E28130-4E1E-4676-835A-98395C3BC3BB}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0ddd015d-b06c-45d5-8c4c-f59713854639}\\PropertyBag\\BaseFolderId" } ], "repeated": 0, "id": 28983 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff557b167c", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002488" } ], "repeated": 0, "id": 28984 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557b16bb", "parentcaller": "0x7fff557b207c", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 28985 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff557b16e2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" } ], "repeated": 0, "id": 28986 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff59f667b5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x90\\xbe:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00<\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9c\\x7f\\xb3\\x0c\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 28987 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff59f667ec", "parentcaller": "0x7fff577b5140", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002488" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 28988 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002488" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 28989 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00002488" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 28990 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff557b2291", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x0000000c" }, { "name": "TokenHandle", "value": "0x000023a0" } ], "repeated": 0, "id": 28991 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557b1fd8", "parentcaller": "0x7fff557b1782", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" }, { "name": "Handle", "value": "0x00001af0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" } ], "repeated": 0, "id": 28992 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557b201a", "parentcaller": "0x7fff557b1782", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "ValueName", "value": "RDVirtualizationPool" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\RDVirtualizationPool" } ], "repeated": 0, "id": 28993 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557b2034", "parentcaller": "0x7fff557b1782", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 28994 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557b17b9", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" }, { "name": "Handle", "value": "0x00001af0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" } ], "repeated": 0, "id": 28995 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557b17fc", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "ValueName", "value": "RDVirtualizationPool" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\RDVirtualizationPool" } ], "repeated": 0, "id": 28996 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557b1816", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 28997 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff557b1849", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x10\\xbf:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xa0\\xbd}\\x1a\\xff\\x7f\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xf8\\x81}\\x1a" } ], "repeated": 0, "id": 28998 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557b1ec7", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\fdeploy" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\fdeploy" } ], "repeated": 0, "id": 28999 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff557b2322", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000023a0" } ], "repeated": 0, "id": 29000 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557b2374", "parentcaller": "0x7fff557c5a19", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002488" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" }, { "name": "Handle", "value": "0x000023a0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" } ], "repeated": 0, "id": 29001 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557b239d", "parentcaller": "0x7fff557c5a19", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000023a0" } ], "repeated": 0, "id": 29002 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557b23bf", "parentcaller": "0x7fff557c5a19", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" } ], "repeated": 0, "id": 29003 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557c4d64", "parentcaller": "0x7fff557c526d", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" } ], "repeated": 0, "id": 29004 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557c530a", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 29005 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557c53f2", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 29006 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557c4d64", "parentcaller": "0x7fff557c526d", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" } ], "repeated": 0, "id": 29007 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557c530a", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 29008 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557c53f2", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 29009 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "ThisPCPolicy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\\PropertyBag\\ThisPCPolicy" } ], "repeated": 0, "id": 29010 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "ThisPCPolicy" }, { "name": "Data", "value": "Show" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\\PropertyBag\\ThisPCPolicy" } ], "repeated": 0, "id": 29011 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "BaseFolderId" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\\PropertyBag\\BaseFolderId" } ], "repeated": 0, "id": 29012 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "BaseFolderId" }, { "name": "Data", "value": "{18989B1D-99B5-455B-841C-AB7C74E4DDFC}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\\PropertyBag\\BaseFolderId" } ], "repeated": 0, "id": 29013 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff557b167c", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002488" } ], "repeated": 0, "id": 29014 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557b16bb", "parentcaller": "0x7fff557b207c", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 29015 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff557b16e2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" } ], "repeated": 0, "id": 29016 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff59f667b5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x90\\xbe:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00<\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0cy\\xb3\\x0c\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 29017 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff59f667ec", "parentcaller": "0x7fff577b5140", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002488" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 29018 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002488" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 29019 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00002488" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 29020 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff557b2291", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x0000000c" }, { "name": "TokenHandle", "value": "0x000023a0" } ], "repeated": 0, "id": 29021 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557b1fd8", "parentcaller": "0x7fff557b1782", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" }, { "name": "Handle", "value": "0x00001af0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" } ], "repeated": 0, "id": 29022 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557b201a", "parentcaller": "0x7fff557b1782", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "ValueName", "value": "RDVirtualizationPool" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\RDVirtualizationPool" } ], "repeated": 0, "id": 29023 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557b2034", "parentcaller": "0x7fff557b1782", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 29024 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557b17b9", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" }, { "name": "Handle", "value": "0x00001af0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" } ], "repeated": 0, "id": 29025 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557b17fc", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "ValueName", "value": "RDVirtualizationPool" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\RDVirtualizationPool" } ], "repeated": 0, "id": 29026 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557b1816", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 29027 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff557b1849", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x10\\xbf:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xa0\\xbd}\\x1a\\xff\\x7f\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xf8\\x81}\\x1a" } ], "repeated": 0, "id": 29028 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557b1ec7", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\fdeploy" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\fdeploy" } ], "repeated": 0, "id": 29029 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff557b2322", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000023a0" } ], "repeated": 0, "id": 29030 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557b2374", "parentcaller": "0x7fff557c5a19", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002488" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" }, { "name": "Handle", "value": "0x000023a0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" } ], "repeated": 0, "id": 29031 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557b239d", "parentcaller": "0x7fff557c5a19", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000023a0" } ], "repeated": 0, "id": 29032 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557b23bf", "parentcaller": "0x7fff557c5a19", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" } ], "repeated": 0, "id": 29033 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557c4d64", "parentcaller": "0x7fff557c526d", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" } ], "repeated": 0, "id": 29034 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557c530a", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 29035 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557c53f2", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 29036 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557b831a", "parentcaller": "0x7fff557b8fd2", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x00002488" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 29037 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557b836d", "parentcaller": "0x7fff557b8fd2", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00002488" }, { "name": "SubKey", "value": "{B250C668-F57D-4EE1-A63C-290EE7D1AA1F}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B250C668-F57D-4EE1-A63C-290EE7D1AA1F}" } ], "repeated": 0, "id": 29038 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557b8396", "parentcaller": "0x7fff557b8fd2", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" } ], "repeated": 0, "id": 29039 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000bf4" }, { "name": "ValueName", "value": "ThisPCPolicy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\PropertyBag\\ThisPCPolicy" } ], "repeated": 0, "id": 29040 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000bf4" }, { "name": "ValueName", "value": "ThisPCPolicy" }, { "name": "Data", "value": "Hide" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\PropertyBag\\ThisPCPolicy" } ], "repeated": 0, "id": 29041 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff557b167c", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002488" } ], "repeated": 0, "id": 29042 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557b16bb", "parentcaller": "0x7fff557b207c", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 29043 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff557b16e2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" } ], "repeated": 0, "id": 29044 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff59f667b5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x90\\xbe:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00<\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0cy\\xb3\\x0c\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 29045 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff59f667ec", "parentcaller": "0x7fff577b5140", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002488" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 29046 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002488" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 29047 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00002488" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 29048 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff557b2291", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x0000000c" }, { "name": "TokenHandle", "value": "0x000023a0" } ], "repeated": 0, "id": 29049 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557b1fd8", "parentcaller": "0x7fff557b1782", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" }, { "name": "Handle", "value": "0x00001af0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" } ], "repeated": 0, "id": 29050 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557b201a", "parentcaller": "0x7fff557b1782", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "ValueName", "value": "RDVirtualizationPool" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\RDVirtualizationPool" } ], "repeated": 0, "id": 29051 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557b2034", "parentcaller": "0x7fff557b1782", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 29052 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557b17b9", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" }, { "name": "Handle", "value": "0x00001af0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" } ], "repeated": 0, "id": 29053 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557b17fc", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "ValueName", "value": "RDVirtualizationPool" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\RDVirtualizationPool" } ], "repeated": 0, "id": 29054 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557b1816", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 29055 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff557b1849", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x10\\xbf:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xa0\\xbd}\\x1a\\xff\\x7f\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xf8\\x81}\\x1a" } ], "repeated": 0, "id": 29056 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557b1ec7", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\fdeploy" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\fdeploy" } ], "repeated": 0, "id": 29057 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff557b2322", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000023a0" } ], "repeated": 0, "id": 29058 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557b2374", "parentcaller": "0x7fff557c5a72", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002488" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" }, { "name": "Handle", "value": "0x000023a0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" } ], "repeated": 0, "id": 29059 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557b239d", "parentcaller": "0x7fff557c5a72", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000023a0" } ], "repeated": 0, "id": 29060 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557b23bf", "parentcaller": "0x7fff557c5a72", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" } ], "repeated": 0, "id": 29061 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557c4d64", "parentcaller": "0x7fff557c526d", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" } ], "repeated": 0, "id": 29062 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557c530a", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 29063 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557c53f2", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 29064 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000b4c" }, { "name": "ValueName", "value": "ThisPCPolicy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{374DE290-123F-4565-9164-39C4925E467B}\\PropertyBag\\ThisPCPolicy" } ], "repeated": 0, "id": 29065 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000b4c" }, { "name": "ValueName", "value": "ThisPCPolicy" }, { "name": "Data", "value": "Hide" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{374DE290-123F-4565-9164-39C4925E467B}\\PropertyBag\\ThisPCPolicy" } ], "repeated": 0, "id": 29066 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff557b167c", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002488" } ], "repeated": 0, "id": 29067 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557b16bb", "parentcaller": "0x7fff557b207c", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 29068 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff557b16e2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" } ], "repeated": 0, "id": 29069 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff59f667b5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x90\\xbe:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00<\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0cy\\xb3\\x0c\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 29070 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff59f667ec", "parentcaller": "0x7fff577b5140", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002488" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 29071 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002488" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 29072 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00002488" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 29073 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff557b2291", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x0000000c" }, { "name": "TokenHandle", "value": "0x000023a0" } ], "repeated": 0, "id": 29074 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557b1fd8", "parentcaller": "0x7fff557b1782", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" }, { "name": "Handle", "value": "0x00001af0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" } ], "repeated": 0, "id": 29075 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557b201a", "parentcaller": "0x7fff557b1782", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "ValueName", "value": "RDVirtualizationPool" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\RDVirtualizationPool" } ], "repeated": 0, "id": 29076 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557b2034", "parentcaller": "0x7fff557b1782", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 29077 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557b17b9", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" }, { "name": "Handle", "value": "0x00001af0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" } ], "repeated": 0, "id": 29078 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557b17fc", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "ValueName", "value": "RDVirtualizationPool" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\RDVirtualizationPool" } ], "repeated": 0, "id": 29079 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557b1816", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 29080 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff557b1849", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x10\\xbf:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xa0\\xbd}\\x1a\\xff\\x7f\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xf8\\x81}\\x1a" } ], "repeated": 0, "id": 29081 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557b1ec7", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\fdeploy" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\fdeploy" } ], "repeated": 0, "id": 29082 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff557b2322", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000023a0" } ], "repeated": 0, "id": 29083 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557b2374", "parentcaller": "0x7fff557c5a72", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002488" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" }, { "name": "Handle", "value": "0x000023a0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" } ], "repeated": 0, "id": 29084 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557b239d", "parentcaller": "0x7fff557c5a72", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000023a0" } ], "repeated": 0, "id": 29085 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557b23bf", "parentcaller": "0x7fff557c5a72", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" } ], "repeated": 0, "id": 29086 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557b831a", "parentcaller": "0x7fff557b8fd2", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x00002488" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 29087 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557b836d", "parentcaller": "0x7fff557b8fd2", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00002488" }, { "name": "SubKey", "value": "{859EAD94-2E85-48AD-A71A-0969CB56A6CD}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{859EAD94-2E85-48AD-A71A-0969CB56A6CD}" } ], "repeated": 0, "id": 29088 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557b8396", "parentcaller": "0x7fff557b8fd2", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" } ], "repeated": 0, "id": 29089 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557c4d64", "parentcaller": "0x7fff557c526d", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" } ], "repeated": 0, "id": 29090 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557c530a", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 29091 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557c53f2", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 29092 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b4" }, { "name": "ValueName", "value": "ThisPCPolicy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{a0c69a99-21c8-4671-8703-7934162fcf1d}\\PropertyBag\\ThisPCPolicy" } ], "repeated": 0, "id": 29093 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b4" }, { "name": "ValueName", "value": "ThisPCPolicy" }, { "name": "Data", "value": "Show" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{a0c69a99-21c8-4671-8703-7934162fcf1d}\\PropertyBag\\ThisPCPolicy" } ], "repeated": 0, "id": 29094 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b4" }, { "name": "ValueName", "value": "BaseFolderId" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{a0c69a99-21c8-4671-8703-7934162fcf1d}\\PropertyBag\\BaseFolderId" } ], "repeated": 0, "id": 29095 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b4" }, { "name": "ValueName", "value": "BaseFolderId" }, { "name": "Data", "value": "{4BD8D571-6D19-48D3-BE97-422220080E43}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{a0c69a99-21c8-4671-8703-7934162fcf1d}\\PropertyBag\\BaseFolderId" } ], "repeated": 0, "id": 29096 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff557b167c", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002488" } ], "repeated": 0, "id": 29097 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557b16bb", "parentcaller": "0x7fff557b207c", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 29098 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff557b16e2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" } ], "repeated": 0, "id": 29099 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff59f667b5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x90\\xbe:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00<\\x00\\x00\\x00\\x00\\x00\\x00\\x00l}\\xb3\\x0c\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 29100 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff59f667ec", "parentcaller": "0x7fff577b5140", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002488" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 29101 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002488" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 29102 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00002488" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 29103 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff557b2291", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x0000000c" }, { "name": "TokenHandle", "value": "0x000023a0" } ], "repeated": 0, "id": 29104 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557b1fd8", "parentcaller": "0x7fff557b1782", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" }, { "name": "Handle", "value": "0x00001af0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" } ], "repeated": 0, "id": 29105 }, { "timestamp": "2026-05-29 01:05:52,290", "thread_id": "4668", "caller": "0x7fff557b201a", "parentcaller": "0x7fff557b1782", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "ValueName", "value": "RDVirtualizationPool" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\RDVirtualizationPool" } ], "repeated": 0, "id": 29106 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff557b2034", "parentcaller": "0x7fff557b1782", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 29107 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff557b17b9", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" }, { "name": "Handle", "value": "0x00001af0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" } ], "repeated": 0, "id": 29108 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff557b17fc", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "ValueName", "value": "RDVirtualizationPool" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\RDVirtualizationPool" } ], "repeated": 0, "id": 29109 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff557b1816", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 29110 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff557b1849", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x10\\xbf:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xa0\\xbd}\\x1a\\xff\\x7f\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xf8\\x81}\\x1a" } ], "repeated": 0, "id": 29111 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff557b1ec7", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\fdeploy" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\fdeploy" } ], "repeated": 0, "id": 29112 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff557b2322", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000023a0" } ], "repeated": 0, "id": 29113 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff557b2374", "parentcaller": "0x7fff557c5a19", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002488" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" }, { "name": "Handle", "value": "0x000023a0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" } ], "repeated": 0, "id": 29114 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff557b239d", "parentcaller": "0x7fff557c5a19", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000023a0" } ], "repeated": 0, "id": 29115 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff557b23bf", "parentcaller": "0x7fff557c5a19", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" } ], "repeated": 0, "id": 29116 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff557c4d64", "parentcaller": "0x7fff557c526d", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" } ], "repeated": 0, "id": 29117 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff557c530a", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 29118 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff557c53f2", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 29119 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003c4" }, { "name": "ValueName", "value": "ThisPCPolicy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7d83ee9b-2244-4e70-b1f5-5393042af1e4}\\PropertyBag\\ThisPCPolicy" } ], "repeated": 0, "id": 29120 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003c4" }, { "name": "ValueName", "value": "ThisPCPolicy" }, { "name": "Data", "value": "Show" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7d83ee9b-2244-4e70-b1f5-5393042af1e4}\\PropertyBag\\ThisPCPolicy" } ], "repeated": 0, "id": 29121 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003c4" }, { "name": "ValueName", "value": "BaseFolderId" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7d83ee9b-2244-4e70-b1f5-5393042af1e4}\\PropertyBag\\BaseFolderId" } ], "repeated": 0, "id": 29122 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003c4" }, { "name": "ValueName", "value": "BaseFolderId" }, { "name": "Data", "value": "{374DE290-123F-4565-9164-39C4925E467B}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7d83ee9b-2244-4e70-b1f5-5393042af1e4}\\PropertyBag\\BaseFolderId" } ], "repeated": 0, "id": 29123 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff557b167c", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002488" } ], "repeated": 0, "id": 29124 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff557b16bb", "parentcaller": "0x7fff557b207c", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 29125 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff557b16e2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" } ], "repeated": 0, "id": 29126 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff59f667b5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x90\\xbe:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00<\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0cy\\xb3\\x0c\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 29127 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff59f667ec", "parentcaller": "0x7fff577b5140", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002488" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 29128 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002488" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 29129 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00002488" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 29130 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff557b2291", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x0000000c" }, { "name": "TokenHandle", "value": "0x000023a0" } ], "repeated": 0, "id": 29131 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff557b1fd8", "parentcaller": "0x7fff557b1782", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" }, { "name": "Handle", "value": "0x00001af0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" } ], "repeated": 0, "id": 29132 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff557b201a", "parentcaller": "0x7fff557b1782", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "ValueName", "value": "RDVirtualizationPool" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\RDVirtualizationPool" } ], "repeated": 0, "id": 29133 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff557b2034", "parentcaller": "0x7fff557b1782", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 29134 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff557b17b9", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" }, { "name": "Handle", "value": "0x00001af0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" } ], "repeated": 0, "id": 29135 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff557b17fc", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "ValueName", "value": "RDVirtualizationPool" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\RDVirtualizationPool" } ], "repeated": 0, "id": 29136 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff557b1816", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 29137 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff557b1849", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x10\\xbf:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xa0\\xbd}\\x1a\\xff\\x7f\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xf8\\x81}\\x1a" } ], "repeated": 0, "id": 29138 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff557b1ec7", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\fdeploy" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\fdeploy" } ], "repeated": 0, "id": 29139 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff557b2322", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000023a0" } ], "repeated": 0, "id": 29140 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff557b2374", "parentcaller": "0x7fff557c5a19", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002488" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" }, { "name": "Handle", "value": "0x000023a0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" } ], "repeated": 0, "id": 29141 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff557b239d", "parentcaller": "0x7fff557c5a19", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000023a0" } ], "repeated": 0, "id": 29142 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff557b23bf", "parentcaller": "0x7fff557c5a19", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" } ], "repeated": 0, "id": 29143 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff557c4d64", "parentcaller": "0x7fff557c526d", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" } ], "repeated": 0, "id": 29144 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff557c530a", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 29145 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff557c53f2", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 29146 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff557c4d64", "parentcaller": "0x7fff557c526d", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" } ], "repeated": 0, "id": 29147 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff557c530a", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 29148 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff557c53f2", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 29149 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006ec" }, { "name": "ValueName", "value": "ThisPCPolicy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\PropertyBag\\ThisPCPolicy" } ], "repeated": 0, "id": 29150 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006ec" }, { "name": "ValueName", "value": "ThisPCPolicy" }, { "name": "Data", "value": "Hide" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\PropertyBag\\ThisPCPolicy" } ], "repeated": 0, "id": 29151 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff557b167c", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002488" } ], "repeated": 0, "id": 29152 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff557b16bb", "parentcaller": "0x7fff557b207c", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 29153 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff557b16e2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" } ], "repeated": 0, "id": 29154 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff59f667b5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x90\\xbe:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00<\\x00\\x00\\x00\\x00\\x00\\x00\\x00,|\\xb3\\x0c\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 29155 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff59f667ec", "parentcaller": "0x7fff577b5140", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002488" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 29156 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002488" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 29157 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00002488" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 29158 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff557b2291", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x0000000c" }, { "name": "TokenHandle", "value": "0x000023a0" } ], "repeated": 0, "id": 29159 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff557b1fd8", "parentcaller": "0x7fff557b1782", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" }, { "name": "Handle", "value": "0x00001af0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" } ], "repeated": 0, "id": 29160 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff557b201a", "parentcaller": "0x7fff557b1782", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "ValueName", "value": "RDVirtualizationPool" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\RDVirtualizationPool" } ], "repeated": 0, "id": 29161 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff557b2034", "parentcaller": "0x7fff557b1782", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 29162 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff557b17b9", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" }, { "name": "Handle", "value": "0x00001af0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" } ], "repeated": 0, "id": 29163 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff557b17fc", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "ValueName", "value": "RDVirtualizationPool" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\RDVirtualizationPool" } ], "repeated": 0, "id": 29164 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff557b1816", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 29165 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff557b1849", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x10\\xbf:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xa0\\xbd}\\x1a\\xff\\x7f\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xf8\\x81}\\x1a" } ], "repeated": 0, "id": 29166 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff557b1ec7", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\fdeploy" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\fdeploy" } ], "repeated": 0, "id": 29167 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff557b2322", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000023a0" } ], "repeated": 0, "id": 29168 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff557b2374", "parentcaller": "0x7fff557c5a72", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002488" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" }, { "name": "Handle", "value": "0x000023a0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" } ], "repeated": 0, "id": 29169 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff557b239d", "parentcaller": "0x7fff557c5a72", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000023a0" } ], "repeated": 0, "id": 29170 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff557b23bf", "parentcaller": "0x7fff557c5a72", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" } ], "repeated": 0, "id": 29171 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b0" }, { "name": "ValueName", "value": "ThisPCPolicy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{f42ee2d3-909f-4907-8871-4c22fc0bf756}\\PropertyBag\\ThisPCPolicy" } ], "repeated": 0, "id": 29172 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b0" }, { "name": "ValueName", "value": "ThisPCPolicy" }, { "name": "Data", "value": "Show" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{f42ee2d3-909f-4907-8871-4c22fc0bf756}\\PropertyBag\\ThisPCPolicy" } ], "repeated": 0, "id": 29173 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b0" }, { "name": "ValueName", "value": "BaseFolderId" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{f42ee2d3-909f-4907-8871-4c22fc0bf756}\\PropertyBag\\BaseFolderId" } ], "repeated": 0, "id": 29174 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b0" }, { "name": "ValueName", "value": "BaseFolderId" }, { "name": "Data", "value": "{FDD39AD0-238F-46AF-ADB4-6C85480369C7}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{f42ee2d3-909f-4907-8871-4c22fc0bf756}\\PropertyBag\\BaseFolderId" } ], "repeated": 0, "id": 29175 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff557b167c", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002488" } ], "repeated": 0, "id": 29176 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff557b16bb", "parentcaller": "0x7fff557b207c", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 29177 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff557b16e2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" } ], "repeated": 0, "id": 29178 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff59f667b5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x90\\xbe:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00<\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0cy\\xb3\\x0c\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 29179 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff59f667ec", "parentcaller": "0x7fff577b5140", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002488" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 29180 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002488" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 29181 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00002488" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 29182 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff557b2291", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x0000000c" }, { "name": "TokenHandle", "value": "0x000023a0" } ], "repeated": 0, "id": 29183 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff557b1fd8", "parentcaller": "0x7fff557b1782", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" }, { "name": "Handle", "value": "0x00001af0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" } ], "repeated": 0, "id": 29184 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff557b201a", "parentcaller": "0x7fff557b1782", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "ValueName", "value": "RDVirtualizationPool" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\RDVirtualizationPool" } ], "repeated": 0, "id": 29185 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff557b2034", "parentcaller": "0x7fff557b1782", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 29186 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff557b17b9", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" }, { "name": "Handle", "value": "0x00001af0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" } ], "repeated": 0, "id": 29187 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff557b17fc", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001af0" }, { "name": "ValueName", "value": "RDVirtualizationPool" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\RDVirtualizationPool" } ], "repeated": 0, "id": 29188 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff557b1816", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 29189 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff557b1849", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x10\\xbf:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xa0\\xbd}\\x1a\\xff\\x7f\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xf8\\x81}\\x1a" } ], "repeated": 0, "id": 29190 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff557b1ec7", "parentcaller": "0x7fff557b22b6", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\fdeploy" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\fdeploy" } ], "repeated": 0, "id": 29191 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff557b2322", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000023a0" } ], "repeated": 0, "id": 29192 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff557b2374", "parentcaller": "0x7fff557c5a19", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002488" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" }, { "name": "Handle", "value": "0x000023a0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" } ], "repeated": 0, "id": 29193 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff557b239d", "parentcaller": "0x7fff557c5a19", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000023a0" } ], "repeated": 0, "id": 29194 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff557b23bf", "parentcaller": "0x7fff557c5a19", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" } ], "repeated": 0, "id": 29195 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff557c4d64", "parentcaller": "0x7fff557c526d", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" } ], "repeated": 0, "id": 29196 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff557c530a", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 29197 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff557c53f2", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 29198 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff557c4d64", "parentcaller": "0x7fff557c526d", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" } ], "repeated": 0, "id": 29199 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff557c530a", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 29200 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff557c53f2", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 29201 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff557c4d64", "parentcaller": "0x7fff557c526d", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" } ], "repeated": 0, "id": 29202 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff557c530a", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 29203 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff557c53f2", "parentcaller": "0x7fff557b251a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 29204 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff557b6c7e", "parentcaller": "0x7fff557b4414", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 11, "id": 29205 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff55824fbc", "parentcaller": "0x7fff5581f4db", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000323-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000146-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 29206 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff5581d809", "parentcaller": "0x7fff5581d730", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0340F119-A598-4ED9-B0AC-6F6A12D3E755" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "7F73BE3F-FB79-493C-A6C7-7EE14E245841" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 29207 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff584cf303", "parentcaller": "0x7fff584ce7f3", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 29208 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58080032", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 29209 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5807fd7f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002524" } ], "repeated": 0, "id": 29210 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff5807fdaa", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 29211 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5807fdca", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 29212 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 29213 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 29214 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000494" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 29215 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 29216 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 29217 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 29218 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 29219 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000494" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 29220 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "ValueName", "value": "MonitorRegistry" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\MonitorRegistry" } ], "repeated": 0, "id": 29221 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 29222 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 29223 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 29224 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000494" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UsersFiles\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UsersFiles\\NameSpace" } ], "repeated": 0, "id": 29225 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UsersFiles\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 29226 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 29227 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 29228 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 29229 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000494" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UsersFiles\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UsersFiles\\NameSpace" } ], "repeated": 0, "id": 29230 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "ValueName", "value": "MonitorRegistry" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UsersFiles\\NameSpace\\MonitorRegistry" } ], "repeated": 0, "id": 29231 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5581b3dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 29232 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff5587d014", "parentcaller": "0x7fff558252c1", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance" }, { "name": "Handle", "value": "0x00000496" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance" } ], "repeated": 0, "id": 29233 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000496" }, { "name": "ValueName", "value": "CLSID" }, { "name": "Data", "value": "{0E5AAE11-A475-4c5b-AB00-C66DE400274E}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance\\CLSID" } ], "repeated": 0, "id": 29234 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff558635fc", "parentcaller": "0x7fff55825399", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002524" } ], "repeated": 0, "id": 29235 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff55863669", "parentcaller": "0x7fff55825399", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "18" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 29236 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff558636a1", "parentcaller": "0x7fff55825399", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "20" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 29237 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff558636e3", "parentcaller": "0x7fff55825399", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002524" } ], "repeated": 0, "id": 29238 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff558638e8", "parentcaller": "0x7fff55825399", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Classes\\CLSID\\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\\InProcServer32" }, { "name": "Handle", "value": "0x00002524" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\\InProcServer32" } ], "repeated": 0, "id": 29239 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002524" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "%SystemRoot%\\system32\\Windows.Storage.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{0E5AAE11-A475-4c5b-AB00-C66DE400274E}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 29240 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002524" }, { "name": "ValueName", "value": "LoadWithoutCOM" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{0E5AAE11-A475-4c5b-AB00-C66DE400274E}\\InProcServer32\\LoadWithoutCOM" } ], "repeated": 0, "id": 29241 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff5586397c", "parentcaller": "0x7fff55825399", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002524" } ], "repeated": 0, "id": 29242 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff558259d3", "parentcaller": "0x7fff55896922", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0E5AAE11-A475-4C5B-AB00-C66DE400274E" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 29243 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff58ac4404", "parentcaller": "0x7fff55896973", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000496" }, { "name": "SubKey", "value": "InitPropertyBag" }, { "name": "Handle", "value": "0x00002526" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance\\InitPropertyBag" } ], "repeated": 0, "id": 29244 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002526" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance\\InitPropertyBag\\Attributes" } ], "repeated": 0, "id": 29245 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002526" }, { "name": "ValueName", "value": "Attributes" }, { "name": "Data", "value": "17" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance\\InitPropertyBag\\Attributes" } ], "repeated": 0, "id": 29246 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002526" }, { "name": "ValueName", "value": "DescriptionID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance\\InitPropertyBag\\DescriptionID" } ], "repeated": 0, "id": 29247 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002526" }, { "name": "ValueName", "value": "HelpTopic" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance\\InitPropertyBag\\HelpTopic" } ], "repeated": 0, "id": 29248 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002526" }, { "name": "ValueName", "value": "AllowChildAliasRegistration" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance\\InitPropertyBag\\AllowChildAliasRegistration" } ], "repeated": 0, "id": 29249 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002526" }, { "name": "ValueName", "value": "RecursiveSearch" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance\\InitPropertyBag\\RecursiveSearch" } ], "repeated": 0, "id": 29250 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002526" }, { "name": "ValueName", "value": "TargetKnownFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance\\InitPropertyBag\\TargetKnownFolder" } ], "repeated": 0, "id": 29251 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b658", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002526" }, { "name": "ValueName", "value": "TargetKnownFolder" }, { "name": "Data", "value": "{5E6C858F-0E22-4760-9AFE-EA3317B67173}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance\\InitPropertyBag\\TargetKnownFolder" } ], "repeated": 0, "id": 29252 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff557c62cb", "parentcaller": "0x7fff558ac7c5", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance" } ], "repeated": 0, "id": 29253 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff557c6313", "parentcaller": "0x7fff558ac7c5", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance" }, { "name": "Handle", "value": "0x000024b4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance" } ], "repeated": 0, "id": 29254 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff557c6354", "parentcaller": "0x7fff558ac7c5", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000024b4" }, { "name": "SubKey", "value": "" }, { "name": "Handle", "value": "0x00002450" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance\\" } ], "repeated": 0, "id": 29255 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff557c63da", "parentcaller": "0x7fff558ac7c5", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" } ], "repeated": 0, "id": 29256 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff557c6396", "parentcaller": "0x7fff558ac7c5", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002450" }, { "name": "SubKey", "value": "" }, { "name": "Handle", "value": "0x000024b4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance\\" } ], "repeated": 0, "id": 29257 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff58ac4304", "parentcaller": "0x7fff58ac665a", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002526" } ], "repeated": 0, "id": 29258 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff5587d159", "parentcaller": "0x7fff5582531b", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002450" } ], "repeated": 0, "id": 29259 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff5587d14b", "parentcaller": "0x7fff5582531b", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000496" } ], "repeated": 0, "id": 29260 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff557b6c7e", "parentcaller": "0x7fff557b4414", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 29261 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff5582a695", "parentcaller": "0x7fff5582a024", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" } ], "repeated": 0, "id": 29262 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff55848063", "parentcaller": "0x7fff55848ae6", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" }, { "name": "Handle", "value": "0x000024b4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" } ], "repeated": 0, "id": 29263 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff558480b3", "parentcaller": "0x7fff55848ae6", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000024b4" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 29264 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff558480df", "parentcaller": "0x7fff55848ae6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" } ], "repeated": 0, "id": 29265 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff557b6c7e", "parentcaller": "0x7fff557b4414", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 3, "id": 29266 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff557c0016", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 29267 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff52874c3e", "parentcaller": "0x7fff52878a3f", "category": "system", "api": "GetUserDefaultLCID", "status": true, "return": "0x00000c09", "arguments": [ { "name": "SystemDefaultLangID", "value": "0x00000c09" }, { "name": "LanguageName", "value": "English (Australia)" } ], "repeated": 11, "id": 29268 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff432c690b", "parentcaller": "0x7fff432b67f7", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" }, { "name": "Handle", "value": "0x000026ac" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" } ], "repeated": 0, "id": 29269 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff432c6964", "parentcaller": "0x7fff432b67f7", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000026ac" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 29270 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff432c6990", "parentcaller": "0x7fff432b67f7", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 29271 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432baa24", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 29272 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432baa24", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 29273 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bc79b", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000026ac" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 29274 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bc7ca", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000024b4" } ], "repeated": 0, "id": 29275 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bc7fe", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "0\\xe7:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00`\\xda\\xd9\\xff\\xff\\xff\\xff\\xff^\\x16fK\\x07\\xef\\xdc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xda\\xd9\\xff\\xff\\xff\\xff\\xffH\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 29276 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bc8d0", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 29277 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8e4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" } ], "repeated": 0, "id": 29278 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 29279 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432baa73", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 29280 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432b9503", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 29281 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b953e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 29282 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432b95a7", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000494" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 29283 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432b95d8", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000026ac" } ], "repeated": 0, "id": 29284 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432b9610", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x10\\xe7:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00i\\xd5[\\x1a\\xff\\x7f\\x00\\x00\\xd0\\xe7:\\x03\\x00\\x00\\x00\\x00\\x10\r\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0fP\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9d|}\\x1a\\xff\\x7f\\x00\\x00(\\x8b}\\x1a\\xff\\x7f\\x00\\x00\\x10\r\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 29285 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432b96e3", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 29286 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b96f7", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 29287 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b9706", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 29288 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b9732", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" } ], "repeated": 0, "id": 29289 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432b9779", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 29290 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff432b9455", "parentcaller": "0x7fff432baae3", "category": "filesystem", "api": "GetDiskFreeSpaceExW", "status": true, "return": "0x00000001", "arguments": [ { "name": "DirectoryName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" } ], "repeated": 0, "id": 29291 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 29292 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 29293 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000024b4" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 29294 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000494" } ], "repeated": 0, "id": 29295 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe9:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00(\\xec:\\x03\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 29296 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 29297 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 29298 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" } ], "repeated": 0, "id": 29299 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 29300 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 29301 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 29302 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000026ac" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 29303 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000024b4" } ], "repeated": 0, "id": 29304 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xac&\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\x98\\x080y^t\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 29305 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 29306 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" } ], "repeated": 0, "id": 29307 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 29308 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 29309 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 29310 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 29311 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 29312 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000494" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 29313 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000026ac" } ], "repeated": 0, "id": 29314 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe9:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00(\\xec:\\x03\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 29315 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 29316 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 29317 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 29318 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 29319 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 29320 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" } ], "repeated": 0, "id": 29321 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000024b4" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 29322 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000494" } ], "repeated": 0, "id": 29323 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xac&\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\x98\\x080y^t\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 29324 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 29325 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 29326 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" } ], "repeated": 0, "id": 29327 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 29328 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 29329 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 29330 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 29331 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000026ac" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 29332 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000024b4" } ], "repeated": 0, "id": 29333 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe9:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00(\\xec:\\x03\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 29334 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 29335 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" } ], "repeated": 0, "id": 29336 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 29337 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 29338 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 29339 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 29340 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000494" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 29341 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000026ac" } ], "repeated": 0, "id": 29342 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xac&\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\x98\\x080y^t\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 29343 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 29344 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 29345 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 29346 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" } ], "repeated": 0, "id": 29347 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 29348 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 29349 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 29350 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000024b4" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 29351 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000494" } ], "repeated": 0, "id": 29352 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe9:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00(\\xec:\\x03\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 29353 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 29354 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 29355 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" } ], "repeated": 0, "id": 29356 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 29357 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 29358 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 29359 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000026ac" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 29360 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000024b4" } ], "repeated": 0, "id": 29361 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xac&\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\x98\\x080y^t\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 29362 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 29363 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" } ], "repeated": 0, "id": 29364 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 29365 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 29366 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 29367 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 29368 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 29369 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000494" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 29370 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000026ac" } ], "repeated": 0, "id": 29371 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe9:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00(\\xec:\\x03\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 29372 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 29373 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 29374 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 29375 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 29376 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 29377 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" } ], "repeated": 0, "id": 29378 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000024b4" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 29379 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000494" } ], "repeated": 0, "id": 29380 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xac&\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\x98\\x080y^t\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 29381 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 29382 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 29383 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" } ], "repeated": 0, "id": 29384 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 29385 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 29386 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 29387 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 29388 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000026ac" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 29389 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000024b4" } ], "repeated": 0, "id": 29390 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe9:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00(\\xec:\\x03\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 29391 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 29392 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" } ], "repeated": 0, "id": 29393 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 29394 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 29395 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 29396 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 29397 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000494" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 29398 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000026ac" } ], "repeated": 0, "id": 29399 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xac&\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\x98\\x080y^t\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 29400 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 29401 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 29402 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 29403 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" } ], "repeated": 0, "id": 29404 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 29405 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 29406 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 29407 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000024b4" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 29408 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000494" } ], "repeated": 0, "id": 29409 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe9:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00(\\xec:\\x03\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 29410 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 29411 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 29412 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" } ], "repeated": 0, "id": 29413 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 29414 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 29415 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 29416 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000026ac" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 29417 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000024b4" } ], "repeated": 0, "id": 29418 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xac&\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\x98\\x080y^t\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 29419 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 29420 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" } ], "repeated": 0, "id": 29421 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 29422 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 29423 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 29424 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 29425 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 29426 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000494" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 29427 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000026ac" } ], "repeated": 0, "id": 29428 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe9:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00(\\xec:\\x03\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 29429 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 29430 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 29431 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 29432 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 29433 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 29434 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" } ], "repeated": 0, "id": 29435 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000024b4" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 29436 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000494" } ], "repeated": 0, "id": 29437 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xac&\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\x98\\x080y^t\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 29438 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 29439 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 29440 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" } ], "repeated": 0, "id": 29441 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 29442 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 29443 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 29444 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 29445 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000026ac" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 29446 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000024b4" } ], "repeated": 0, "id": 29447 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe9:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00(\\xec:\\x03\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 29448 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 29449 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" } ], "repeated": 0, "id": 29450 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 29451 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 29452 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 29453 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 29454 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000494" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 29455 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000026ac" } ], "repeated": 0, "id": 29456 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xac&\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\x98\\x080y^t\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 29457 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 29458 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 29459 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 29460 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" } ], "repeated": 0, "id": 29461 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 29462 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 29463 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 29464 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000024b4" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 29465 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000494" } ], "repeated": 0, "id": 29466 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe9:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00(\\xec:\\x03\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 29467 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 29468 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 29469 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" } ], "repeated": 0, "id": 29470 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 29471 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 29472 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 29473 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000026ac" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 29474 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000024b4" } ], "repeated": 0, "id": 29475 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xac&\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\x98\\x080y^t\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 29476 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 29477 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" } ], "repeated": 0, "id": 29478 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 29479 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 29480 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 29481 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 29482 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 29483 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000494" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 29484 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000026ac" } ], "repeated": 0, "id": 29485 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe9:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00(\\xec:\\x03\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 29486 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 29487 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 29488 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 29489 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 29490 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 29491 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" } ], "repeated": 0, "id": 29492 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000024b4" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 29493 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000494" } ], "repeated": 0, "id": 29494 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xac&\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\x98\\x080y^t\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 29495 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 29496 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 29497 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" } ], "repeated": 0, "id": 29498 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 29499 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 29500 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 29501 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 29502 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000026ac" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 29503 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000024b4" } ], "repeated": 0, "id": 29504 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe9:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00(\\xec:\\x03\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 29505 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 29506 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" } ], "repeated": 0, "id": 29507 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 29508 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 29509 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 29510 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 29511 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000494" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 29512 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000026ac" } ], "repeated": 0, "id": 29513 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xac&\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\x98\\x080y^t\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 29514 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 29515 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 29516 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 29517 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" } ], "repeated": 0, "id": 29518 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 29519 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 29520 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 29521 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000024b4" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 29522 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000494" } ], "repeated": 0, "id": 29523 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe9:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00(\\xec:\\x03\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 29524 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 29525 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 29526 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" } ], "repeated": 0, "id": 29527 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 29528 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 29529 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 29530 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000026ac" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 29531 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000024b4" } ], "repeated": 0, "id": 29532 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xac&\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\x98\\x080y^t\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 29533 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 29534 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" } ], "repeated": 0, "id": 29535 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 29536 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 29537 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 29538 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff5780d897", "parentcaller": "0x7fff432b949c", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000d5c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00@\\x00\\x00\\x00\\x00\\x00\\x00`9\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 29539 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bc5ce", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 29540 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bc5ce", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 29541 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bc79b", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000494" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 29542 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bc7ca", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000026ac" } ], "repeated": 0, "id": 29543 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bc7fe", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xe0\\xe6:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00`\\xda\\xd9\\xff\\xff\\xff\\xff\\xff^\\x16fK\\x07\\xef\\xdc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xda\\xd9\\xff\\xff\\xff\\xff\\xffH\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\r\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 29544 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bc8d0", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 29545 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8e4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 29546 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 29547 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bc61a", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 29548 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bc669", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 29549 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc691", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" } ], "repeated": 0, "id": 29550 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bc79b", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000024b4" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 29551 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bc7ca", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000494" } ], "repeated": 0, "id": 29552 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bc7fe", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xe0\\xe6:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\xb4$\\x00\\x00\\x00\\x00\\x00\\x00\\xb4$\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x81|}\\x1a\\xff\\x7f\\x00\\x00(\\x8b}\\x1a\\xff\\x7f\\x00\\x00\\xb4$\\x00\\x00\\x00\\x00\\x00\\x00\\xb4$\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x85g}W\\xff\\x7f\\x00\\x00\\xb4$\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 29553 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bc8d0", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 29554 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8e4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 29555 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" } ], "repeated": 0, "id": 29556 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc6d4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 29557 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bc6f9", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 29558 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432c08f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d84" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 29559 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff5780d897", "parentcaller": "0x7fff432c0a96", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001c54" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 29560 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bbc69", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 29561 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bc79b", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000026ac" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 29562 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bc7ca", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000024b4" } ], "repeated": 0, "id": 29563 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bc7fe", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xe8:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xf7\\x8b\\x10\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00T\\x1c\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 29564 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bc8d0", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 29565 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8e4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" } ], "repeated": 0, "id": 29566 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 29567 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bbccd", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 29568 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff5780d897", "parentcaller": "0x7fff432bd729", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000d5c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00@\\x00\\x00\\x00\\x00\\x00\\x00`9\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 29569 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432b9392", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 29570 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bc79b", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000494" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 29571 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bc7ca", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000026ac" } ], "repeated": 0, "id": 29572 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bc7fe", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "p\\xe8:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00]\\xdd|W\\xff\\x7f\\x00\\x007\\x003\\x004\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x003N\\x0b\\xf8\\x1e)Lv4\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x92\\x93+C\\xff\\x7f\\x00\\x00" } ], "repeated": 0, "id": 29573 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bc8d0", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!4734" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 29574 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8e4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 29575 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 29576 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b6a3f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" } ], "repeated": 0, "id": 29577 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bbc69", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 29578 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bc79b", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000024b4" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 29579 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bc7ca", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000494" } ], "repeated": 0, "id": 29580 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bc7fe", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x10\\xe7:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x004\\x07&\\x13\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04m+C\\xff\\x7f\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 29581 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bc8d0", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 29582 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8e4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 29583 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" } ], "repeated": 0, "id": 29584 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bbccd", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 29585 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff5780d897", "parentcaller": "0x7fff432bd729", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000d5c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00@\\x00\\x00\\x00\\x00\\x00\\x00`9\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 29586 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432c084a", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 29587 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432c0a05", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d84" } ], "repeated": 0, "id": 29588 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff558b2b5a", "parentcaller": "0x7fff558658f2", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001011c" }, { "name": "Message", "value": "0x000004b5" } ], "repeated": 0, "id": 29589 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bbd54", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 29590 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bc79b", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000026ac" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 29591 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bc7ca", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000024b4" } ], "repeated": 0, "id": 29592 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bc7fe", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "@\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00s\\xb3\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa1[\\xf7Y\\xff\\x7f\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\x96\\xaa\\x0c\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 29593 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bc8d0", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 29594 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8e4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" } ], "repeated": 0, "id": 29595 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 29596 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bbd99", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 29597 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff5780d897", "parentcaller": "0x7fff432bd729", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000d5c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00@\\x00\\x00\\x00\\x00\\x00\\x00`9\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 29598 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432b9503", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 29599 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b953e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 29600 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432b95a7", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000494" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 29601 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432b95d8", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000026ac" } ], "repeated": 0, "id": 29602 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432b9610", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9d|}\\x1a\\xff\\x7f\\x00\\x00(\\x8b}\\x1a\\xff\\x7f\\x00\\x00\\x10\r\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\xf9\\x1d\\x01\\x00\\x00\\x00\\x00]\\xdd|W\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\x96\\xaa\\x0c\\x00\\x00\\x00\\x00\\xf9\\x7fN\\x0c\\xea[\\x00\\x00\\x18\\xf9\\x1d\\x01\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 29603 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432b96e3", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 29604 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b96f7", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 29605 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b9706", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 29606 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b9732", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" } ], "repeated": 0, "id": 29607 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432b9779", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 29608 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff432c690b", "parentcaller": "0x7fff432bb551", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" }, { "name": "Handle", "value": "0x000024b4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" } ], "repeated": 0, "id": 29609 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff432c6964", "parentcaller": "0x7fff432bb551", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000024b4" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 29610 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff432c6990", "parentcaller": "0x7fff432bb551", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" } ], "repeated": 0, "id": 29611 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff5585204d", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000024b4" } ], "repeated": 0, "id": 29612 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff558520a2", "parentcaller": "0x7fff55851f69", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "18" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 29613 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff55852301", "parentcaller": "0x7fff55851f69", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "20" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 29614 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5585211d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" } ], "repeated": 0, "id": 29615 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff58081596", "parentcaller": "0x7fff58ac668d", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": ".url" }, { "name": "Handle", "value": "0x000024b6" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\.url" } ], "repeated": 0, "id": 29616 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff5808ab55", "parentcaller": "0x7fff5585290f", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b6" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "InternetShortcut" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.URL\\(Default)" } ], "repeated": 0, "id": 29617 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff58ac3d65", "parentcaller": "0x7fff55854a2d", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000968" }, { "name": "SubKey", "value": ".url" }, { "name": "Handle", "value": "0x00000494" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.url" } ], "repeated": 0, "id": 29618 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff58081596", "parentcaller": "0x7fff58ac668d", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000494" }, { "name": "SubKey", "value": "" }, { "name": "Handle", "value": "0x000026ac" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.url\\" } ], "repeated": 0, "id": 29619 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff5808ad48", "parentcaller": "0x7fff55854f0b", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000026ac" }, { "name": "SubKey", "value": "UserChoice" }, { "name": "Handle", "value": "0x00002450" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.url\\UserChoice" } ], "repeated": 0, "id": 29620 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808ad83", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002450" }, { "name": "ValueName", "value": "ProgId" }, { "name": "Data", "value": "IE.AssocFile.URL" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.url\\UserChoice\\ProgId" } ], "repeated": 0, "id": 29621 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff5808ad91", "parentcaller": "0x7fff55854f0b", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002450" } ], "repeated": 0, "id": 29622 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000026ac" }, { "name": "SubKey", "value": "UserChoice" }, { "name": "Handle", "value": "0x00002450" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.url\\UserChoice" } ], "repeated": 0, "id": 29623 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002450" }, { "name": "ValueName", "value": "Hash" }, { "name": "Data", "value": "PUpA5B+kaOU=" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.url\\UserChoice\\Hash" } ], "repeated": 0, "id": 29624 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff5808ad91", "parentcaller": "0x7fff55854f4c", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002450" } ], "repeated": 0, "id": 29625 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff580a002a", "parentcaller": "0x7fff55854fb9", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000026ac" }, { "name": "SubKey", "value": "" }, { "name": "Handle", "value": "0x00002450" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.url\\" } ], "repeated": 0, "id": 29626 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff55856271", "parentcaller": "0x7fff55854fd0", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002450" }, { "name": "SubKey", "value": "UserChoice" }, { "name": "Handle", "value": "0x00002524" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.url\\UserChoice" } ], "repeated": 0, "id": 29627 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff558562bf", "parentcaller": "0x7fff55854fd0", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002524" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 29628 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff5585631b", "parentcaller": "0x7fff55854fd0", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002524" } ], "repeated": 0, "id": 29629 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff55856caa", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002524" } ], "repeated": 0, "id": 29630 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff55856bfb", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "0\\xf7\\xa4\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 29631 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff55856c23", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002524" } ], "repeated": 0, "id": 29632 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff558550f2", "parentcaller": "0x7fff55854ac6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002450" } ], "repeated": 0, "id": 29633 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff55854ad2", "parentcaller": "0x7fff55852e79", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 29634 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff58095eff", "parentcaller": "0x7fff580969fb", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 29635 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff558561ac", "parentcaller": "0x7fff55852f1e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "IE.AssocFile.URL" }, { "name": "Handle", "value": "0x000026ae" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\IE.AssocFile.URL" } ], "repeated": 0, "id": 29636 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff558561c9", "parentcaller": "0x7fff55852f1e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ae" } ], "repeated": 0, "id": 29637 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff55853405", "parentcaller": "0x7fff55852415", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "IE.AssocFile.URL" }, { "name": "Handle", "value": "0x000026ae" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\IE.AssocFile.URL" } ], "repeated": 0, "id": 29638 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000026ae" }, { "name": "KeyInformation", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\IE.AssocFile.URL" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 29639 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000026ae" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 1, "id": 29640 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000026ae" }, { "name": "ObjectAttributesName", "value": "CurVer" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\IE.AssocFile.URL\\CurVer" } ], "repeated": 0, "id": 29641 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\IE.AssocFile.URL\\CurVer" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\IE.AssocFile.URL\\CurVer" } ], "repeated": 0, "id": 29642 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff58081596", "parentcaller": "0x7fff58ac668d", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000026ae" }, { "name": "SubKey", "value": "" }, { "name": "Handle", "value": "0x00000496" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\IE.AssocFile.URL\\" } ], "repeated": 0, "id": 29643 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff55852456", "parentcaller": "0x7fff5585298d", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ae" } ], "repeated": 0, "id": 29644 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b51c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000496" }, { "name": "ValueName", "value": "IsShortcut" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\IE.AssocFile.URL\\IsShortcut" } ], "repeated": 0, "id": 29645 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000496" }, { "name": "KeyInformation", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\IE.AssocFile.URL" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 29646 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000496" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 1, "id": 29647 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000496" }, { "name": "ObjectAttributesName", "value": "ShellEx\\{000214F9-0000-0000-C000-000000000046}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\IE.AssocFile.URL\\ShellEx\\{000214F9-0000-0000-C000-000000000046}" } ], "repeated": 0, "id": 29648 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\IE.AssocFile.URL\\ShellEx\\{000214F9-0000-0000-C000-000000000046}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\IE.AssocFile.URL\\ShellEx\\{000214F9-0000-0000-C000-000000000046}" } ], "repeated": 0, "id": 29649 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000024b6" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\.URL" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 29650 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000024b6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 29651 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "`\\xca:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\xb6$\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xcb:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 29652 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\.URL\\ShellEx\\{000214F9-0000-0000-C000-000000000046}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\.URL\\ShellEx\\{000214F9-0000-0000-C000-000000000046}" } ], "repeated": 0, "id": 29653 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000024b6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 29654 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000026ac" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000024b6" }, { "name": "ObjectAttributesName", "value": "ShellEx\\{000214F9-0000-0000-C000-000000000046}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.URL\\ShellEx\\{000214F9-0000-0000-C000-000000000046}" } ], "repeated": 0, "id": 29655 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff58099041", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ae" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{FBF23B40-E3F0-101B-8488-00AA003E56F8}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.URL\\ShellEx\\{000214F9-0000-0000-C000-000000000046}\\(Default)" } ], "repeated": 0, "id": 29656 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d3018", "parentcaller": "0x7fff58099041", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ae" } ], "repeated": 0, "id": 29657 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff58095eff", "parentcaller": "0x7fff580969fb", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b6" } ], "repeated": 0, "id": 29658 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff58095eff", "parentcaller": "0x7fff580969fb", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000496" } ], "repeated": 0, "id": 29659 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff558499ce", "parentcaller": "0x7fff558498a0", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "CLSID\\{FBF23B40-E3F0-101B-8488-00AA003E56F8}" }, { "name": "Handle", "value": "0x00000496" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\CLSID\\{FBF23B40-E3F0-101B-8488-00AA003E56F8}" } ], "repeated": 0, "id": 29660 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff558498d6", "parentcaller": "0x7fff5584a964", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000496" }, { "name": "ValueName", "value": "DisableProcessIsolation" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\\DisableProcessIsolation" } ], "repeated": 0, "id": 29661 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff558498d6", "parentcaller": "0x7fff5584a990", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000496" }, { "name": "ValueName", "value": "NoOplock" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\\NoOplock" } ], "repeated": 0, "id": 29662 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff558499ce", "parentcaller": "0x7fff558498a0", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "ExplorerCLSIDFlags\\{FBF23B40-E3F0-101B-8488-00AA003E56F8}" }, { "name": "Handle", "value": "0x000024b6" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\ExplorerCLSIDFlags\\{FBF23B40-E3F0-101B-8488-00AA003E56F8}" } ], "repeated": 0, "id": 29663 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff558498d6", "parentcaller": "0x7fff5584a9a9", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b6" }, { "name": "ValueName", "value": "NoOplock" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\ExplorerCLSIDFlags\\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\\NoOplock" } ], "repeated": 0, "id": 29664 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff558498d6", "parentcaller": "0x7fff5584a9be", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000496" }, { "name": "ValueName", "value": "UseInProcHandlerCache" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\\UseInProcHandlerCache" } ], "repeated": 0, "id": 29665 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff558498d6", "parentcaller": "0x7fff5584a9d3", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000496" }, { "name": "ValueName", "value": "UseOutOfProcHandlerCache" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\\UseOutOfProcHandlerCache" } ], "repeated": 0, "id": 29666 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff55976124", "parentcaller": "0x7fff558344d2", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b6" } ], "repeated": 0, "id": 29667 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff5584a9f6", "parentcaller": "0x7fff558344d2", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000496" } ], "repeated": 0, "id": 29668 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff5587d014", "parentcaller": "0x7fff558252c1", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "CLSID\\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\\Instance" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\CLSID\\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\\Instance" } ], "repeated": 0, "id": 29669 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 29670 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff58be0000", "arguments": [ { "name": "lpLibFileName", "value": "shell32.dll" }, { "name": "dwFlags", "value": "0x00004000" } ], "repeated": 0, "id": 29671 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577dac31", "parentcaller": "0x7fff558258ff", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "SHELL32.dll" }, { "name": "ModuleHandle", "value": "0x7fff58be0000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff58c378f0" } ], "repeated": 0, "id": 29672 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff58c37b42", "parentcaller": "0x7fff5582592e", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "CLSID\\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\\Instance" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\CLSID\\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\\Instance" } ], "repeated": 0, "id": 29673 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff558635fc", "parentcaller": "0x7fff55825399", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000494" } ], "repeated": 0, "id": 29674 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff55863669", "parentcaller": "0x7fff55825399", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "18" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 29675 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff558636a1", "parentcaller": "0x7fff55825399", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "20" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 29676 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff558636e3", "parentcaller": "0x7fff55825399", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 29677 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff558638e8", "parentcaller": "0x7fff55825399", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Classes\\CLSID\\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\\InProcServer32" }, { "name": "Handle", "value": "0x00000494" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\\InProcServer32" } ], "repeated": 0, "id": 29678 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "C:\\Windows\\System32\\ieframe.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 29679 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "ValueName", "value": "LoadWithoutCOM" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\\InProcServer32\\LoadWithoutCOM" } ], "repeated": 0, "id": 29680 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff5586397c", "parentcaller": "0x7fff55825399", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 29681 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff55825882", "parentcaller": "0x7fff558495d3", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "FBF23B40-E3F0-101B-8488-00AA003E56F8" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "000214F9-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "InternetShortcut" } ], "repeated": 0, "id": 29682 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff5808b3e7", "parentcaller": "0x7fff558258a5", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ShellCompatibility\\Objects\\{FBF23B40-E3F0-101B-8488-00AA003E56F8}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ShellCompatibility\\Objects\\{FBF23B40-E3F0-101B-8488-00AA003E56F8}" } ], "repeated": 0, "id": 29683 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff413787e8", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "MutexName", "value": "Local\\InternetShortcutMutex" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 29684 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff41378810", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 29685 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff41378810", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "Milliseconds", "value": "10000" } ], "repeated": 0, "id": 29686 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff41396d8c", "parentcaller": "0x7fff41281ead", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "942BC614-676C-464E-B384-D3202AAA02DA" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000000-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 29687 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff41396d8c", "parentcaller": "0x7fff41378e23", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "06EEE834-461C-42C2-8DCF-1502B527B1F9" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "0000010B-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 29688 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff4136a287", "parentcaller": "0x7fff41378e41", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "4DFED3F9-B794-4D3C-973B-DDA1C28105A9" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "B7F02995-84DD-4F19-970A-1625E95C8BD0" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 29689 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff41761431", "parentcaller": "0x7fff4141a7ca", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 29690 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff413788ef", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 29691 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff4137890a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 29692 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff55848063", "parentcaller": "0x7fff55848ae6", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" }, { "name": "Handle", "value": "0x00000494" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" } ], "repeated": 0, "id": 29693 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff558480b3", "parentcaller": "0x7fff55848ae6", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000494" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 29694 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff558480df", "parentcaller": "0x7fff55848ae6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 29695 }, { "timestamp": "2026-05-29 01:05:52,305", "thread_id": "4668", "caller": "0x7fff41354ccb", "parentcaller": "0x7fff41354c34", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002526" } ], "repeated": 0, "id": 29696 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 29697 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000039e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 29698 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000039e" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 1, "id": 29699 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000039e" }, { "name": "ObjectAttributesName", "value": ".url" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\.url" } ], "repeated": 0, "id": 29700 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002488" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\.url" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\.url" } ], "repeated": 0, "id": 29701 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff58ac408f", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000248a" }, { "name": "ValueName", "value": "PerceivedType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.URL\\PerceivedType" } ], "repeated": 0, "id": 29702 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d3018", "parentcaller": "0x7fff58ac408f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000248a" } ], "repeated": 0, "id": 29703 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 29704 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000039e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 29705 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000039e" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 1, "id": 29706 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000039e" }, { "name": "ObjectAttributesName", "value": "SystemFileAssociations\\.url" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\SystemFileAssociations\\.url" } ], "repeated": 0, "id": 29707 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\SystemFileAssociations\\.url" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\SystemFileAssociations\\.url" } ], "repeated": 0, "id": 29708 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff52874c3e", "parentcaller": "0x7fff52878a3f", "category": "system", "api": "GetUserDefaultLCID", "status": true, "return": "0x00000c09", "arguments": [ { "name": "SystemDefaultLangID", "value": "0x00000c09" }, { "name": "LanguageName", "value": "English (Australia)" } ], "repeated": 1, "id": 29709 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432c5686", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 29710 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432c5686", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" }, { "name": "Milliseconds", "value": "600000" } ], "repeated": 0, "id": 29711 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 29712 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff432c5ded", "parentcaller": "0x7fff432c56be", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "AB8902B4-09CA-4BB6-B78D-A8F59079A8D5" }, { "name": "ClsContext", "value": "0x00004004", "pretty_value": "CLSCTX_LOCAL_SERVER|CLSCTX_NO_FAILURE_LOG" }, { "name": "riid", "value": "75121952-E0D0-43E5-9380-1D80483ACF72" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 29713 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff432c5d25", "parentcaller": "0x7fff432c56d1", "category": "system", "api": "CreateTimerQueueTimer", "status": true, "return": "0x00000001", "arguments": [ { "name": "phNewTimer", "value": "0x0cad51e0" }, { "name": "TimerQueue", "value": "0x00000000" }, { "name": "Callback", "value": "0x432ed350" }, { "name": "Parameter", "value": "0x033aea60" }, { "name": "DueTime", "value": "60000" }, { "name": "Period", "value": "1000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 29714 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xf9\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00<\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4668" } ], "repeated": 0, "id": 29715 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58085ee4", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002048" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 29716 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 29717 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 29718 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4620", "caller": "0x7fff59f86798", "parentcaller": "0x7fff5780ced6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 29719 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4620", "caller": "0x7fff59f867b9", "parentcaller": "0x7fff5780ced6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001128" } ], "repeated": 0, "id": 29720 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff5585204d", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002518" } ], "repeated": 0, "id": 29721 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 29722 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff558520a2", "parentcaller": "0x7fff55851f69", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "18" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 29723 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff55852301", "parentcaller": "0x7fff55851f69", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "20" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 29724 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5585211d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002518" } ], "repeated": 0, "id": 29725 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff58081596", "parentcaller": "0x7fff58ac668d", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": ".url" }, { "name": "Handle", "value": "0x0000251a" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\.url" } ], "repeated": 0, "id": 29726 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff5808ab55", "parentcaller": "0x7fff5585290f", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000251a" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "InternetShortcut" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.URL\\(Default)" } ], "repeated": 0, "id": 29727 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff58ac3d65", "parentcaller": "0x7fff55854a2d", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000968" }, { "name": "SubKey", "value": ".url" }, { "name": "Handle", "value": "0x00002414" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.url" } ], "repeated": 0, "id": 29728 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff58081596", "parentcaller": "0x7fff58ac668d", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002414" }, { "name": "SubKey", "value": "" }, { "name": "Handle", "value": "0x000025c4" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.url\\" } ], "repeated": 0, "id": 29729 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff5808ad48", "parentcaller": "0x7fff55854f0b", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000025c4" }, { "name": "SubKey", "value": "UserChoice" }, { "name": "Handle", "value": "0x00000f80" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.url\\UserChoice" } ], "repeated": 0, "id": 29730 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808ad83", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f80" }, { "name": "ValueName", "value": "ProgId" }, { "name": "Data", "value": "IE.AssocFile.URL" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.url\\UserChoice\\ProgId" } ], "repeated": 0, "id": 29731 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff5808ad91", "parentcaller": "0x7fff55854f0b", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f80" } ], "repeated": 0, "id": 29732 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff5808ad48", "parentcaller": "0x7fff55854f4c", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000025c4" }, { "name": "SubKey", "value": "UserChoice" }, { "name": "Handle", "value": "0x00000f80" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.url\\UserChoice" } ], "repeated": 0, "id": 29733 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808ad83", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f80" }, { "name": "ValueName", "value": "Hash" }, { "name": "Data", "value": "PUpA5B+kaOU=" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.url\\UserChoice\\Hash" } ], "repeated": 0, "id": 29734 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff5808ad91", "parentcaller": "0x7fff55854f4c", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f80" } ], "repeated": 0, "id": 29735 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff580a002a", "parentcaller": "0x7fff55854fb9", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000025c4" }, { "name": "SubKey", "value": "" }, { "name": "Handle", "value": "0x00000f80" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.url\\" } ], "repeated": 0, "id": 29736 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff55856271", "parentcaller": "0x7fff55854fd0", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000f80" }, { "name": "SubKey", "value": "UserChoice" }, { "name": "Handle", "value": "0x0000268c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.url\\UserChoice" } ], "repeated": 0, "id": 29737 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff558562bf", "parentcaller": "0x7fff55854fd0", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000268c" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 29738 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff5585631b", "parentcaller": "0x7fff55854fd0", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" } ], "repeated": 0, "id": 29739 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff55856caa", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000268c" } ], "repeated": 0, "id": 29740 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff55856bfb", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "0\\xf7\\xa4\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 29741 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff55856c23", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000268c" } ], "repeated": 0, "id": 29742 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff558550f2", "parentcaller": "0x7fff55854ac6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f80" } ], "repeated": 0, "id": 29743 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff55854ad2", "parentcaller": "0x7fff55852e79", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002414" } ], "repeated": 0, "id": 29744 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff58095eff", "parentcaller": "0x7fff580969fb", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025c4" } ], "repeated": 0, "id": 29745 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff558561ac", "parentcaller": "0x7fff55852f1e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "IE.AssocFile.URL" }, { "name": "Handle", "value": "0x000025c6" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\IE.AssocFile.URL" } ], "repeated": 0, "id": 29746 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff558561c9", "parentcaller": "0x7fff55852f1e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025c6" } ], "repeated": 0, "id": 29747 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff55853405", "parentcaller": "0x7fff55852415", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "IE.AssocFile.URL" }, { "name": "Handle", "value": "0x000025c6" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\IE.AssocFile.URL" } ], "repeated": 0, "id": 29748 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000025c6" }, { "name": "KeyInformation", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\IE.AssocFile.URL" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 29749 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000025c6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 1, "id": 29750 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000025c6" }, { "name": "ObjectAttributesName", "value": "CurVer" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\IE.AssocFile.URL\\CurVer" } ], "repeated": 0, "id": 29751 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\IE.AssocFile.URL\\CurVer" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\IE.AssocFile.URL\\CurVer" } ], "repeated": 0, "id": 29752 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff58081596", "parentcaller": "0x7fff58ac668d", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000025c6" }, { "name": "SubKey", "value": "" }, { "name": "Handle", "value": "0x00002416" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\IE.AssocFile.URL\\" } ], "repeated": 0, "id": 29753 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff55852456", "parentcaller": "0x7fff5585298d", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025c6" } ], "repeated": 0, "id": 29754 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b51c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002416" }, { "name": "ValueName", "value": "IsShortcut" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\IE.AssocFile.URL\\IsShortcut" } ], "repeated": 0, "id": 29755 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002416" }, { "name": "KeyInformation", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\IE.AssocFile.URL" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 29756 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002416" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 1, "id": 29757 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00002416" }, { "name": "ObjectAttributesName", "value": "ShellEx\\{e357fccd-a995-4576-b01f-234630154e96}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\IE.AssocFile.URL\\ShellEx\\{e357fccd-a995-4576-b01f-234630154e96}" } ], "repeated": 0, "id": 29758 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\IE.AssocFile.URL\\ShellEx\\{e357fccd-a995-4576-b01f-234630154e96}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\IE.AssocFile.URL\\ShellEx\\{e357fccd-a995-4576-b01f-234630154e96}" } ], "repeated": 0, "id": 29759 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000251a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\.URL" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 29760 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000251a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 29761 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xcc:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\x1a%\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\xcd:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 29762 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\.URL\\ShellEx\\{e357fccd-a995-4576-b01f-234630154e96}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\.URL\\ShellEx\\{e357fccd-a995-4576-b01f-234630154e96}" } ], "repeated": 0, "id": 29763 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000251a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 29764 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000251a" }, { "name": "ObjectAttributesName", "value": "ShellEx\\{e357fccd-a995-4576-b01f-234630154e96}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.URL\\ShellEx\\{e357fccd-a995-4576-b01f-234630154e96}" } ], "repeated": 0, "id": 29765 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff58081596", "parentcaller": "0x7fff58ac668d", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "*" }, { "name": "Handle", "value": "0x000025c6" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\*" } ], "repeated": 0, "id": 29766 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000025c6" }, { "name": "KeyInformation", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\*" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 29767 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000025c6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 1, "id": 29768 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000025c6" }, { "name": "ObjectAttributesName", "value": "ShellEx\\{e357fccd-a995-4576-b01f-234630154e96}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\*\\ShellEx\\{e357fccd-a995-4576-b01f-234630154e96}" } ], "repeated": 0, "id": 29769 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\*\\ShellEx\\{e357fccd-a995-4576-b01f-234630154e96}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\*\\ShellEx\\{e357fccd-a995-4576-b01f-234630154e96}" } ], "repeated": 0, "id": 29770 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff58081596", "parentcaller": "0x7fff58ac668d", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "AllFilesystemObjects" }, { "name": "Handle", "value": "0x00000f82" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\AllFilesystemObjects" } ], "repeated": 0, "id": 29771 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000f82" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 29772 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000f82" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 29773 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x10\\xcc:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\x82\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xcd:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 29774 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\AllFilesystemObjects\\ShellEx\\{e357fccd-a995-4576-b01f-234630154e96}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\AllFilesystemObjects\\ShellEx\\{e357fccd-a995-4576-b01f-234630154e96}" } ], "repeated": 0, "id": 29775 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000f82" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 29776 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000f82" }, { "name": "ObjectAttributesName", "value": "ShellEx\\{e357fccd-a995-4576-b01f-234630154e96}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\ShellEx\\{e357fccd-a995-4576-b01f-234630154e96}" } ], "repeated": 0, "id": 29777 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff58095eff", "parentcaller": "0x7fff580969fb", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000251a" } ], "repeated": 0, "id": 29778 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff58095eff", "parentcaller": "0x7fff580969fb", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002416" } ], "repeated": 0, "id": 29779 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff58095eff", "parentcaller": "0x7fff580969fb", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025c6" } ], "repeated": 0, "id": 29780 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff58095eff", "parentcaller": "0x7fff580969fb", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000f82" } ], "repeated": 0, "id": 29781 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xf9\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00<\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4668" } ], "repeated": 0, "id": 29782 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58085ee4", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002048" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 29783 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 29784 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 29785 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4620", "caller": "0x7fff59f86798", "parentcaller": "0x7fff5780ced6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000023a0" } ], "repeated": 0, "id": 29786 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4620", "caller": "0x7fff59f867b9", "parentcaller": "0x7fff5780ced6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001af0" } ], "repeated": 0, "id": 29787 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 29788 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff5585204d", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002524" } ], "repeated": 0, "id": 29789 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "18" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 29790 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff55852301", "parentcaller": "0x7fff55851f69", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "20" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 29791 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5585211d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002524" } ], "repeated": 0, "id": 29792 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff58081596", "parentcaller": "0x7fff58ac668d", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": ".url" }, { "name": "Handle", "value": "0x00002526" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\.url" } ], "repeated": 0, "id": 29793 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff5808ab55", "parentcaller": "0x7fff5585290f", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002526" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "InternetShortcut" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.URL\\(Default)" } ], "repeated": 0, "id": 29794 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff58ac3d65", "parentcaller": "0x7fff55854a2d", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000968" }, { "name": "SubKey", "value": ".url" }, { "name": "Handle", "value": "0x00000494" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.url" } ], "repeated": 0, "id": 29795 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff58081596", "parentcaller": "0x7fff58ac668d", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000494" }, { "name": "SubKey", "value": "" }, { "name": "Handle", "value": "0x000026ac" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.url\\" } ], "repeated": 0, "id": 29796 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff5808ad48", "parentcaller": "0x7fff55854f0b", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000026ac" }, { "name": "SubKey", "value": "UserChoice" }, { "name": "Handle", "value": "0x000024b4" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.url\\UserChoice" } ], "repeated": 0, "id": 29797 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808ad83", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" }, { "name": "ValueName", "value": "ProgId" }, { "name": "Data", "value": "IE.AssocFile.URL" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.url\\UserChoice\\ProgId" } ], "repeated": 0, "id": 29798 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff5808ad91", "parentcaller": "0x7fff55854f0b", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" } ], "repeated": 0, "id": 29799 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff5808ad48", "parentcaller": "0x7fff55854f4c", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000026ac" }, { "name": "SubKey", "value": "UserChoice" }, { "name": "Handle", "value": "0x000024b4" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.url\\UserChoice" } ], "repeated": 0, "id": 29800 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808ad83", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" }, { "name": "ValueName", "value": "Hash" }, { "name": "Data", "value": "PUpA5B+kaOU=" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.url\\UserChoice\\Hash" } ], "repeated": 0, "id": 29801 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff5808ad91", "parentcaller": "0x7fff55854f4c", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" } ], "repeated": 0, "id": 29802 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff580a002a", "parentcaller": "0x7fff55854fb9", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000026ac" }, { "name": "SubKey", "value": "" }, { "name": "Handle", "value": "0x000024b4" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.url\\" } ], "repeated": 0, "id": 29803 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff55856271", "parentcaller": "0x7fff55854fd0", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000024b4" }, { "name": "SubKey", "value": "UserChoice" }, { "name": "Handle", "value": "0x00002450" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.url\\UserChoice" } ], "repeated": 0, "id": 29804 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff558562bf", "parentcaller": "0x7fff55854fd0", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002450" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 29805 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff5585631b", "parentcaller": "0x7fff55854fd0", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002450" } ], "repeated": 0, "id": 29806 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff55856caa", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002450" } ], "repeated": 0, "id": 29807 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff55856bfb", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xe0O\\xa5\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 29808 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff55856c23", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002450" } ], "repeated": 0, "id": 29809 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff558550f2", "parentcaller": "0x7fff55854ac6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" } ], "repeated": 0, "id": 29810 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff55854ad2", "parentcaller": "0x7fff55852e79", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 29811 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff58095eff", "parentcaller": "0x7fff580969fb", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 29812 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff558561ac", "parentcaller": "0x7fff55852f1e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "IE.AssocFile.URL" }, { "name": "Handle", "value": "0x000026ae" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\IE.AssocFile.URL" } ], "repeated": 0, "id": 29813 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff558561c9", "parentcaller": "0x7fff55852f1e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ae" } ], "repeated": 0, "id": 29814 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff55853405", "parentcaller": "0x7fff55852415", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "IE.AssocFile.URL" }, { "name": "Handle", "value": "0x000026ae" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\IE.AssocFile.URL" } ], "repeated": 0, "id": 29815 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000026ae" }, { "name": "KeyInformation", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\IE.AssocFile.URL" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 29816 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000026ae" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 1, "id": 29817 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000026ae" }, { "name": "ObjectAttributesName", "value": "CurVer" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\IE.AssocFile.URL\\CurVer" } ], "repeated": 0, "id": 29818 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\IE.AssocFile.URL\\CurVer" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\IE.AssocFile.URL\\CurVer" } ], "repeated": 0, "id": 29819 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff58081596", "parentcaller": "0x7fff58ac668d", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000026ae" }, { "name": "SubKey", "value": "" }, { "name": "Handle", "value": "0x00000496" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\IE.AssocFile.URL\\" } ], "repeated": 0, "id": 29820 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff55852456", "parentcaller": "0x7fff5585298d", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ae" } ], "repeated": 0, "id": 29821 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b51c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000496" }, { "name": "ValueName", "value": "IsShortcut" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\IE.AssocFile.URL\\IsShortcut" } ], "repeated": 0, "id": 29822 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000496" }, { "name": "KeyInformation", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\IE.AssocFile.URL" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 29823 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000496" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 1, "id": 29824 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000496" }, { "name": "ObjectAttributesName", "value": "ShellEx\\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\IE.AssocFile.URL\\ShellEx\\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1}" } ], "repeated": 0, "id": 29825 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\IE.AssocFile.URL\\ShellEx\\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\IE.AssocFile.URL\\ShellEx\\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1}" } ], "repeated": 0, "id": 29826 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002526" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\.URL" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 29827 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002526" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 29828 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xd0\\xca:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00&%\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xcb:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 29829 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\.URL\\ShellEx\\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\.URL\\ShellEx\\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1}" } ], "repeated": 0, "id": 29830 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002526" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 29831 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00002526" }, { "name": "ObjectAttributesName", "value": "ShellEx\\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.URL\\ShellEx\\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1}" } ], "repeated": 0, "id": 29832 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff58081596", "parentcaller": "0x7fff58ac668d", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "*" }, { "name": "Handle", "value": "0x000026ae" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\*" } ], "repeated": 0, "id": 29833 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000026ae" }, { "name": "KeyInformation", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\*" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 29834 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000026ae" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 1, "id": 29835 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000026ae" }, { "name": "ObjectAttributesName", "value": "ShellEx\\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\*\\ShellEx\\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1}" } ], "repeated": 0, "id": 29836 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\*\\ShellEx\\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\*\\ShellEx\\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1}" } ], "repeated": 0, "id": 29837 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff58081596", "parentcaller": "0x7fff58ac668d", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "AllFilesystemObjects" }, { "name": "Handle", "value": "0x000024b6" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\AllFilesystemObjects" } ], "repeated": 0, "id": 29838 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000024b6" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 29839 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000024b6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 29840 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xc0\\xca:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\xb6$\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\xcb:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 29841 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\AllFilesystemObjects\\ShellEx\\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\AllFilesystemObjects\\ShellEx\\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1}" } ], "repeated": 0, "id": 29842 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000024b6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 29843 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000024b6" }, { "name": "ObjectAttributesName", "value": "ShellEx\\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\ShellEx\\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1}" } ], "repeated": 0, "id": 29844 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff58095eff", "parentcaller": "0x7fff580969fb", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002526" } ], "repeated": 0, "id": 29845 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff58095eff", "parentcaller": "0x7fff580969fb", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000496" } ], "repeated": 0, "id": 29846 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff58095eff", "parentcaller": "0x7fff580969fb", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ae" } ], "repeated": 0, "id": 29847 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff58095eff", "parentcaller": "0x7fff580969fb", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b6" } ], "repeated": 0, "id": 29848 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 29849 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000c7c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 29850 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432cbf4b", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" } ], "repeated": 0, "id": 29851 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff5587d014", "parentcaller": "0x7fff558252c1", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "CLSID\\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\\Instance" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\CLSID\\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\\Instance" } ], "repeated": 0, "id": 29852 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 29853 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff58be0000", "arguments": [ { "name": "lpLibFileName", "value": "shell32.dll" }, { "name": "dwFlags", "value": "0x00004000" } ], "repeated": 0, "id": 29854 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577dac31", "parentcaller": "0x7fff558258ff", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "SHELL32.dll" }, { "name": "ModuleHandle", "value": "0x7fff58be0000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff58c378f0" } ], "repeated": 0, "id": 29855 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff58c37b42", "parentcaller": "0x7fff5582592e", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "CLSID\\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\\Instance" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\CLSID\\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\\Instance" } ], "repeated": 0, "id": 29856 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff558635fc", "parentcaller": "0x7fff55825399", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002488" } ], "repeated": 0, "id": 29857 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff55863669", "parentcaller": "0x7fff55825399", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "18" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 29858 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff558636a1", "parentcaller": "0x7fff55825399", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "20" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 29859 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff558636e3", "parentcaller": "0x7fff55825399", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" } ], "repeated": 0, "id": 29860 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff558638e8", "parentcaller": "0x7fff55825399", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Classes\\CLSID\\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\\InProcServer32" }, { "name": "Handle", "value": "0x00002488" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\\InProcServer32" } ], "repeated": 0, "id": 29861 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "C:\\Windows\\System32\\ieframe.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 29862 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" }, { "name": "ValueName", "value": "LoadWithoutCOM" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\\InProcServer32\\LoadWithoutCOM" } ], "repeated": 0, "id": 29863 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff5586397c", "parentcaller": "0x7fff55825399", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" } ], "repeated": 0, "id": 29864 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff55825882", "parentcaller": "0x7fff558495d3", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "FBF23B40-E3F0-101B-8488-00AA003E56F8" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "000214F9-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "InternetShortcut" } ], "repeated": 0, "id": 29865 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff5808b3e7", "parentcaller": "0x7fff558258a5", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ShellCompatibility\\Objects\\{FBF23B40-E3F0-101B-8488-00AA003E56F8}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ShellCompatibility\\Objects\\{FBF23B40-E3F0-101B-8488-00AA003E56F8}" } ], "repeated": 0, "id": 29866 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff413787e8", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" }, { "name": "MutexName", "value": "Local\\InternetShortcutMutex" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 29867 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff41378810", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 29868 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff41378810", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" }, { "name": "Milliseconds", "value": "10000" } ], "repeated": 0, "id": 29869 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff41396d8c", "parentcaller": "0x7fff41281ead", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "942BC614-676C-464E-B384-D3202AAA02DA" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000000-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 29870 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff41396d8c", "parentcaller": "0x7fff41378e23", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "06EEE834-461C-42C2-8DCF-1502B527B1F9" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "0000010B-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 29871 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff4136a287", "parentcaller": "0x7fff41378e41", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "4DFED3F9-B794-4D3C-973B-DDA1C28105A9" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "B7F02995-84DD-4F19-970A-1625E95C8BD0" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 29872 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff41761431", "parentcaller": "0x7fff4141a7ca", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 29873 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff413788ef", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" } ], "repeated": 0, "id": 29874 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff4137890a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" } ], "repeated": 0, "id": 29875 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff55848063", "parentcaller": "0x7fff55848ae6", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" }, { "name": "Handle", "value": "0x00002488" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" } ], "repeated": 0, "id": 29876 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff558480b3", "parentcaller": "0x7fff55848ae6", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002488" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 29877 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff558480df", "parentcaller": "0x7fff55848ae6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" } ], "repeated": 0, "id": 29878 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff41354ccb", "parentcaller": "0x7fff41354c34", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002526" } ], "repeated": 0, "id": 29879 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff52874c3e", "parentcaller": "0x7fff52878a3f", "category": "system", "api": "GetUserDefaultLCID", "status": true, "return": "0x00000c09", "arguments": [ { "name": "SystemDefaultLangID", "value": "0x00000c09" }, { "name": "LanguageName", "value": "English (Australia)" } ], "repeated": 1, "id": 29880 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff432c690b", "parentcaller": "0x7fff432b67f7", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" }, { "name": "Handle", "value": "0x00002524" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" } ], "repeated": 0, "id": 29881 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff432c6964", "parentcaller": "0x7fff432b67f7", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002524" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 29882 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff432c6990", "parentcaller": "0x7fff432b67f7", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002524" } ], "repeated": 0, "id": 29883 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432baa24", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 29884 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432baa24", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 29885 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bc79b", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002524" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 29886 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bc7ca", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002488" } ], "repeated": 0, "id": 29887 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bc7fe", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "0\\xe7:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00`\\xda\\xd9\\xff\\xff\\xff\\xff\\xff\\xe3zhK\\x07\\xef\\xdc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xda\\xd9\\xff\\xff\\xff\\xff\\xffH\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 29888 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bc8d0", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 29889 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8e4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" } ], "repeated": 0, "id": 29890 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002524" } ], "repeated": 0, "id": 29891 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432baa73", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 29892 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432b9503", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 29893 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b953e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 29894 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432b95a7", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000026ac" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 29895 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432b95d8", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002524" } ], "repeated": 0, "id": 29896 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432b9610", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x10\\xe7:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00i\\xd5[\\x1a\\xff\\x7f\\x00\\x00\\xd0\\xe7:\\x03\\x00\\x00\\x00\\x00\\x10\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0fP\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9d|}\\x1a\\xff\\x7f\\x00\\x00(\\x8b}\\x1a\\xff\\x7f\\x00\\x00\\x10\r\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 29897 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432b96e3", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 29898 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b96f7", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002524" } ], "repeated": 0, "id": 29899 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b9706", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 29900 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b9732", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" } ], "repeated": 0, "id": 29901 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432b9779", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 29902 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff432b9455", "parentcaller": "0x7fff432baae3", "category": "filesystem", "api": "GetDiskFreeSpaceExW", "status": true, "return": "0x00000001", "arguments": [ { "name": "DirectoryName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" } ], "repeated": 0, "id": 29903 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 29904 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 29905 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002488" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 29906 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000026ac" } ], "repeated": 0, "id": 29907 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe9:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00\\xfe\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00(\\xec:\\x03\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 29908 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002524" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 29909 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 29910 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" } ], "repeated": 0, "id": 29911 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 29912 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 29913 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002524" } ], "repeated": 0, "id": 29914 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002524" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 29915 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002488" } ], "repeated": 0, "id": 29916 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff$%\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\x98\\x080y^t\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfe\\xff\\xff\\xff\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 29917 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 29918 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" } ], "repeated": 0, "id": 29919 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002524" } ], "repeated": 0, "id": 29920 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 29921 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 29922 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 29923 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 29924 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000026ac" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 29925 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002524" } ], "repeated": 0, "id": 29926 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe9:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00\\xfe\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00(\\xec:\\x03\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 29927 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 29928 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002524" } ], "repeated": 0, "id": 29929 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 29930 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 29931 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 29932 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" } ], "repeated": 0, "id": 29933 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002488" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 29934 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000026ac" } ], "repeated": 0, "id": 29935 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff$%\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\x98\\x080y^t\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfe\\xff\\xff\\xff\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 29936 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002524" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 29937 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 29938 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" } ], "repeated": 0, "id": 29939 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002524" } ], "repeated": 0, "id": 29940 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 29941 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 29942 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 29943 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002524" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 29944 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002488" } ], "repeated": 0, "id": 29945 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe9:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00\\xfe\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00(\\xec:\\x03\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 29946 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 29947 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" } ], "repeated": 0, "id": 29948 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002524" } ], "repeated": 0, "id": 29949 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 29950 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 29951 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 29952 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000026ac" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 29953 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002524" } ], "repeated": 0, "id": 29954 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff$%\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\x98\\x080y^t\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfe\\xff\\xff\\xff\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 29955 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 29956 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002524" } ], "repeated": 0, "id": 29957 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 29958 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" } ], "repeated": 0, "id": 29959 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 29960 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 29961 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 29962 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002488" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 29963 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000026ac" } ], "repeated": 0, "id": 29964 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe9:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00\\xfe\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00(\\xec:\\x03\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 29965 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002524" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 29966 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 29967 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" } ], "repeated": 0, "id": 29968 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 29969 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 29970 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002524" } ], "repeated": 0, "id": 29971 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002524" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 29972 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002488" } ], "repeated": 0, "id": 29973 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff$%\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\x98\\x080y^t\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfe\\xff\\xff\\xff\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 29974 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 29975 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" } ], "repeated": 0, "id": 29976 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002524" } ], "repeated": 0, "id": 29977 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 29978 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 29979 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 29980 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 29981 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000026ac" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 29982 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002524" } ], "repeated": 0, "id": 29983 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe9:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00\\xfe\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00(\\xec:\\x03\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 29984 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 29985 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002524" } ], "repeated": 0, "id": 29986 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 29987 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 29988 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 29989 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" } ], "repeated": 0, "id": 29990 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002488" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 29991 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000026ac" } ], "repeated": 0, "id": 29992 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff$%\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\x98\\x080y^t\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfe\\xff\\xff\\xff\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 29993 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002524" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 29994 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 29995 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" } ], "repeated": 0, "id": 29996 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002524" } ], "repeated": 0, "id": 29997 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 29998 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 29999 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 30000 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002524" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 30001 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002488" } ], "repeated": 0, "id": 30002 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe9:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00\\xfe\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00(\\xec:\\x03\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 30003 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 30004 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" } ], "repeated": 0, "id": 30005 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002524" } ], "repeated": 0, "id": 30006 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 30007 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 30008 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 30009 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000026ac" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 30010 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002524" } ], "repeated": 0, "id": 30011 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff$%\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\x98\\x080y^t\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfe\\xff\\xff\\xff\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 30012 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 30013 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002524" } ], "repeated": 0, "id": 30014 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 30015 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" } ], "repeated": 0, "id": 30016 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 30017 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 30018 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 30019 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002488" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 30020 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000026ac" } ], "repeated": 0, "id": 30021 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe9:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00\\xfe\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00(\\xec:\\x03\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 30022 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002524" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 30023 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 30024 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" } ], "repeated": 0, "id": 30025 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 30026 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 30027 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002524" } ], "repeated": 0, "id": 30028 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002524" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 30029 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002488" } ], "repeated": 0, "id": 30030 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff$%\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\x98\\x080y^t\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfe\\xff\\xff\\xff\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 30031 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 30032 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" } ], "repeated": 0, "id": 30033 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002524" } ], "repeated": 0, "id": 30034 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 30035 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 30036 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 30037 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 30038 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000026ac" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 30039 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002524" } ], "repeated": 0, "id": 30040 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe9:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00\\xfe\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00(\\xec:\\x03\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 30041 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 30042 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002524" } ], "repeated": 0, "id": 30043 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 30044 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 30045 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 30046 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" } ], "repeated": 0, "id": 30047 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002488" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 30048 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000026ac" } ], "repeated": 0, "id": 30049 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff$%\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\x98\\x080y^t\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfe\\xff\\xff\\xff\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 30050 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002524" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 30051 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 30052 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" } ], "repeated": 0, "id": 30053 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002524" } ], "repeated": 0, "id": 30054 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 30055 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 30056 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 30057 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002524" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 30058 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002488" } ], "repeated": 0, "id": 30059 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe9:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00\\xfe\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00(\\xec:\\x03\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 30060 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 30061 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" } ], "repeated": 0, "id": 30062 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002524" } ], "repeated": 0, "id": 30063 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 30064 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 30065 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 30066 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000026ac" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 30067 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002524" } ], "repeated": 0, "id": 30068 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff$%\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\x98\\x080y^t\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfe\\xff\\xff\\xff\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 30069 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 30070 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002524" } ], "repeated": 0, "id": 30071 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 30072 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" } ], "repeated": 0, "id": 30073 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 30074 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 30075 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 30076 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002488" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 30077 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000026ac" } ], "repeated": 0, "id": 30078 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe9:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00\\xfe\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00(\\xec:\\x03\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 30079 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002524" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 30080 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 30081 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" } ], "repeated": 0, "id": 30082 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 30083 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 30084 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002524" } ], "repeated": 0, "id": 30085 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002524" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 30086 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002488" } ], "repeated": 0, "id": 30087 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff$%\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\x98\\x080y^t\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfe\\xff\\xff\\xff\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 30088 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 30089 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" } ], "repeated": 0, "id": 30090 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002524" } ], "repeated": 0, "id": 30091 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 30092 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 30093 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 30094 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 30095 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000026ac" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 30096 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002524" } ], "repeated": 0, "id": 30097 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe9:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00\\xfe\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00(\\xec:\\x03\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 30098 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 30099 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002524" } ], "repeated": 0, "id": 30100 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 30101 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 30102 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 30103 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" } ], "repeated": 0, "id": 30104 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002488" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 30105 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000026ac" } ], "repeated": 0, "id": 30106 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff$%\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\x98\\x080y^t\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfe\\xff\\xff\\xff\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 30107 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002524" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 30108 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 30109 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" } ], "repeated": 0, "id": 30110 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002524" } ], "repeated": 0, "id": 30111 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 30112 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 30113 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 30114 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002524" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 30115 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002488" } ], "repeated": 0, "id": 30116 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe9:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00\\xfe\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00(\\xec:\\x03\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 30117 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 30118 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" } ], "repeated": 0, "id": 30119 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002524" } ], "repeated": 0, "id": 30120 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 30121 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 30122 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 30123 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000026ac" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 30124 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002524" } ], "repeated": 0, "id": 30125 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff$%\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\x98\\x080y^t\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfe\\xff\\xff\\xff\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 30126 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 30127 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002524" } ], "repeated": 0, "id": 30128 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 30129 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" } ], "repeated": 0, "id": 30130 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 30131 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 30132 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 30133 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002488" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 30134 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000026ac" } ], "repeated": 0, "id": 30135 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe9:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00\\xfe\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00(\\xec:\\x03\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 30136 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002524" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 30137 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 30138 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" } ], "repeated": 0, "id": 30139 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 30140 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 30141 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002524" } ], "repeated": 0, "id": 30142 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002524" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 30143 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002488" } ], "repeated": 0, "id": 30144 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff$%\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\x98\\x080y^t\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfe\\xff\\xff\\xff\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 30145 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 30146 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" } ], "repeated": 0, "id": 30147 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002524" } ], "repeated": 0, "id": 30148 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 30149 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 30150 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff5780d897", "parentcaller": "0x7fff432b949c", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000d5c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00@\\x00\\x00\\x00\\x00\\x00\\x00`9\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 30151 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bc5ce", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 30152 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bc5ce", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 30153 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bc79b", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000026ac" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 30154 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bc7ca", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002524" } ], "repeated": 0, "id": 30155 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bc7fe", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xe0\\xe6:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00`\\xda\\xd9\\xff\\xff\\xff\\xff\\xff\\xe3zhK\\x07\\xef\\xdc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xda\\xd9\\xff\\xff\\xff\\xff\\xffH\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\r\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 30156 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bc8d0", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 30157 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8e4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002524" } ], "repeated": 0, "id": 30158 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 30159 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bc61a", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 30160 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bc669", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 30161 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc691", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" } ], "repeated": 0, "id": 30162 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bc79b", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002488" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 30163 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bc7ca", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000026ac" } ], "repeated": 0, "id": 30164 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bc7fe", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xe0\\xe6:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x88$\\x00\\x00\\x00\\x00\\x00\\x00\\x88$\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x81|}\\x1a\\xff\\x7f\\x00\\x00(\\x8b}\\x1a\\xff\\x7f\\x00\\x00\\x88$\\x00\\x00\\x00\\x00\\x00\\x00\\x88$\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x85g}W\\xff\\x7f\\x00\\x00\\x88$\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 30165 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bc8d0", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002524" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 30166 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8e4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 30167 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" } ], "repeated": 0, "id": 30168 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc6d4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002524" } ], "repeated": 0, "id": 30169 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bc6f9", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 30170 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432c08f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d84" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 30171 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff5780d897", "parentcaller": "0x7fff432c0a96", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001c54" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 30172 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bbc69", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 30173 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bc79b", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002524" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 30174 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bc7ca", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002488" } ], "repeated": 0, "id": 30175 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bc7fe", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xe8:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xf7\\x8b\\x10\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00T\\x1c\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 30176 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bc8d0", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 30177 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8e4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" } ], "repeated": 0, "id": 30178 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002524" } ], "repeated": 0, "id": 30179 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bbccd", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 30180 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff5780d897", "parentcaller": "0x7fff432bd729", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000d5c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00@\\x00\\x00\\x00\\x00\\x00\\x00`9\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 30181 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432b9392", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 30182 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bc79b", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000026ac" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 30183 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bc7ca", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002524" } ], "repeated": 0, "id": 30184 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bc7fe", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "p\\xe8:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00]\\xdd|W\\xff\\x7f\\x00\\x005\\x00d\\x004\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00^\\xeeW\\xe2F\\xc0\\xf8[4\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x92\\x93+C\\xff\\x7f\\x00\\x00" } ], "repeated": 0, "id": 30185 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bc8d0", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!45d4" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 30186 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8e4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002524" } ], "repeated": 0, "id": 30187 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 30188 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b6a3f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" } ], "repeated": 0, "id": 30189 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bbc69", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 30190 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bc79b", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002488" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 30191 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bc7ca", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000026ac" } ], "repeated": 0, "id": 30192 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bc7fe", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x10\\xe7:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd4\\x05&\\x13\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04m+C\\xff\\x7f\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 30193 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bc8d0", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002524" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 30194 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8e4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 30195 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" } ], "repeated": 0, "id": 30196 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bbccd", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002524" } ], "repeated": 0, "id": 30197 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff5780d897", "parentcaller": "0x7fff432bd729", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000d5c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00@\\x00\\x00\\x00\\x00\\x00\\x00`9\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 30198 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432c084a", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 30199 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432c0a05", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d84" } ], "repeated": 0, "id": 30200 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff558b2b5a", "parentcaller": "0x7fff558658f2", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001011c" }, { "name": "Message", "value": "0x000004b5" } ], "repeated": 0, "id": 30201 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bbd54", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 30202 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bc79b", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002524" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 30203 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bc7ca", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002488" } ], "repeated": 0, "id": 30204 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bc7fe", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "@\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00s\\xb3\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa1[\\xf7Y\\xff\\x7f\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x83\\xaa\\x0c\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 30205 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bc8d0", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 30206 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8e4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" } ], "repeated": 0, "id": 30207 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002524" } ], "repeated": 0, "id": 30208 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bbd99", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 30209 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff5780d897", "parentcaller": "0x7fff432bd729", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000d5c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00@\\x00\\x00\\x00\\x00\\x00\\x00`9\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 30210 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432b9503", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 30211 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b953e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 30212 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432b95a7", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000026ac" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 30213 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432b95d8", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002524" } ], "repeated": 0, "id": 30214 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432b9610", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9d|}\\x1a\\xff\\x7f\\x00\\x00(\\x8b}\\x1a\\xff\\x7f\\x00\\x00\\x10\r\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\xf9\\x1d\\x01\\x00\\x00\\x00\\x00]\\xdd|W\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x83\\xaa\\x0c\\x00\\x00\\x00\\x00\\xf9\\x7fN\\x0c\\xea[\\x00\\x00\\x18\\xf9\\x1d\\x01\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 30215 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432b96e3", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 30216 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b96f7", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002524" } ], "repeated": 0, "id": 30217 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b9706", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 30218 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b9732", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" } ], "repeated": 0, "id": 30219 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff432c690b", "parentcaller": "0x7fff432bb551", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" }, { "name": "Handle", "value": "0x00002488" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" } ], "repeated": 0, "id": 30220 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff432c6964", "parentcaller": "0x7fff432bb551", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002488" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 30221 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff432c6990", "parentcaller": "0x7fff432bb551", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" } ], "repeated": 0, "id": 30222 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff5587d014", "parentcaller": "0x7fff558252c1", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "CLSID\\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\\Instance" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\CLSID\\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\\Instance" } ], "repeated": 0, "id": 30223 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 30224 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff58be0000", "arguments": [ { "name": "lpLibFileName", "value": "shell32.dll" }, { "name": "dwFlags", "value": "0x00004000" } ], "repeated": 0, "id": 30225 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577dac31", "parentcaller": "0x7fff558258ff", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "SHELL32.dll" }, { "name": "ModuleHandle", "value": "0x7fff58be0000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff58c378f0" } ], "repeated": 0, "id": 30226 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff58c37b42", "parentcaller": "0x7fff5582592e", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "CLSID\\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\\Instance" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\CLSID\\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\\Instance" } ], "repeated": 0, "id": 30227 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff558635fc", "parentcaller": "0x7fff55825399", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002488" } ], "repeated": 0, "id": 30228 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff55863669", "parentcaller": "0x7fff55825399", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "18" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 30229 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff558636a1", "parentcaller": "0x7fff55825399", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "20" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 30230 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff558636e3", "parentcaller": "0x7fff55825399", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" } ], "repeated": 0, "id": 30231 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff558638e8", "parentcaller": "0x7fff55825399", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Classes\\CLSID\\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\\InProcServer32" }, { "name": "Handle", "value": "0x00002488" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\\InProcServer32" } ], "repeated": 0, "id": 30232 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "C:\\Windows\\System32\\ieframe.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 30233 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" }, { "name": "ValueName", "value": "LoadWithoutCOM" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\\InProcServer32\\LoadWithoutCOM" } ], "repeated": 0, "id": 30234 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff5586397c", "parentcaller": "0x7fff55825399", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" } ], "repeated": 0, "id": 30235 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff55825882", "parentcaller": "0x7fff558495d3", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "FBF23B40-E3F0-101B-8488-00AA003E56F8" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "000214F9-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "InternetShortcut" } ], "repeated": 0, "id": 30236 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff5808b3e7", "parentcaller": "0x7fff558258a5", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ShellCompatibility\\Objects\\{FBF23B40-E3F0-101B-8488-00AA003E56F8}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ShellCompatibility\\Objects\\{FBF23B40-E3F0-101B-8488-00AA003E56F8}" } ], "repeated": 0, "id": 30237 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff413787e8", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" }, { "name": "MutexName", "value": "Local\\InternetShortcutMutex" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 30238 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff41378810", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 30239 }, { "timestamp": "2026-05-29 01:05:52,321", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff41378810", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" }, { "name": "Milliseconds", "value": "10000" } ], "repeated": 0, "id": 30240 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff41396d8c", "parentcaller": "0x7fff41281ead", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "942BC614-676C-464E-B384-D3202AAA02DA" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000000-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 30241 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff41396d8c", "parentcaller": "0x7fff41378e23", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "06EEE834-461C-42C2-8DCF-1502B527B1F9" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "0000010B-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 30242 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff4136a287", "parentcaller": "0x7fff41378e41", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "4DFED3F9-B794-4D3C-973B-DDA1C28105A9" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "B7F02995-84DD-4F19-970A-1625E95C8BD0" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 30243 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff41761431", "parentcaller": "0x7fff4141a7ca", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 30244 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff413788ef", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" } ], "repeated": 0, "id": 30245 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff4137890a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" } ], "repeated": 0, "id": 30246 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff55848063", "parentcaller": "0x7fff55848ae6", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" }, { "name": "Handle", "value": "0x00002488" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" } ], "repeated": 0, "id": 30247 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff558480b3", "parentcaller": "0x7fff55848ae6", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002488" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 30248 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff558480df", "parentcaller": "0x7fff55848ae6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002488" } ], "repeated": 0, "id": 30249 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff41354ccb", "parentcaller": "0x7fff41354c34", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000496" } ], "repeated": 0, "id": 30250 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff52874c3e", "parentcaller": "0x7fff52878a3f", "category": "system", "api": "GetUserDefaultLCID", "status": true, "return": "0x00000c09", "arguments": [ { "name": "SystemDefaultLangID", "value": "0x00000c09" }, { "name": "LanguageName", "value": "English (Australia)" } ], "repeated": 1, "id": 30251 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432c5686", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 30252 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432c5686", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "Milliseconds", "value": "600000" } ], "repeated": 0, "id": 30253 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 30254 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff432c5ded", "parentcaller": "0x7fff432c56be", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "AB8902B4-09CA-4BB6-B78D-A8F59079A8D5" }, { "name": "ClsContext", "value": "0x00004004", "pretty_value": "CLSCTX_LOCAL_SERVER|CLSCTX_NO_FAILURE_LOG" }, { "name": "riid", "value": "75121952-E0D0-43E5-9380-1D80483ACF72" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 30255 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff432c5d25", "parentcaller": "0x7fff432c56d1", "category": "system", "api": "CreateTimerQueueTimer", "status": true, "return": "0x00000001", "arguments": [ { "name": "phNewTimer", "value": "0x0cad5720" }, { "name": "TimerQueue", "value": "0x00000000" }, { "name": "Callback", "value": "0x432ed350" }, { "name": "Parameter", "value": "0x033aea60" }, { "name": "DueTime", "value": "60000" }, { "name": "Period", "value": "1000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 30256 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 30257 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff5853a7fb", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000c7c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 30258 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432cbf4b", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 30259 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff5587d014", "parentcaller": "0x7fff558252c1", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "CLSID\\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\\Instance" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\CLSID\\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\\Instance" } ], "repeated": 0, "id": 30260 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 30261 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff58be0000", "arguments": [ { "name": "lpLibFileName", "value": "shell32.dll" }, { "name": "dwFlags", "value": "0x00004000" } ], "repeated": 0, "id": 30262 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577dac31", "parentcaller": "0x7fff558258ff", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "SHELL32.dll" }, { "name": "ModuleHandle", "value": "0x7fff58be0000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff58c378f0" } ], "repeated": 0, "id": 30263 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff58c37b42", "parentcaller": "0x7fff5582592e", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "CLSID\\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\\Instance" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\CLSID\\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\\Instance" } ], "repeated": 0, "id": 30264 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff558635fc", "parentcaller": "0x7fff55825399", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000494" } ], "repeated": 0, "id": 30265 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff55863669", "parentcaller": "0x7fff55825399", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "18" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 30266 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff558636a1", "parentcaller": "0x7fff55825399", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "20" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 30267 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff558636e3", "parentcaller": "0x7fff55825399", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 30268 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff558638e8", "parentcaller": "0x7fff55825399", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Classes\\CLSID\\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\\InProcServer32" }, { "name": "Handle", "value": "0x00000494" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\\InProcServer32" } ], "repeated": 0, "id": 30269 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "C:\\Windows\\System32\\ieframe.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 30270 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "ValueName", "value": "LoadWithoutCOM" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\\InProcServer32\\LoadWithoutCOM" } ], "repeated": 0, "id": 30271 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff5586397c", "parentcaller": "0x7fff55825399", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 30272 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff55825882", "parentcaller": "0x7fff558495d3", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "FBF23B40-E3F0-101B-8488-00AA003E56F8" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "000214F9-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "InternetShortcut" } ], "repeated": 0, "id": 30273 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff5808b3e7", "parentcaller": "0x7fff558258a5", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ShellCompatibility\\Objects\\{FBF23B40-E3F0-101B-8488-00AA003E56F8}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ShellCompatibility\\Objects\\{FBF23B40-E3F0-101B-8488-00AA003E56F8}" } ], "repeated": 0, "id": 30274 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff413787e8", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "MutexName", "value": "Local\\InternetShortcutMutex" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 30275 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff41378810", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 30276 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff41378810", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "Milliseconds", "value": "10000" } ], "repeated": 0, "id": 30277 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff41396d8c", "parentcaller": "0x7fff41281ead", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "942BC614-676C-464E-B384-D3202AAA02DA" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000000-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 30278 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff41396d8c", "parentcaller": "0x7fff41378e23", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "06EEE834-461C-42C2-8DCF-1502B527B1F9" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "0000010B-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 30279 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff4136a287", "parentcaller": "0x7fff41378e41", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "4DFED3F9-B794-4D3C-973B-DDA1C28105A9" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "B7F02995-84DD-4F19-970A-1625E95C8BD0" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 30280 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff41761431", "parentcaller": "0x7fff4141a7ca", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 30281 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff413788ef", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 30282 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff4137890a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 30283 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff55848063", "parentcaller": "0x7fff55848ae6", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" }, { "name": "Handle", "value": "0x00000494" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" } ], "repeated": 0, "id": 30284 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff558480b3", "parentcaller": "0x7fff55848ae6", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000494" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 30285 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff558480df", "parentcaller": "0x7fff55848ae6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 30286 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff41354ccb", "parentcaller": "0x7fff41354c34", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022ae" } ], "repeated": 0, "id": 30287 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff52874c3e", "parentcaller": "0x7fff52878a3f", "category": "system", "api": "GetUserDefaultLCID", "status": true, "return": "0x00000c09", "arguments": [ { "name": "SystemDefaultLangID", "value": "0x00000c09" }, { "name": "LanguageName", "value": "English (Australia)" } ], "repeated": 1, "id": 30288 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff432c690b", "parentcaller": "0x7fff432b67f7", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" }, { "name": "Handle", "value": "0x000022ac" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" } ], "repeated": 0, "id": 30289 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff432c6964", "parentcaller": "0x7fff432b67f7", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000022ac" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 30290 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff432c6990", "parentcaller": "0x7fff432b67f7", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022ac" } ], "repeated": 0, "id": 30291 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432baa24", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 30292 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432baa24", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 30293 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bc79b", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000022ac" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 30294 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bc7ca", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000494" } ], "repeated": 0, "id": 30295 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bc7fe", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "0\\xe7:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00`\\xda\\xd9\\xff\\xff\\xff\\xff\\xffO\\xccjK\\x07\\xef\\xdc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xda\\xd9\\xff\\xff\\xff\\xff\\xffH\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 30296 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bc8d0", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 30297 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8e4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 30298 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022ac" } ], "repeated": 0, "id": 30299 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432baa73", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 30300 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432b9503", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 30301 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b953e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 30302 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432b95a7", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000242c" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 30303 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432b95d8", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000022ac" } ], "repeated": 0, "id": 30304 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432b9610", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x10\\xe7:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00i\\xd5[\\x1a\\xff\\x7f\\x00\\x00\\xd0\\xe7:\\x03\\x00\\x00\\x00\\x00\\x10\r\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0fP\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9d|}\\x1a\\xff\\x7f\\x00\\x00(\\x8b}\\x1a\\xff\\x7f\\x00\\x00\\x10\r\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 30305 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432b96e3", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 30306 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b96f7", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022ac" } ], "repeated": 0, "id": 30307 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b9706", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 30308 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b9732", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 30309 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432b9779", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 30310 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff432b9455", "parentcaller": "0x7fff432baae3", "category": "filesystem", "api": "GetDiskFreeSpaceExW", "status": true, "return": "0x00000001", "arguments": [ { "name": "DirectoryName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" } ], "repeated": 0, "id": 30311 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 30312 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 30313 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000494" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 30314 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000242c" } ], "repeated": 0, "id": 30315 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe9:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00\\xfe\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00(\\xec:\\x03\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 30316 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022ac" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 30317 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 30318 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 30319 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 30320 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 30321 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022ac" } ], "repeated": 0, "id": 30322 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000022ac" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 30323 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000494" } ], "repeated": 0, "id": 30324 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xac\"\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\x98\\x080y^t\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfe\\xff\\xff\\xff\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 30325 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 30326 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 30327 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022ac" } ], "repeated": 0, "id": 30328 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 30329 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 30330 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 30331 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 30332 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000242c" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 30333 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000022ac" } ], "repeated": 0, "id": 30334 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe9:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00\\xfe\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00(\\xec:\\x03\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 30335 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 30336 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022ac" } ], "repeated": 0, "id": 30337 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 30338 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 30339 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 30340 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 30341 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000494" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 30342 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000242c" } ], "repeated": 0, "id": 30343 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xac\"\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\x98\\x080y^t\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfe\\xff\\xff\\xff\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 30344 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022ac" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 30345 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 30346 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 30347 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022ac" } ], "repeated": 0, "id": 30348 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 30349 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 30350 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 30351 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000022ac" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 30352 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000494" } ], "repeated": 0, "id": 30353 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe9:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00\\xfe\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00(\\xec:\\x03\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 30354 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 30355 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 30356 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022ac" } ], "repeated": 0, "id": 30357 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 30358 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 30359 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 30360 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000242c" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 30361 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000022ac" } ], "repeated": 0, "id": 30362 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xac\"\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\x98\\x080y^t\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfe\\xff\\xff\\xff\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 30363 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 30364 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022ac" } ], "repeated": 0, "id": 30365 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 30366 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 30367 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 30368 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 30369 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 30370 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000494" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 30371 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000242c" } ], "repeated": 0, "id": 30372 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe9:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00\\xfe\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00(\\xec:\\x03\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 30373 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022ac" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 30374 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 30375 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 30376 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 30377 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 30378 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022ac" } ], "repeated": 0, "id": 30379 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000022ac" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 30380 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000494" } ], "repeated": 0, "id": 30381 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xac\"\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\x98\\x080y^t\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfe\\xff\\xff\\xff\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 30382 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 30383 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 30384 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022ac" } ], "repeated": 0, "id": 30385 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 30386 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 30387 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 30388 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 30389 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000242c" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 30390 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000022ac" } ], "repeated": 0, "id": 30391 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe9:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00\\xfe\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00(\\xec:\\x03\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 30392 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 30393 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022ac" } ], "repeated": 0, "id": 30394 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 30395 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 30396 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 30397 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 30398 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000494" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 30399 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000242c" } ], "repeated": 0, "id": 30400 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xac\"\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\x98\\x080y^t\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfe\\xff\\xff\\xff\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 30401 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022ac" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 30402 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 30403 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 30404 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022ac" } ], "repeated": 0, "id": 30405 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 30406 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 30407 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 30408 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000022ac" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 30409 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000494" } ], "repeated": 0, "id": 30410 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe9:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00\\xfe\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00(\\xec:\\x03\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 30411 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 30412 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 30413 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022ac" } ], "repeated": 0, "id": 30414 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 30415 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 30416 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 30417 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000242c" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 30418 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000022ac" } ], "repeated": 0, "id": 30419 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xac\"\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\x98\\x080y^t\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfe\\xff\\xff\\xff\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 30420 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 30421 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022ac" } ], "repeated": 0, "id": 30422 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 30423 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 30424 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 30425 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 30426 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 30427 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000494" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 30428 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000242c" } ], "repeated": 0, "id": 30429 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe9:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00\\xfe\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00(\\xec:\\x03\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 30430 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022ac" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 30431 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 30432 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 30433 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 30434 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 30435 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022ac" } ], "repeated": 0, "id": 30436 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000022ac" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 30437 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000494" } ], "repeated": 0, "id": 30438 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xac\"\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\x98\\x080y^t\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfe\\xff\\xff\\xff\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 30439 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 30440 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 30441 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022ac" } ], "repeated": 0, "id": 30442 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 30443 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 30444 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 30445 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 30446 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000242c" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 30447 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000022ac" } ], "repeated": 0, "id": 30448 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe9:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00\\xfe\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00(\\xec:\\x03\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 30449 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 30450 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022ac" } ], "repeated": 0, "id": 30451 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 30452 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 30453 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 30454 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 30455 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000494" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 30456 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000242c" } ], "repeated": 0, "id": 30457 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xac\"\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\x98\\x080y^t\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfe\\xff\\xff\\xff\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 30458 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022ac" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 30459 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 30460 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 30461 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022ac" } ], "repeated": 0, "id": 30462 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 30463 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 30464 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 30465 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000022ac" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 30466 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000494" } ], "repeated": 0, "id": 30467 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe9:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00\\xfe\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00(\\xec:\\x03\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 30468 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 30469 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 30470 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022ac" } ], "repeated": 0, "id": 30471 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 30472 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 30473 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 30474 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000242c" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 30475 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000022ac" } ], "repeated": 0, "id": 30476 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xac\"\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\x98\\x080y^t\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfe\\xff\\xff\\xff\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 30477 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 30478 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022ac" } ], "repeated": 0, "id": 30479 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 30480 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 30481 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 30482 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 30483 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 30484 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000494" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 30485 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000242c" } ], "repeated": 0, "id": 30486 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe9:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00\\xfe\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00(\\xec:\\x03\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 30487 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022ac" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 30488 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 30489 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 30490 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 30491 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 30492 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022ac" } ], "repeated": 0, "id": 30493 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000022ac" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 30494 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000494" } ], "repeated": 0, "id": 30495 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xac\"\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\x98\\x080y^t\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfe\\xff\\xff\\xff\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 30496 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 30497 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 30498 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022ac" } ], "repeated": 0, "id": 30499 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 30500 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 30501 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 30502 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 30503 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000242c" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 30504 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000022ac" } ], "repeated": 0, "id": 30505 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe9:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00\\xfe\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00(\\xec:\\x03\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 30506 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 30507 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022ac" } ], "repeated": 0, "id": 30508 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 30509 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 30510 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 30511 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 30512 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000494" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 30513 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000242c" } ], "repeated": 0, "id": 30514 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xac\"\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\x98\\x080y^t\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfe\\xff\\xff\\xff\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 30515 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022ac" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 30516 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 30517 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 30518 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022ac" } ], "repeated": 0, "id": 30519 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 30520 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 30521 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 30522 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000022ac" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 30523 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000494" } ], "repeated": 0, "id": 30524 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe9:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00\\xfe\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00(\\xec:\\x03\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 30525 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 30526 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 30527 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022ac" } ], "repeated": 0, "id": 30528 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 30529 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 30530 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 30531 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000242c" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 30532 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000022ac" } ], "repeated": 0, "id": 30533 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xac\"\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\x98\\x080y^t\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfe\\xff\\xff\\xff\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 30534 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 30535 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022ac" } ], "repeated": 0, "id": 30536 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 30537 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 30538 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 30539 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 30540 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bab59", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 30541 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432babb3", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000494" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 30542 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432babe2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000242c" } ], "repeated": 0, "id": 30543 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bac17", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe9:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xa8|\\x1a\\xff\\x7f\\x00\\x00AOY\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00\\xfe\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00(\\xec:\\x03\\x00\\x00\\x00\\x00\\xb9\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xec:\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 30544 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bace2", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022ac" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 30545 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bacf6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 30546 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bad05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 30547 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bad2c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 30548 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bad7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 30549 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022ac" } ], "repeated": 0, "id": 30550 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bade9", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000022ac" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 30551 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bae19", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000494" } ], "repeated": 0, "id": 30552 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bae57", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xac\"\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\x98\\x080y^t\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x80\\xed:\\x03\\x00\\x00\\x00\\x00\\xf0\\x94j\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfe\\xff\\xff\\xff\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 30553 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432baf31", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 30554 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf44", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 30555 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022ac" } ], "repeated": 0, "id": 30556 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432baf87", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 30557 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bafb0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 30558 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff5780d897", "parentcaller": "0x7fff432b949c", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000d5c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00@\\x00\\x00\\x00\\x00\\x00\\x00`9\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 30559 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bc5ce", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 30560 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bc5ce", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 30561 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bc79b", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000242c" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 30562 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bc7ca", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000022ac" } ], "repeated": 0, "id": 30563 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bc7fe", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xe0\\xe6:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00`\\xda\\xd9\\xff\\xff\\xff\\xff\\xffO\\xccjK\\x07\\xef\\xdc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xda\\xd9\\xff\\xff\\xff\\xff\\xffH\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\r\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 30564 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bc8d0", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 30565 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8e4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022ac" } ], "repeated": 0, "id": 30566 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 30567 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bc61a", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 30568 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bc669", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 30569 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc691", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 30570 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bc79b", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000494" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 30571 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bc7ca", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000242c" } ], "repeated": 0, "id": 30572 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bc7fe", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xe0\\xe6:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x9d\\x1a\\xff\\x7f\\x00\\x00\\x94\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x94\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x81|}\\x1a\\xff\\x7f\\x00\\x00(\\x8b}\\x1a\\xff\\x7f\\x00\\x00\\x94\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x94\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x85g}W\\xff\\x7f\\x00\\x00\\x94\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 30573 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bc8d0", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022ac" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 30574 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8e4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 30575 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 30576 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc6d4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022ac" } ], "repeated": 0, "id": 30577 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432bc6f9", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 30578 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432c08f5", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d84" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 30579 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff5780d897", "parentcaller": "0x7fff432c0a96", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001c54" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 30580 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bbc69", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 30581 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bc79b", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000022ac" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 30582 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bc7ca", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000494" } ], "repeated": 0, "id": 30583 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bc7fe", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xe8:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xf7\\x8b\\x10\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00T\\x1c\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 30584 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bc8d0", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 30585 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8e4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 30586 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022ac" } ], "repeated": 0, "id": 30587 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bbccd", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 30588 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff5780d897", "parentcaller": "0x7fff432bd729", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000d5c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00@\\x00\\x00\\x00\\x00\\x00\\x00`9\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 30589 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432b9392", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 30590 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bc79b", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000242c" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 30591 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bc7ca", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000022ac" } ], "repeated": 0, "id": 30592 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bc7fe", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "p\\xe8:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xea:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xf2:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00]\\xdd|W\\xff\\x7f\\x00\\x006\\x002\\x00c\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00J\\xefq\\xb0eg\\x9ce4\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x92\\x93+C\\xff\\x7f\\x00\\x00" } ], "repeated": 0, "id": 30593 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bc8d0", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!462c" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 30594 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8e4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022ac" } ], "repeated": 0, "id": 30595 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 30596 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432b6a3f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 30597 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff432bbc69", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 30598 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff432bc79b", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000494" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 30599 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff5781026b", "parentcaller": "0x7fff432bc7ca", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000242c" } ], "repeated": 0, "id": 30600 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff432bc7fe", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x10\\xe7:\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00,\\x06&\\x13\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04m+C\\xff\\x7f\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 30601 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577ced78", "parentcaller": "0x7fff432bc8d0", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022ac" }, { "name": "MutexName", "value": "Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 30602 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8e4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000242c" } ], "repeated": 0, "id": 30603 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bc8f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 30604 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff432bbccd", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022ac" } ], "repeated": 0, "id": 30605 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff5780d897", "parentcaller": "0x7fff432bd729", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000d5c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00@\\x00\\x00\\x00\\x00\\x00\\x00`9\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 30606 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432c084a", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d10" } ], "repeated": 0, "id": 30607 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff432c0a05", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000d84" } ], "repeated": 0, "id": 30608 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff558b2b5a", "parentcaller": "0x7fff558658f2", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001011c" }, { "name": "Message", "value": "0x000004b5" } ], "repeated": 0, "id": 30609 }, { "timestamp": "2026-05-29 01:05:52,337", "thread_id": "4668", "caller": "0x7fff577d6785", "parentcaller": "0x7fff557c403a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002354" } ], "repeated": 0, "id": 30610 }, { "timestamp": "2026-05-29 01:05:52,446", "thread_id": "2440", "caller": "0x7fff597abf07", "parentcaller": "0x7fff597abe66", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 30611 }, { "timestamp": "2026-05-29 01:05:52,446", "thread_id": "2440", "caller": "0x7fff59765bc1", "parentcaller": "0x7fff59765b34", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000023bc" } ], "repeated": 0, "id": 30612 }, { "timestamp": "2026-05-29 01:05:54,352", "thread_id": "5368", "caller": "0x7fff577ce76a", "parentcaller": "0x7fff584cea0e", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "oleaut32.dll" }, { "name": "ModuleHandle", "value": "0x7fff58860000" } ], "repeated": 0, "id": 30613 }, { "timestamp": "2026-05-29 01:05:54,352", "thread_id": "5368", "caller": "0x7fff5809b283", "parentcaller": "0x7fff58088b47", "category": "windows", "api": "PostThreadMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessId", "value": "4484" }, { "name": "ThreadId", "value": "4488" }, { "name": "Message", "value": "0" } ], "repeated": 1, "id": 30614 }, { "timestamp": "2026-05-29 01:05:54,352", "thread_id": "5368", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5809da8f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000016a4" } ], "repeated": 0, "id": 30615 }, { "timestamp": "2026-05-29 01:05:54,352", "thread_id": "5368", "caller": "0x7fff59fa467e", "parentcaller": "0x7fff5781f79a", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "12" }, { "name": "ThreadInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5368" } ], "repeated": 0, "id": 30616 }, { "timestamp": "2026-05-29 01:05:54,352", "thread_id": "5368", "caller": "0x7fff581815b8", "parentcaller": "0x7fff59f69a1d", "category": "misc", "api": "GetKeyboardLayout", "status": true, "return": "0x04090409", "arguments": [ { "name": "KeyboardLayout", "value": "0x00000409" }, { "name": "LanguageName", "value": "English (United States)" } ], "repeated": 0, "id": 30617 }, { "timestamp": "2026-05-29 01:05:54,352", "thread_id": "5368", "caller": "0x7fff59fa469e", "parentcaller": "0x7fff5781f79a", "category": "threading", "api": "NtTerminateThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00000000" }, { "name": "ExitStatus", "value": "0x00000000" }, { "name": "ThreadId", "value": "0" }, { "name": "ProcessId", "value": "0" } ], "repeated": 0, "id": 30618 }, { "timestamp": "2026-05-29 01:05:54,462", "thread_id": "4560", "caller": "0x7fff577ce76a", "parentcaller": "0x7fff584cea0e", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "oleaut32.dll" }, { "name": "ModuleHandle", "value": "0x7fff58860000" } ], "repeated": 0, "id": 30619 }, { "timestamp": "2026-05-29 01:05:54,462", "thread_id": "6148", "caller": "0x7fff5809b283", "parentcaller": "0x7fff58088b47", "category": "windows", "api": "PostThreadMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessId", "value": "4484" }, { "name": "ThreadId", "value": "4488" }, { "name": "Message", "value": "0" } ], "repeated": 2, "id": 30620 }, { "timestamp": "2026-05-29 01:05:54,462", "thread_id": "6148", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5809da8f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000017d8" } ], "repeated": 0, "id": 30621 }, { "timestamp": "2026-05-29 01:05:54,462", "thread_id": "4560", "caller": "0x7fff5809b283", "parentcaller": "0x7fff58088b47", "category": "windows", "api": "PostThreadMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessId", "value": "4484" }, { "name": "ThreadId", "value": "4488" }, { "name": "Message", "value": "0" } ], "repeated": 0, "id": 30622 }, { "timestamp": "2026-05-29 01:05:54,462", "thread_id": "4560", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5809da8f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab4" } ], "repeated": 0, "id": 30623 }, { "timestamp": "2026-05-29 01:05:54,493", "thread_id": "12852", "caller": "0x7fff577ce76a", "parentcaller": "0x7fff584cea0e", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "oleaut32.dll" }, { "name": "ModuleHandle", "value": "0x7fff58860000" } ], "repeated": 0, "id": 30624 }, { "timestamp": "2026-05-29 01:05:54,493", "thread_id": "12852", "caller": "0x7fff5809b283", "parentcaller": "0x7fff58088b47", "category": "windows", "api": "PostThreadMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessId", "value": "4484" }, { "name": "ThreadId", "value": "4488" }, { "name": "Message", "value": "0" } ], "repeated": 0, "id": 30625 }, { "timestamp": "2026-05-29 01:05:54,493", "thread_id": "12852", "caller": "0x7fff59fa467e", "parentcaller": "0x7fff5781f79a", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "12" }, { "name": "ThreadInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "12852" } ], "repeated": 0, "id": 30626 }, { "timestamp": "2026-05-29 01:05:54,493", "thread_id": "12852", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5854360c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002260" } ], "repeated": 0, "id": 30627 }, { "timestamp": "2026-05-29 01:05:54,493", "thread_id": "9572", "caller": "0x7fff577ce76a", "parentcaller": "0x7fff584cea0e", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "oleaut32.dll" }, { "name": "ModuleHandle", "value": "0x7fff58860000" } ], "repeated": 0, "id": 30628 }, { "timestamp": "2026-05-29 01:05:54,493", "thread_id": "9572", "caller": "0x7fff5809b283", "parentcaller": "0x7fff58088b47", "category": "windows", "api": "PostThreadMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessId", "value": "4484" }, { "name": "ThreadId", "value": "4488" }, { "name": "Message", "value": "0" } ], "repeated": 1, "id": 30629 }, { "timestamp": "2026-05-29 01:05:54,493", "thread_id": "9572", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5809da8f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001abc" } ], "repeated": 0, "id": 30630 }, { "timestamp": "2026-05-29 01:05:54,493", "thread_id": "9572", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5809da8f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ac0" } ], "repeated": 0, "id": 30631 }, { "timestamp": "2026-05-29 01:05:54,493", "thread_id": "9572", "caller": "0x7fff59fa467e", "parentcaller": "0x7fff5781f79a", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "12" }, { "name": "ThreadInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "9572" } ], "repeated": 0, "id": 30632 }, { "timestamp": "2026-05-29 01:05:54,493", "thread_id": "9572", "caller": "0x7fff59faeb32", "parentcaller": "0x7fff59f674ed", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000038" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 1, "id": 30633 }, { "timestamp": "2026-05-29 01:05:54,493", "thread_id": "12852", "caller": "0x7fff581815b8", "parentcaller": "0x7fff59f69a1d", "category": "misc", "api": "GetKeyboardLayout", "status": true, "return": "0x04090409", "arguments": [ { "name": "KeyboardLayout", "value": "0x00000409" }, { "name": "LanguageName", "value": "English (United States)" } ], "repeated": 0, "id": 30634 }, { "timestamp": "2026-05-29 01:05:54,493", "thread_id": "12852", "caller": "0x7fff577d6785", "parentcaller": "0x7fff597be41e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000237c" } ], "repeated": 0, "id": 30635 }, { "timestamp": "2026-05-29 01:05:54,493", "thread_id": "12852", "caller": "0x7fff577d6785", "parentcaller": "0x7fff597be4e4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 30636 }, { "timestamp": "2026-05-29 01:05:54,493", "thread_id": "12852", "caller": "0x7fff59fa469e", "parentcaller": "0x7fff5781f79a", "category": "threading", "api": "NtTerminateThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00000000" }, { "name": "ExitStatus", "value": "0x00000000" }, { "name": "ThreadId", "value": "0" }, { "name": "ProcessId", "value": "0" } ], "repeated": 0, "id": 30637 }, { "timestamp": "2026-05-29 01:05:54,493", "thread_id": "9572", "caller": "0x7fff581815b8", "parentcaller": "0x7fff59f69a1d", "category": "misc", "api": "GetKeyboardLayout", "status": true, "return": "0x04090409", "arguments": [ { "name": "KeyboardLayout", "value": "0x00000409" }, { "name": "LanguageName", "value": "English (United States)" } ], "repeated": 0, "id": 30638 }, { "timestamp": "2026-05-29 01:05:54,493", "thread_id": "9572", "caller": "0x7fff577d6785", "parentcaller": "0x7fff597be41e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab8" } ], "repeated": 0, "id": 30639 }, { "timestamp": "2026-05-29 01:05:54,493", "thread_id": "9572", "caller": "0x7fff59fa469e", "parentcaller": "0x7fff5781f79a", "category": "threading", "api": "NtTerminateThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00000000" }, { "name": "ExitStatus", "value": "0x00000000" }, { "name": "ThreadId", "value": "0" }, { "name": "ProcessId", "value": "0" } ], "repeated": 0, "id": 30640 }, { "timestamp": "2026-05-29 01:05:56,305", "thread_id": "4560", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbddbb", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000024c0" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "6136" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" } ], "repeated": 0, "id": 30641 }, { "timestamp": "2026-05-29 01:05:56,305", "thread_id": "4560", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbddbb", "category": "process", "api": "NtOpenProcess", "status": false, "return": "0xffffffffc0000022", "pretty_return": "ACCESS_DENIED", "arguments": [ { "name": "ProcessHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "1180" } ], "repeated": 0, "id": 30642 }, { "timestamp": "2026-05-29 01:05:56,305", "thread_id": "4560", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbddbb", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000024cc" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "5624" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" } ], "repeated": 0, "id": 30643 }, { "timestamp": "2026-05-29 01:05:56,305", "thread_id": "4560", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbddbb", "category": "process", "api": "NtOpenProcess", "status": false, "return": "0xffffffffc0000022", "pretty_return": "ACCESS_DENIED", "arguments": [ { "name": "ProcessHandle", "value": "0x000024cc" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "1048" } ], "repeated": 0, "id": 30644 }, { "timestamp": "2026-05-29 01:05:56,305", "thread_id": "4560", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbddbb", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002438" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 30645 }, { "timestamp": "2026-05-29 01:05:56,305", "thread_id": "4560", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbddbb", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000237c" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "12844" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" } ], "repeated": 0, "id": 30646 }, { "timestamp": "2026-05-29 01:05:56,305", "thread_id": "4560", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbddbb", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002260" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "5128" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" } ], "repeated": 0, "id": 30647 }, { "timestamp": "2026-05-29 01:05:56,305", "thread_id": "4560", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbddbb", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001acc" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "6400" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" } ], "repeated": 0, "id": 30648 }, { "timestamp": "2026-05-29 01:05:56,305", "thread_id": "4560", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\x11\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4560" } ], "repeated": 7, "id": 30649 }, { "timestamp": "2026-05-29 01:05:56,305", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 30650 }, { "timestamp": "2026-05-29 01:05:56,305", "thread_id": "4560", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\x11\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4560" } ], "repeated": 3, "id": 30651 }, { "timestamp": "2026-05-29 01:05:56,305", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 30652 }, { "timestamp": "2026-05-29 01:05:56,305", "thread_id": "4560", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\x11\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4560" } ], "repeated": 0, "id": 30653 }, { "timestamp": "2026-05-29 01:05:56,305", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 30654 }, { "timestamp": "2026-05-29 01:05:56,305", "thread_id": "4560", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\x11\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4560" } ], "repeated": 0, "id": 30655 }, { "timestamp": "2026-05-29 01:05:56,305", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 30656 }, { "timestamp": "2026-05-29 01:05:56,305", "thread_id": "4560", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\x11\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4560" } ], "repeated": 1, "id": 30657 }, { "timestamp": "2026-05-29 01:05:56,305", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 2, "id": 30658 }, { "timestamp": "2026-05-29 01:05:56,305", "thread_id": "4560", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\x11\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4560" } ], "repeated": 2, "id": 30659 }, { "timestamp": "2026-05-29 01:05:56,305", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 30660 }, { "timestamp": "2026-05-29 01:05:56,305", "thread_id": "4560", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\x11\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4560" } ], "repeated": 2, "id": 30661 }, { "timestamp": "2026-05-29 01:05:56,305", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 30662 }, { "timestamp": "2026-05-29 01:05:56,305", "thread_id": "4560", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\x11\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4560" } ], "repeated": 1, "id": 30663 }, { "timestamp": "2026-05-29 01:05:56,305", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 30664 }, { "timestamp": "2026-05-29 01:05:56,305", "thread_id": "4560", "caller": "0x7fff41dbe842", "parentcaller": "0x7fff59fc16e9", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002454" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "\\Device\\Bam" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 30665 }, { "timestamp": "2026-05-29 01:05:56,305", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 37, "id": 30666 }, { "timestamp": "2026-05-29 01:05:59,368", "thread_id": "6160", "caller": "0x7fff577ce76a", "parentcaller": "0x7fff584cea0e", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "oleaut32.dll" }, { "name": "ModuleHandle", "value": "0x7fff58860000" } ], "repeated": 0, "id": 30667 }, { "timestamp": "2026-05-29 01:05:59,368", "thread_id": "6160", "caller": "0x7fff5809b283", "parentcaller": "0x7fff58088b47", "category": "windows", "api": "PostThreadMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessId", "value": "4484" }, { "name": "ThreadId", "value": "4488" }, { "name": "Message", "value": "0" } ], "repeated": 1, "id": 30668 }, { "timestamp": "2026-05-29 01:06:00,008", "thread_id": "4696", "caller": "0x7ff79bc5652c", "parentcaller": "0x7ff79bc55d54", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\rsaenh.dll" }, { "name": "BaseAddress", "value": "0x7fff56630000" } ], "repeated": 0, "id": 30669 }, { "timestamp": "2026-05-29 01:06:00,008", "thread_id": "4696", "caller": "0x7ff79bc5652c", "parentcaller": "0x7ff79bc55d54", "category": "crypto", "api": "CryptAcquireContextW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Container", "value": "" }, { "name": "Provider", "value": "" }, { "name": "Flags", "value": "0xf0000000" } ], "repeated": 0, "id": 30670 }, { "timestamp": "2026-05-29 01:06:00,008", "thread_id": "4696", "caller": "0x7ff79bc5655a", "parentcaller": "0x7ff79bc55d54", "category": "crypto", "api": "CryptCreateHash", "status": true, "return": "0x00000001", "arguments": [ { "name": "Algid", "value": "0x00008003", "pretty_value": "MD5" }, { "name": "CryptKey", "value": "0x00000000" }, { "name": "Hash object", "value": "0x0cb36290" } ], "repeated": 0, "id": 30671 }, { "timestamp": "2026-05-29 01:06:00,008", "thread_id": "4696", "caller": "0x7ff79bc565a5", "parentcaller": "0x7ff79bc55d54", "category": "crypto", "api": "CryptHashData", "status": true, "return": "0x00000001", "arguments": [ { "name": "CryptHash", "value": "0x0cb36290" }, { "name": "Buffer", "value": "{\\x007\\x00C\\x005\\x00A\\x004\\x000\\x00E\\x00F\\x00-\\x00A\\x000\\x00F\\x00B\\x00-\\x004\\x00B\\x00F\\x00C\\x00-\\x008\\x007\\x004\\x00A\\x00-\\x00C\\x000\\x00F\\x002\\x00E\\x000\\x00B\\x009\\x00F\\x00A\\x008\\x00E\\x00}\\x00\\\\x00S\\x00t\\x00e\\x00a\\x00m\\x00\\\\x00s\\x00t\\x00e\\x00a\\x00m\\x00.\\x00e\\x00x\\x00e\\x00.\\x001\\x00" }, { "name": "Length", "value": "112" } ], "repeated": 0, "id": 30672 }, { "timestamp": "2026-05-29 01:06:00,008", "thread_id": "4696", "caller": "0x7ff79bc5652c", "parentcaller": "0x7ff79bc55d54", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\rsaenh.dll" }, { "name": "BaseAddress", "value": "0x7fff56630000" } ], "repeated": 0, "id": 30673 }, { "timestamp": "2026-05-29 01:06:00,008", "thread_id": "4696", "caller": "0x7ff79bc5652c", "parentcaller": "0x7ff79bc55d54", "category": "crypto", "api": "CryptAcquireContextW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Container", "value": "" }, { "name": "Provider", "value": "" }, { "name": "Flags", "value": "0xf0000000" } ], "repeated": 0, "id": 30674 }, { "timestamp": "2026-05-29 01:06:00,008", "thread_id": "4696", "caller": "0x7ff79bc5655a", "parentcaller": "0x7ff79bc55d54", "category": "crypto", "api": "CryptCreateHash", "status": true, "return": "0x00000001", "arguments": [ { "name": "Algid", "value": "0x00008003", "pretty_value": "MD5" }, { "name": "CryptKey", "value": "0x00000000" }, { "name": "Hash object", "value": "0x0cb36610" } ], "repeated": 0, "id": 30675 }, { "timestamp": "2026-05-29 01:06:00,008", "thread_id": "4696", "caller": "0x7ff79bc565a5", "parentcaller": "0x7ff79bc55d54", "category": "crypto", "api": "CryptHashData", "status": true, "return": "0x00000001", "arguments": [ { "name": "CryptHash", "value": "0x0cb36610" }, { "name": "Buffer", "value": "C\\x00:\\x00\\\\x00U\\x00s\\x00e\\x00r\\x00s\\x00\\\\x00a\\x00d\\x00m\\x00i\\x00n\\x00\\\\x00A\\x00p\\x00p\\x00D\\x00a\\x00t\\x00a\\x00\\\\x00L\\x00o\\x00c\\x00a\\x00l\\x00\\\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00\\\\x00O\\x00n\\x00e\\x00D\\x00r\\x00i\\x00v\\x00e\\x00\\\\x00O\\x00n\\x00e\\x00D\\x00r\\x00i\\x00v\\x00e\\x00.\\x00e\\x00x\\x00e\\x00.\\x005\\x000\\x001\\x00" }, { "name": "Length", "value": "128" } ], "repeated": 0, "id": 30676 }, { "timestamp": "2026-05-29 01:06:00,008", "thread_id": "4696", "caller": "0x7ff79bc5696c", "parentcaller": "0x7ff79bc55d54", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 30677 }, { "timestamp": "2026-05-29 01:06:00,008", "thread_id": "4696", "caller": "0x7ff79bc623a8", "parentcaller": "0x7ff79bc62e19", "category": "system", "api": "LdrGetDllHandle", "status": false, "return": "0xffffffffc0000135", "pretty_return": "DLL_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\SecurityHealthSSO.dll" }, { "name": "ModuleHandle", "value": "0x7fff57ec14a4" } ], "repeated": 0, "id": 30678 }, { "timestamp": "2026-05-29 01:06:00,008", "thread_id": "4696", "caller": "0x7ff79bc8ab52", "parentcaller": "0x7ff79bc896ee", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x0000200a" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 30679 }, { "timestamp": "2026-05-29 01:06:00,008", "thread_id": "4696", "caller": "0x7ff79bc62fcc", "parentcaller": "0x7ff79bc569dd", "category": "system", "api": "CreateTimerQueueTimer", "status": true, "return": "0x00000001", "arguments": [ { "name": "phNewTimer", "value": "0x0cb35340" }, { "name": "TimerQueue", "value": "0x00000000" }, { "name": "Callback", "value": "0x9be06320" }, { "name": "Parameter", "value": "0x035cb810" }, { "name": "DueTime", "value": "5000" }, { "name": "Period", "value": "1000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 30680 }, { "timestamp": "2026-05-29 01:06:00,008", "thread_id": "4696", "caller": "0x7ff79bc630c3", "parentcaller": "0x7ff79bc569dd", "category": "system", "api": "CreateTimerQueueTimer", "status": true, "return": "0x00000001", "arguments": [ { "name": "phNewTimer", "value": "0x0cb35c70" }, { "name": "TimerQueue", "value": "0x00000000" }, { "name": "Callback", "value": "0x9be06320" }, { "name": "Parameter", "value": "0x035cb810" }, { "name": "DueTime", "value": "1000" }, { "name": "Period", "value": "1000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 30681 }, { "timestamp": "2026-05-29 01:06:00,337", "thread_id": "4696", "caller": "0x7ff79bc5a83a", "parentcaller": "0x7ff79bc5a34b", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 30682 }, { "timestamp": "2026-05-29 01:06:00,337", "thread_id": "4696", "caller": "0x7ff79bc79bc9", "parentcaller": "0x7ff79bc5930c", "category": "misc", "api": "FindResourceExW", "status": true, "return": "0x01310a70", "arguments": [ { "name": "Module", "value": "0x7ff79bc10000" }, { "name": "Type", "value": "#6" }, { "name": "Name", "value": "#54" }, { "name": "Language", "value": "0x00000000" } ], "repeated": 0, "id": 30683 }, { "timestamp": "2026-05-29 01:06:00,337", "thread_id": "4696", "caller": "0x7ff79bc79be3", "parentcaller": "0x7ff79bc5930c", "category": "misc", "api": "LoadResource", "status": true, "return": "0x01312a78", "arguments": [ { "name": "Module", "value": "0x7ff79bc10000" }, { "name": "ResourceInfo", "value": "0x01310a70" } ], "repeated": 0, "id": 30684 }, { "timestamp": "2026-05-29 01:06:05,680", "thread_id": "8412", "caller": "0x7fff58542f2d", "parentcaller": "0x7fff58542d59", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "16" }, { "name": "ThreadInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "8412" } ], "repeated": 0, "id": 30685 }, { "timestamp": "2026-05-29 01:06:05,680", "thread_id": "8412", "caller": "0x7fff59fa467e", "parentcaller": "0x7fff5781f79a", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "12" }, { "name": "ThreadInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "8412" } ], "repeated": 0, "id": 30686 }, { "timestamp": "2026-05-29 01:06:05,680", "thread_id": "8412", "caller": "0x7fff59fa469e", "parentcaller": "0x7fff5781f79a", "category": "threading", "api": "NtTerminateThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00000000" }, { "name": "ExitStatus", "value": "0x00000000" }, { "name": "ThreadId", "value": "0" }, { "name": "ProcessId", "value": "0" } ], "repeated": 0, "id": 30687 }, { "timestamp": "2026-05-29 01:06:05,727", "thread_id": "8324", "caller": "0x7fff58542f2d", "parentcaller": "0x7fff58542d59", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "16" }, { "name": "ThreadInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "8324" } ], "repeated": 0, "id": 30688 }, { "timestamp": "2026-05-29 01:06:05,727", "thread_id": "8324", "caller": "0x7fff59fa467e", "parentcaller": "0x7fff5781f79a", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "12" }, { "name": "ThreadInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "8324" } ], "repeated": 0, "id": 30689 }, { "timestamp": "2026-05-29 01:06:05,727", "thread_id": "8324", "caller": "0x7fff59fa469e", "parentcaller": "0x7fff5781f79a", "category": "threading", "api": "NtTerminateThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00000000" }, { "name": "ExitStatus", "value": "0x00000000" }, { "name": "ThreadId", "value": "0" }, { "name": "ProcessId", "value": "0" } ], "repeated": 0, "id": 30690 }, { "timestamp": "2026-05-29 01:06:07,633", "thread_id": "6224", "caller": "0x7fff59fa467e", "parentcaller": "0x7fff59fa3748", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "12" }, { "name": "ThreadInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6224" } ], "repeated": 0, "id": 30691 }, { "timestamp": "2026-05-29 01:06:07,633", "thread_id": "6176", "caller": "0x7fff59fa467e", "parentcaller": "0x7fff59fa3748", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "12" }, { "name": "ThreadInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6176" } ], "repeated": 0, "id": 30692 }, { "timestamp": "2026-05-29 01:06:07,633", "thread_id": "6168", "caller": "0x7fff59fa469e", "parentcaller": "0x7fff59fa3748", "category": "threading", "api": "NtTerminateThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00000000" }, { "name": "ExitStatus", "value": "0x00000000" }, { "name": "ThreadId", "value": "0" }, { "name": "ProcessId", "value": "0" } ], "repeated": 1, "id": 30693 }, { "timestamp": "2026-05-29 01:06:09,321", "thread_id": "4560", "caller": "0x7fff597abf07", "parentcaller": "0x7fff597abe66", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 30694 }, { "timestamp": "2026-05-29 01:06:11,790", "thread_id": "4696", "caller": "0x7ff79be6dccc", "parentcaller": "0x7ff79be74662", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000066" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 30695 }, { "timestamp": "2026-05-29 01:06:11,790", "thread_id": "4696", "caller": "0x7ff79be61930", "parentcaller": "0x7ff79be6dd29", "category": "misc", "api": "GetCursorPos", "status": true, "return": "0x00000001", "arguments": [ { "name": "x", "value": "54" }, { "name": "y", "value": "1055" } ], "repeated": 0, "id": 30696 }, { "timestamp": "2026-05-29 01:06:11,790", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc69953", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 7, "id": 30697 }, { "timestamp": "2026-05-29 01:06:11,883", "thread_id": "4696", "caller": "0x7ff79bc6b631", "parentcaller": "0x7ff79bc6b527", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "TaskbarMonitor" }, { "name": "Atom", "value": "0x0000c045" } ], "repeated": 0, "id": 30698 }, { "timestamp": "2026-05-29 01:06:11,899", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc69953", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 30699 }, { "timestamp": "2026-05-29 01:06:11,899", "thread_id": "4696", "caller": "0x7ff79bc6b631", "parentcaller": "0x7ff79bc6b527", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "TaskbarMonitor" }, { "name": "Atom", "value": "0x0000c045" } ], "repeated": 0, "id": 30700 }, { "timestamp": "2026-05-29 01:06:11,899", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc69953", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 1, "id": 30701 }, { "timestamp": "2026-05-29 01:06:11,915", "thread_id": "4696", "caller": "0x7ff79bc6b631", "parentcaller": "0x7ff79bc6b527", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "TaskbarMonitor" }, { "name": "Atom", "value": "0x0000c045" } ], "repeated": 0, "id": 30702 }, { "timestamp": "2026-05-29 01:06:11,915", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc69953", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 2, "id": 30703 }, { "timestamp": "2026-05-29 01:06:12,383", "thread_id": "4696", "caller": "0x7ff79be2a062", "parentcaller": "0x7ff79be299a9", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00001016" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 30704 }, { "timestamp": "2026-05-29 01:06:12,383", "thread_id": "4696", "caller": "0x7ff79be2a062", "parentcaller": "0x7ff79be299a9", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00001018" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 30705 }, { "timestamp": "2026-05-29 01:06:12,383", "thread_id": "4696", "caller": "0x7ff79be2a062", "parentcaller": "0x7ff79be299a9", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 30706 }, { "timestamp": "2026-05-29 01:06:12,446", "thread_id": "5108", "caller": "0x7fff426da250", "parentcaller": "0x7fff57fc7344", "category": "system", "api": "GetSystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 30707 }, { "timestamp": "2026-05-29 01:06:12,446", "thread_id": "5108", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff42570a3f", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000023b4" }, { "name": "DesiredAccess", "value": "0x00000410", "pretty_value": "PROCESS_VM_READ|PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 30708 }, { "timestamp": "2026-05-29 01:06:12,446", "thread_id": "5108", "caller": "0x7fff5781026b", "parentcaller": "0x7fff42570dc8", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000023b4" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002358" } ], "repeated": 0, "id": 30709 }, { "timestamp": "2026-05-29 01:06:12,446", "thread_id": "5108", "caller": "0x7fff42570e03", "parentcaller": "0x7fff42570a6b", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 30710 }, { "timestamp": "2026-05-29 01:06:12,446", "thread_id": "5108", "caller": "0x7fff42570e77", "parentcaller": "0x7fff42570a6b", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x90\\x7f\\xc6\\x0b\\x00\\x00\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00\\xb8\\x7f\\xc6\\x0b\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd8\\x7f\\xc6\\x0b\\x00\\x00\\x00\\x00T\\x00S\\x00A\\x00:\\x00/\\x00/\\x00P\\x00r\\x00o\\x00c\\x00U\\x00n\\x00i\\x00q\\x00u\\x00e\\x00W\\x00\\x00\\x00\\x00\\x00\\x00\\x00%\\xf1\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 30711 }, { "timestamp": "2026-05-29 01:06:12,446", "thread_id": "5108", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff44bd4f06", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002358" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 30712 }, { "timestamp": "2026-05-29 01:06:12,446", "thread_id": "5108", "caller": "0x7fff5781026b", "parentcaller": "0x7fff44c0f8f9", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002358" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00001acc" } ], "repeated": 0, "id": 30713 }, { "timestamp": "2026-05-29 01:06:12,446", "thread_id": "5108", "caller": "0x7fff44c0f5ac", "parentcaller": "0x7fff44c0f931", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 30714 }, { "timestamp": "2026-05-29 01:06:12,446", "thread_id": "5108", "caller": "0x7fff44c0f65d", "parentcaller": "0x7fff44c0f931", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00 \\x86\\xc6\\x0b\\x00\\x00\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00H\\x86\\xc6\\x0b\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x86\\xc6\\x0b\\x00\\x00\\x00\\x00T\\x00S\\x00A\\x00:\\x00/\\x00/\\x00P\\x00r\\x00o\\x00c\\x00U\\x00n\\x00i\\x00q\\x00u\\x00e\\x00W\\x00\\x00\\x00\\x00\\x00\\x00\\x00%\\xf1\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 30715 }, { "timestamp": "2026-05-29 01:06:12,446", "thread_id": "5108", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff426da18b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000ea0" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 30716 }, { "timestamp": "2026-05-29 01:06:12,446", "thread_id": "5000", "caller": "0x7fff54890772", "parentcaller": "0x7fff5486709a", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00010128" }, { "name": "Message", "value": "0x00000060" } ], "repeated": 0, "id": 30717 }, { "timestamp": "2026-05-29 01:06:12,446", "thread_id": "4696", "caller": "0x7ff79bc54d73", "parentcaller": "0x7ff79bc4e52c", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 30718 }, { "timestamp": "2026-05-29 01:06:12,446", "thread_id": "4696", "caller": "0x7ff79bc54d73", "parentcaller": "0x7ff79bc4e52c", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 30719 }, { "timestamp": "2026-05-29 01:06:12,446", "thread_id": "4696", "caller": "0x7ff79bc54d73", "parentcaller": "0x7ff79bc4e52c", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000023b4" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search" } ], "repeated": 0, "id": 30720 }, { "timestamp": "2026-05-29 01:06:12,446", "thread_id": "4696", "caller": "0x7ff79bc54d73", "parentcaller": "0x7ff79bc4e52c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000023b4" }, { "name": "ValueName", "value": "SearchboxTaskbarMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\SearchboxTaskbarMode" } ], "repeated": 0, "id": 30721 }, { "timestamp": "2026-05-29 01:06:12,446", "thread_id": "4696", "caller": "0x7ff79bc54d73", "parentcaller": "0x7ff79bc4e52c", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000023b4" } ], "repeated": 0, "id": 30722 }, { "timestamp": "2026-05-29 01:06:12,446", "thread_id": "4696", "caller": "0x7ff79bc54d73", "parentcaller": "0x7ff79bc5370c", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 30723 }, { "timestamp": "2026-05-29 01:06:12,446", "thread_id": "4696", "caller": "0x7ff79bc54d73", "parentcaller": "0x7ff79bc5370c", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 30724 }, { "timestamp": "2026-05-29 01:06:12,446", "thread_id": "4696", "caller": "0x7ff79bc54d73", "parentcaller": "0x7ff79bc5370c", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000023b4" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search" } ], "repeated": 0, "id": 30725 }, { "timestamp": "2026-05-29 01:06:12,446", "thread_id": "4696", "caller": "0x7ff79bc54d73", "parentcaller": "0x7ff79bc5370c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000023b4" }, { "name": "ValueName", "value": "SearchboxTaskbarMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\SearchboxTaskbarMode" } ], "repeated": 0, "id": 30726 }, { "timestamp": "2026-05-29 01:06:12,446", "thread_id": "4696", "caller": "0x7ff79bc54d73", "parentcaller": "0x7ff79bc5370c", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000023b4" } ], "repeated": 0, "id": 30727 }, { "timestamp": "2026-05-29 01:06:12,446", "thread_id": "4696", "caller": "0x7ff79bc54d73", "parentcaller": "0x7ff79bc53715", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 30728 }, { "timestamp": "2026-05-29 01:06:12,446", "thread_id": "4696", "caller": "0x7ff79bc54d73", "parentcaller": "0x7ff79bc53715", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 30729 }, { "timestamp": "2026-05-29 01:06:12,446", "thread_id": "4696", "caller": "0x7ff79bc54d73", "parentcaller": "0x7ff79bc53715", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000023b4" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search" } ], "repeated": 0, "id": 30730 }, { "timestamp": "2026-05-29 01:06:12,446", "thread_id": "4696", "caller": "0x7ff79bc54d73", "parentcaller": "0x7ff79bc53715", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000023b4" }, { "name": "ValueName", "value": "SearchboxTaskbarMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\SearchboxTaskbarMode" } ], "repeated": 0, "id": 30731 }, { "timestamp": "2026-05-29 01:06:12,446", "thread_id": "4696", "caller": "0x7ff79bc54d73", "parentcaller": "0x7ff79bc53715", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000023b4" } ], "repeated": 0, "id": 30732 }, { "timestamp": "2026-05-29 01:06:12,446", "thread_id": "4696", "caller": "0x7ff79bc69d1d", "parentcaller": "0x7ff79bc69cab", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 30733 }, { "timestamp": "2026-05-29 01:06:12,446", "thread_id": "4696", "caller": "0x7ff79bc69d1d", "parentcaller": "0x7ff79bc69cab", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 30734 }, { "timestamp": "2026-05-29 01:06:12,446", "thread_id": "4696", "caller": "0x7ff79bc69d1d", "parentcaller": "0x7ff79bc69cab", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000023b4" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced" } ], "repeated": 0, "id": 30735 }, { "timestamp": "2026-05-29 01:06:12,446", "thread_id": "4696", "caller": "0x7ff79bc69d1d", "parentcaller": "0x7ff79bc69cab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000023b4" }, { "name": "ValueName", "value": "ShowCortanaButton" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowCortanaButton" } ], "repeated": 0, "id": 30736 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bc69d1d", "parentcaller": "0x7ff79bc69cab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000023b4" } ], "repeated": 0, "id": 30737 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bc54f57", "parentcaller": "0x7ff79bc4e161", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "TaskbarMonitor" }, { "name": "Atom", "value": "0x0000c045" } ], "repeated": 1, "id": 30738 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bc4e734", "parentcaller": "0x7ff79bc4e33a", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\xf9\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00X\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\r\\x00\\x00\\x00\\x01\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4696" } ], "repeated": 0, "id": 30739 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4636", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xf9\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x1c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4636" } ], "repeated": 0, "id": 30740 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bc54f57", "parentcaller": "0x7ff79bc4d8f5", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "TaskbarMonitor" }, { "name": "Atom", "value": "0x0000c045" } ], "repeated": 0, "id": 30741 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bdd34aa", "parentcaller": "0x7ff79bdd4d6e", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x00000002", "pretty_value": "KEY_SET_VALUE" }, { "name": "Handle", "value": "0x000024cc" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 30742 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bdd34e9", "parentcaller": "0x7ff79bdd4d6e", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024cc" }, { "name": "ValueName", "value": "TraySearchBoxVisible" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Buffer", "value": "0" }, { "name": "BufferLength", "value": "4" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\TraySearchBoxVisible" } ], "repeated": 0, "id": 30743 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bdd3501", "parentcaller": "0x7ff79bdd4d6e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024cc" } ], "repeated": 0, "id": 30744 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bdd34aa", "parentcaller": "0x7ff79bdd4d6e", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x00000002", "pretty_value": "KEY_SET_VALUE" }, { "name": "Handle", "value": "0x000024cc" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 30745 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4636", "caller": "0x7ff79bc4ab22", "parentcaller": "0x00000000", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 30746 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bdd3501", "parentcaller": "0x7ff79bdd4d6e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024cc" } ], "repeated": 0, "id": 30747 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bc4dffd", "parentcaller": "0x7ff79bc4db65", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "TaskbarMonitor" }, { "name": "Atom", "value": "0x0000c045" } ], "repeated": 0, "id": 30748 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4636", "caller": "0x7ff79bc4ab22", "parentcaller": "0x00000000", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 30749 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4576", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\x11\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4576" } ], "repeated": 0, "id": 30750 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\xf9\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00X\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\r\\x00\\x00\\x00\\x01\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4696" } ], "repeated": 0, "id": 30751 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 30752 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4576", "caller": "0x7ff79bc4ac80", "parentcaller": "0x00000000", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 30753 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bcbc401", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "Handle", "value": "0x00002408" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 30754 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4576", "caller": "0x7ff79bc4ac9f", "parentcaller": "0x00000000", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 30755 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bcbc458", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002408" } ], "repeated": 0, "id": 30756 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4636", "caller": "0x7ff79bc4ab4a", "parentcaller": "0x00000000", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 30757 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 30758 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4636", "caller": "0x7ff79bc4ab8a", "parentcaller": "0x00000000", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 30759 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002408" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 30760 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002408" }, { "name": "ValueName", "value": "HeadlinesOnboardingComplete" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\HeadlinesOnboardingComplete" } ], "repeated": 0, "id": 30761 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002408" } ], "repeated": 0, "id": 30762 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4636", "caller": "0x7ff79bc4aba9", "parentcaller": "0x00000000", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 30763 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 30764 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "5000", "caller": "0x7fff42595b7f", "parentcaller": "0x7fff42595b24", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CloudExperienceHost" }, { "name": "Handle", "value": "0x000016b8" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CloudExperienceHost" } ], "repeated": 0, "id": 30765 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 30766 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "5000", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000016b8" }, { "name": "ObjectAttributesName", "value": "Fullscreen" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CloudExperienceHost\\Fullscreen" } ], "repeated": 0, "id": 30767 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002408" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 30768 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "5000", "caller": "0x7fff426bfce2", "parentcaller": "0x7fff42595b24", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000016b8" } ], "repeated": 0, "id": 30769 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002408" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 30770 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4636", "caller": "0x7ff79bc4abc8", "parentcaller": "0x00000000", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 30771 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bcbc401", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "Handle", "value": "0x00002408" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 30772 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bcbc434", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002408" }, { "name": "ValueName", "value": "IsFeedsAvailable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\IsFeedsAvailable" } ], "repeated": 0, "id": 30773 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bcbc458", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002408" } ], "repeated": 0, "id": 30774 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 30775 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 30776 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002408" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 30777 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4560", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff584fb0ca", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 30778 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002408" }, { "name": "ValueName", "value": "HeadlinesOnboardingComplete" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\HeadlinesOnboardingComplete" } ], "repeated": 0, "id": 30779 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002408" } ], "repeated": 0, "id": 30780 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 30781 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 30782 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002408" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 30783 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002408" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 30784 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002408" } ], "repeated": 0, "id": 30785 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4560", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 30786 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bcbc401", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "Handle", "value": "0x00002408" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 30787 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bcbc434", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002408" }, { "name": "ValueName", "value": "IsFeedsAvailable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\IsFeedsAvailable" } ], "repeated": 0, "id": 30788 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4560", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 30789 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4560", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000360" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 30790 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bcbc458", "parentcaller": "0x7ff79bcbc483", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002408" } ], "repeated": 0, "id": 30791 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 30792 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 30793 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002408" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 30794 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002408" }, { "name": "ValueName", "value": "HeadlinesOnboardingComplete" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\HeadlinesOnboardingComplete" } ], "repeated": 0, "id": 30795 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd23cc1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002408" } ], "repeated": 0, "id": 30796 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 30797 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 30798 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4620", "caller": "0x7ff79bcb8fba", "parentcaller": "0x00000000", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 30799 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002408" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 30800 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002408" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 30801 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002408" } ], "repeated": 0, "id": 30802 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 30803 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 30804 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002408" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 30805 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002408" }, { "name": "ValueName", "value": "ShellFeedsTaskbarViewMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarViewMode" } ], "repeated": 0, "id": 30806 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd33914", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002408" } ], "repeated": 0, "id": 30807 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4620", "caller": "0x7ff79bcb8ff6", "parentcaller": "0x00000000", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 30808 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4636", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xf9\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x1c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4636" } ], "repeated": 0, "id": 30809 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4620", "caller": "0x7ff79bcb8ff6", "parentcaller": "0x00000000", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 30810 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bc557d2", "parentcaller": "0x7ff79bd1630d", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "TaskbarMonitor" }, { "name": "Atom", "value": "0x0000c045" } ], "repeated": 0, "id": 30811 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4620", "caller": "0x7ff79bcb9017", "parentcaller": "0x00000000", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 30812 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 30813 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 30814 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4620", "caller": "0x7ff79bc1afc1", "parentcaller": "0x7ff79bcb903d", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 30815 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002408" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Feeds" } ], "repeated": 0, "id": 30816 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002408" }, { "name": "ValueName", "value": "ShellFeedsTaskbarContentUpdateMode" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Feeds\\ShellFeedsTaskbarContentUpdateMode" } ], "repeated": 0, "id": 30817 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 30818 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd3434f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002408" } ], "repeated": 0, "id": 30819 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bc4d757", "parentcaller": "0x7ff79bc4b674", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 30820 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bc6b631", "parentcaller": "0x7ff79bc6b527", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "TaskbarMonitor" }, { "name": "Atom", "value": "0x0000c045" } ], "repeated": 0, "id": 30821 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc69953", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 30822 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bc4d757", "parentcaller": "0x7ff79bc4b674", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 2, "id": 30823 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bc801c8", "parentcaller": "0x7ff79bc8a0c8", "category": "misc", "api": "GetKeyboardLayout", "status": true, "return": "0x04090409", "arguments": [ { "name": "KeyboardLayout", "value": "0x00000409" }, { "name": "LanguageName", "value": "English (United States)" } ], "repeated": 1, "id": 30824 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bc801c8", "parentcaller": "0x7ff79bc8a0c8", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x0000104e" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 30825 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bc801c8", "parentcaller": "0x7ff79bc8a0c8", "category": "synchronization", "api": "NtOpenEvent", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "Handle", "value": "0x035cf0c0" }, { "name": "EventName", "value": "Local\\1ImmersiveFocusTrackingActiveEvent" } ], "repeated": 0, "id": 30826 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bc521d5", "parentcaller": "0x7ff79bc51a67", "category": "system", "api": "GetLastInputInfo", "status": true, "return": "0x00000001", "arguments": [], "repeated": 0, "id": 30827 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bc521fe", "parentcaller": "0x7ff79bc51a67", "category": "device", "api": "NtPowerInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "InformationLevel", "value": "16" }, { "name": "InputBuffer", "value": "" }, { "name": "OutputBuffer", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 30828 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4560", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff557c3a38", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\x11\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4560" } ], "repeated": 0, "id": 30829 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bc76bd8", "parentcaller": "0x7ff79bc8a0c8", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00010110" }, { "name": "Message", "value": "0x0000c028" } ], "repeated": 0, "id": 30830 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "misc", "api": "GetKeyboardLayout", "status": true, "return": "0x04090409", "arguments": [ { "name": "KeyboardLayout", "value": "0x00000409" }, { "name": "LanguageName", "value": "English (United States)" } ], "repeated": 0, "id": 30831 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "5000", "caller": "0x7fff57fc2eeb", "parentcaller": "0x7fff581ba00f", "category": "synchronization", "api": "NtFindAtom", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "AtomName", "value": "Windows.Internal.Shell.Holographic.Win32PortedView" }, { "name": "Atom", "value": "0x00000000" } ], "repeated": 1, "id": 30832 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "5000", "caller": "0x7fff57fc2eeb", "parentcaller": "0x7fff581ba00f", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "{9F4C2855-9F79-4B39-A8D0-E1D42DE1D5F3} 5" }, { "name": "Atom", "value": "0x0000c067" } ], "repeated": 0, "id": 30833 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "5000", "caller": "0x7fff5781026b", "parentcaller": "0x7fff45584920", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000016b8" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000026c4" } ], "repeated": 0, "id": 30834 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "5000", "caller": "0x7fff45584c45", "parentcaller": "0x7fff45584941", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 30835 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "5000", "caller": "0x7fff45584ce5", "parentcaller": "0x7fff45584941", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00y\\xc6\\x0b\\x00\\x00\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00(y\\xc6\\x0b\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00Hy\\xc6\\x0b\\x00\\x00\\x00\\x00T\\x00S\\x00A\\x00:\\x00/\\x00/\\x00P\\x00r\\x00o\\x00c\\x00U\\x00n\\x00i\\x00q\\x00u\\x00e\\x00W\\x00\\x00\\x00\\x00\\x00\\x00\\x00%\\xf1\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 30836 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 30837 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024c0" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 30838 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4560", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\x11\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4560" } ], "repeated": 0, "id": 30839 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "5000", "caller": "0x7fff425a9007", "parentcaller": "0x7fff425a8c10", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 30840 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "5000", "caller": "0x7fff57fc2eeb", "parentcaller": "0x7fff581ba00f", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "MultimonitorActivationException" }, { "name": "Atom", "value": "0x0000c049" } ], "repeated": 0, "id": 30841 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000100a8" }, { "name": "Message", "value": "0x00000060" } ], "repeated": 0, "id": 30842 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 30843 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 30844 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xd0\\xf1\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xa7=\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xaa\\x01\\x03I\\xff\\x7f\\x00\\x00\\xb0\\xef\\x08I\\xff\\x7f\\x00\\x00" } ], "repeated": 0, "id": 30845 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4620", "caller": "0x7fff42568962", "parentcaller": "0x7fff42567e38", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001011a" }, { "name": "Message", "value": "0x00000401" } ], "repeated": 0, "id": 30846 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002408" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 30847 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 30848 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "5000", "caller": "0x7fff41dbd603", "parentcaller": "0x7fff41dfc80c", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000026c4" }, { "name": "HandleName", "value": "\\Device\\Bam" }, { "name": "IoControlCode", "value": "0x00220004" }, { "name": "InputBuffer", "value": "\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb8\\x16\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 30849 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002408" } ], "repeated": 0, "id": 30850 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\default\\TextInput\\ConfigureJapaneseIMEVersion" }, { "name": "Handle", "value": "0x00002408" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\TextInput\\ConfigureJapaneseIMEVersion" } ], "repeated": 0, "id": 30851 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002408" }, { "name": "ValueName", "value": "PolicyType" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\TextInput\\ConfigureJapaneseIMEVersion\\PolicyType" } ], "repeated": 0, "id": 30852 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002408" }, { "name": "ValueName", "value": "Behavior" }, { "name": "Data", "value": "73760" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\TextInput\\ConfigureJapaneseIMEVersion\\Behavior" } ], "repeated": 0, "id": 30853 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002408" }, { "name": "ValueName", "value": "MergeAlgorithm" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\TextInput\\ConfigureJapaneseIMEVersion\\MergeAlgorithm" } ], "repeated": 0, "id": 30854 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002408" }, { "name": "ValueName", "value": "RegKeyPathRedirectMapped" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\TextInput\\ConfigureJapaneseIMEVersion\\RegKeyPathRedirectMapped" } ], "repeated": 0, "id": 30855 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002408" }, { "name": "ValueName", "value": "RegKeyPathRedirect" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\TextInput\\ConfigureJapaneseIMEVersion\\RegKeyPathRedirect" } ], "repeated": 0, "id": 30856 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002408" }, { "name": "ValueName", "value": "grouppolicyname" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\TextInput\\ConfigureJapaneseIMEVersion\\grouppolicyname" } ], "repeated": 0, "id": 30857 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002408" }, { "name": "ValueName", "value": "ADMXMetadataUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\TextInput\\ConfigureJapaneseIMEVersion\\ADMXMetadataUser" } ], "repeated": 0, "id": 30858 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002408" }, { "name": "ValueName", "value": "ADMXMetadataDevice" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\TextInput\\ConfigureJapaneseIMEVersion\\ADMXMetadataDevice" } ], "repeated": 0, "id": 30859 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002408" }, { "name": "ValueName", "value": "ADMXMetadataBoth" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\TextInput\\ConfigureJapaneseIMEVersion\\ADMXMetadataBoth" } ], "repeated": 0, "id": 30860 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002408" }, { "name": "ValueName", "value": "30Value" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\TextInput\\ConfigureJapaneseIMEVersion\\30Value" } ], "repeated": 0, "id": 30861 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002408" }, { "name": "ValueName", "value": "Value" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\TextInput\\ConfigureJapaneseIMEVersion\\Value" } ], "repeated": 0, "id": 30862 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002408" } ], "repeated": 0, "id": 30863 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\TextInput" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\TextInput" } ], "repeated": 1, "id": 30864 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 30865 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 30866 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbddbb", "category": "process", "api": "NtOpenProcess", "status": false, "return": "0xffffffffc0000022", "pretty_return": "ACCESS_DENIED", "arguments": [ { "name": "ProcessHandle", "value": "0x7fff59f75ba1" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "1048" } ], "repeated": 0, "id": 30867 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbddbb", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002344" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 30868 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Input\\TSF\\Tsf3Override\\{03b5835f-f03c-411b-9ce2-aa23e1171e36}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Input\\TSF\\Tsf3Override\\{03b5835f-f03c-411b-9ce2-aa23e1171e36}" } ], "repeated": 0, "id": 30869 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbddbb", "category": "process", "api": "NtOpenProcess", "status": false, "return": "0xffffffffc0000022", "pretty_return": "ACCESS_DENIED", "arguments": [ { "name": "ProcessHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "1180" } ], "repeated": 0, "id": 30870 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbddbb", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002614" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "5624" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" } ], "repeated": 0, "id": 30871 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbddbb", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002684" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "12844" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" } ], "repeated": 0, "id": 30872 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbddbb", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000022f8" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "5128" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" } ], "repeated": 0, "id": 30873 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbddbb", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000025e4" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "6400" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" } ], "repeated": 0, "id": 30874 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 1, "id": 30875 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 30876 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 1, "id": 30877 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 30878 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 1, "id": 30879 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 30880 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 1, "id": 30881 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 30882 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 2, "id": 30883 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 30884 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 1, "id": 30885 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4620", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 30886 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 1, "id": 30887 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 30888 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 1, "id": 30889 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 30890 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 1, "id": 30891 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 30892 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 1, "id": 30893 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 30894 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 1, "id": 30895 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 30896 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 30897 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 30898 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 30899 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bc6b631", "parentcaller": "0x7ff79bc6b527", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "TaskbarMonitor" }, { "name": "Atom", "value": "0x0000c045" } ], "repeated": 0, "id": 30900 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 30901 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "5000", "caller": "0x7fff41dbe842", "parentcaller": "0x7fff41dbd62c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000023a4" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "\\Device\\Bam" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 30902 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 30903 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc69953", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 30904 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 30905 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "5000", "caller": "0x7fff41dbe8a3", "parentcaller": "0x7fff41dbd62c", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000023a4" }, { "name": "HandleName", "value": "\\Device\\Bam" }, { "name": "IoControlCode", "value": "0x00220004" }, { "name": "InputBuffer", "value": "\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00D#\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c'\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9c\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14&\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x84&\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\"\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe4%\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 30906 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 3, "id": 30907 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 30908 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "5000", "caller": "0x7fff57fcb8ed", "parentcaller": "0x7fff58085341", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x000023a4", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x7fff580853d0" }, { "name": "Parameter", "value": "0x04b8c630" }, { "name": "CreationFlags", "value": "0x00000004" }, { "name": "ThreadId", "value": "2192" }, { "name": "ProcessId", "value": "4484" } ], "repeated": 0, "id": 30909 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "5000", "caller": "0x7fff5781f430", "parentcaller": "0x7fff58085379", "category": "threading", "api": "NtResumeThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x000023a4" }, { "name": "SuspendCount", "value": "1" }, { "name": "ThreadId", "value": "2192" }, { "name": "ProcessId", "value": "4484" } ], "repeated": 0, "id": 30910 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58085f99", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026c4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 30911 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 30912 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 5, "id": 30913 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc68e6a", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 30914 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 1, "id": 30915 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc690f2", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 30916 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 1, "id": 30917 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "2192", "caller": "0x7fff59fc507d", "parentcaller": "0x7fff59fc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 30918 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "2192", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7fff580853d0" }, { "name": "Parameter", "value": "0x04b8c630" } ], "repeated": 0, "id": 30919 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc686b4", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 30920 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 30921 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "2192", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x08\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2192" } ], "repeated": 0, "id": 30922 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "5000", "caller": "0x7fff4257b9c6", "parentcaller": "0x7fff4257e0b8", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 30923 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xe2\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x005\\x18\\xff\\x7f\\x00\\x00(\\xe3\\\\x03\\x00\\x00\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 30924 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 30925 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 30926 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002408" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 30927 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "5000", "caller": "0x7fff57fcb8ed", "parentcaller": "0x7fff58085341", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x00002684", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x7fff580853d0" }, { "name": "Parameter", "value": "0x04b8ae90" }, { "name": "CreationFlags", "value": "0x00000004" }, { "name": "ThreadId", "value": "2336" }, { "name": "ProcessId", "value": "4484" } ], "repeated": 0, "id": 30928 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4696", "caller": "0x7ff79bc8a418", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002408" } ], "repeated": 0, "id": 30929 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "5000", "caller": "0x7fff5781f430", "parentcaller": "0x7fff58085379", "category": "threading", "api": "NtResumeThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00002684" }, { "name": "SuspendCount", "value": "1" }, { "name": "ThreadId", "value": "2336" }, { "name": "ProcessId", "value": "4484" } ], "repeated": 0, "id": 30930 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58085f99", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022f8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 30931 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 30932 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4620", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 5, "id": 30933 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "2336", "caller": "0x7fff59fc507d", "parentcaller": "0x7fff59fc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 30934 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 30935 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "2336", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7fff580853d0" }, { "name": "Parameter", "value": "0x04b8ae90" } ], "repeated": 0, "id": 30936 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "2336", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00 \t\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2336" } ], "repeated": 0, "id": 30937 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 3, "id": 30938 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "2192", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x08\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2192" } ], "repeated": 0, "id": 30939 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 7, "id": 30940 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "2336", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5978ef53", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000017d8" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 30941 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "2336", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff584c6d2f", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000016a4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 30942 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "2336", "caller": "0x7fff5855dd9d", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002710" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000430" }, { "name": "ObjectAttributesName", "value": "Windows.ApplicationModel.Internal.UserActivities.UserActivityHistoryPayload" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Internal.UserActivities.UserActivityHistoryPayload" } ], "repeated": 0, "id": 30943 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "2336", "caller": "0x7fff5855ddf7", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002710" }, { "name": "KeyInformation", "value": "\\xff97\\xfffc\\xffe7\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00\\xff96\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00A\\x00p\\x00p\\x00l\\x00i\\x00c\\x00a\\x00t\\x00i\\x00o\\x00n\\x00M\\x00o\\x00d\\x00e\\x00l\\x00.\\x00I\\x00n\\x00t\\x00e\\x00r\\x00n\\x00a\\x00l\\x00.\\x00U\\x00s\\x00e\\x00r\\x00A\\x00c\\x00t\\x00i\\x00v\\x00i\\x00t\\x00i\\x00e\\x00s\\x00.\\x00U\\x00s\\x00e\\x00r\\x00A\\x00c\\x00t\\x00i\\x00v\\x00i\\x00t\\x00y\\x00H\\x00i\\x00s\\x00t\\x00o\\x00r\\x00y\\x00P\\x00a\\x00y\\x00l\\x00o\\x00a\\x00d\\x00\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\xffc4\\x02%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\r%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0EzX\\xffff\\x7f\\x00\\x00X\\x1ap\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\xffe3\\xff89\r\\x00\\x00\\x00\\x00\\xff87\\xff9dNX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff0\\xffa5~\\x0c\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x1ap\\x0c\\x00\\x00\\x00\\x00\\xfff0\\xffa5~\\x0c\\x00\\x00\\x00\\x00\\xffd0j\\xffc8\\x0b\\x00\\x00\\x00\\x00\\xffc7\\xffb3\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\xfff6sNX\\xffff\\x7f\\x00\\x00\\xff90\\x05\\xffa8\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffd0j\\xffc8\\x0b\\x00\\x00\\x00\\x00\\xffb0\\xffe8\\xffaa\\x0c\\x00\\x00\\x00\\x00\\xffb0\\xffe8\\xffaa\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff0\\xffa5~\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00~W\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x006\\xff8cYX\\xffff\\x7f\\x00\\x00\\xffc0\\xff95\\xffa3\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\xffe4\\xff89\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\xffe4\\xff89\r\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 30944 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "2336", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002710" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Internal.UserActivities.UserActivityHistoryPayload\\ActivationType" } ], "repeated": 0, "id": 30945 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "2336", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002710" }, { "name": "ValueName", "value": "Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Internal.UserActivities.UserActivityHistoryPayload\\Server" } ], "repeated": 0, "id": 30946 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "2336", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff585700bb", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002710" }, { "name": "ValueName", "value": "DllPath" }, { "name": "Data", "value": "C:\\Windows\\System32\\cdprt.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Internal.UserActivities.UserActivityHistoryPayload\\DllPath" } ], "repeated": 0, "id": 30947 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "2336", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002710" }, { "name": "ValueName", "value": "Threading" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Internal.UserActivities.UserActivityHistoryPayload\\Threading" } ], "repeated": 0, "id": 30948 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "2336", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002710" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Internal.UserActivities.UserActivityHistoryPayload\\TrustLevel" } ], "repeated": 0, "id": 30949 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "2336", "caller": "0x7fff584bc0fc", "parentcaller": "0x7fff58554170", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00002710" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Internal.UserActivities.UserActivityHistoryPayload\\CustomAttributes" } ], "repeated": 0, "id": 30950 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "2336", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002710" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Internal.UserActivities.UserActivityHistoryPayload\\RemoteServer" } ], "repeated": 0, "id": 30951 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "2336", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002710" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Internal.UserActivities.UserActivityHistoryPayload\\ActivateAsUser" } ], "repeated": 0, "id": 30952 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "2336", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002710" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Internal.UserActivities.UserActivityHistoryPayload\\ActivateInSharedBroker" } ], "repeated": 0, "id": 30953 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "2336", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002710" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Internal.UserActivities.UserActivityHistoryPayload\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 30954 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "2336", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58562222", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002710" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Internal.UserActivities.UserActivityHistoryPayload\\Permissions" } ], "repeated": 0, "id": 30955 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "2336", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002710" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Internal.UserActivities.UserActivityHistoryPayload\\ActivateOnHostFlags" } ], "repeated": 0, "id": 30956 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "2336", "caller": "0x7fff58557226", "parentcaller": "0x7fff5855ca23", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002710" } ], "repeated": 0, "id": 30957 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "2336", "caller": "0x7fff5855dd9d", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002710" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000430" }, { "name": "ObjectAttributesName", "value": "Windows.Globalization.Calendar" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Globalization.Calendar" } ], "repeated": 0, "id": 30958 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "2336", "caller": "0x7fff5855ddf7", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002710" }, { "name": "KeyInformation", "value": "\\xff97\\xfffc\\xffe7\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00<\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00G\\x00l\\x00o\\x00b\\x00a\\x00l\\x00i\\x00z\\x00a\\x00t\\x00i\\x00o\\x00n\\x00.\\x00C\\x00a\\x00l\\x00e\\x00n\\x00d\\x00a\\x00r\\x00\\x00\\x00\\x00\\x00\\x0f\\x00.\\x00\\x00\\x00\\x00\\x00k\\xffb8\\xfff7Y\\xffff\\x7f\\x00\\x00\\x0e\\x00\\x1c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffe0\\xffdd\\xffa3\\x0c\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x15\\x01\\x00\\x00\\x00\\x00\\xffe9\\xffe6\\xff89\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xff8c%\\x01\\x00\\x00\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\xffc4\\x02%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\r%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0EzX\\xffff\\x7f\\x00\\x00\\xff98\\x1cp\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffc0\\xffe7\\xff89\r\\x00\\x00\\x00\\x00\\xff87\\xff9dNX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\xffe9\\xffaa\\x0c\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\x1cp\\x0c\\x00\\x00\\x00\\x00\\xff90\\xffe9\\xffaa\\x0c\\x00\\x00\\x00\\x00P_\\xffc8\\x0b\\x00\\x00\\x00\\x00\\xffc7\\xffb3\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\xfff6sNX\\xffff\\x7f\\x00\\x00\\x10\\x12\\xffa8\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffffP_\\xffc8\\x0b\\x00\\x00\\x00\\x00\\xffd0\\xfff5\\xffaa\\x0c\\x00\\x00\\x00\\x00\\xffd0\\xfff5\\xffaa\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\xffe9\\xffaa\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x006\\xff8cYX\\xffff\\x7f\\x00\\x00`\\xff9b\\xffa3\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0\\xffe8\\xff89\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0\\xffe8\\xff89\r\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 30959 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "2336", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002710" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Globalization.Calendar\\ActivationType" } ], "repeated": 0, "id": 30960 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "2336", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002710" }, { "name": "ValueName", "value": "Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Globalization.Calendar\\Server" } ], "repeated": 0, "id": 30961 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "2336", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff585700bb", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002710" }, { "name": "ValueName", "value": "DllPath" }, { "name": "Data", "value": "C:\\Windows\\System32\\Windows.Globalization.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Globalization.Calendar\\DllPath" } ], "repeated": 0, "id": 30962 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "2336", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002710" }, { "name": "ValueName", "value": "Threading" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Globalization.Calendar\\Threading" } ], "repeated": 0, "id": 30963 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "2336", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002710" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Globalization.Calendar\\TrustLevel" } ], "repeated": 0, "id": 30964 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "2336", "caller": "0x7fff584bc0fc", "parentcaller": "0x7fff58554170", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00002710" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Globalization.Calendar\\CustomAttributes" } ], "repeated": 0, "id": 30965 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "2336", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002710" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Globalization.Calendar\\RemoteServer" } ], "repeated": 0, "id": 30966 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "2336", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002710" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Globalization.Calendar\\ActivateAsUser" } ], "repeated": 0, "id": 30967 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "2336", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002710" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Globalization.Calendar\\ActivateInSharedBroker" } ], "repeated": 0, "id": 30968 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "2336", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002710" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Globalization.Calendar\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 30969 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "2336", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58562222", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002710" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Globalization.Calendar\\Permissions" } ], "repeated": 0, "id": 30970 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "2336", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002710" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Globalization.Calendar\\ActivateOnHostFlags" } ], "repeated": 0, "id": 30971 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "2336", "caller": "0x7fff58557226", "parentcaller": "0x7fff5855ca23", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002710" } ], "repeated": 0, "id": 30972 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "2336", "caller": "0x7fff577ffa4e", "parentcaller": "0x7fff577fe97c", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "102" } ], "repeated": 0, "id": 30973 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "2336", "caller": "0x7fff5855dd9d", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002710" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000430" }, { "name": "ObjectAttributesName", "value": "Windows.Data.Json.JsonObject" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Json.JsonObject" } ], "repeated": 0, "id": 30974 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "2336", "caller": "0x7fff5855ddf7", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002710" }, { "name": "KeyInformation", "value": "\\xff97\\xfffc\\xffe7\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x008\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00D\\x00a\\x00t\\x00a\\x00.\\x00J\\x00s\\x00o\\x00n\\x00.\\x00J\\x00s\\x00o\\x00n\\x00O\\x00b\\x00j\\x00e\\x00c\\x00t\\x00\\xff80\r%\\x01\\x00\\x00\\x00\\x00\r\\x00\\x15\\x00\\x00\\x00\\x00\\x00k\\xffb8\\xfff7Y\\xffff\\x7f\\x00\\x00\\x0c\\x00.\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffe0\\xffdd\\xffa3\\x0c\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x15\\x01\\x00\\x00\\x00\\x00\\xffb9\\xffe6\\xff89\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xff8c%\\x01\\x00\\x00\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\xffc4\\x02%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\r%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0EzX\\xffff\\x7f\\x00\\x00X\\x11p\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\xffe7\\xff89\r\\x00\\x00\\x00\\x00\\xff87\\xff9dNX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffe0w\\xffa7\\x0c\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x11p\\x0c\\x00\\x00\\x00\\x00\\xffe0w\\xffa7\\x0c\\x00\\x00\\x00\\x00Pa\\xffc8\\x0b\\x00\\x00\\x00\\x00\\xffc7\\xffb3\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\xfff6sNX\\xffff\\x7f\\x00\\x00\\x10\\x1b\\xffa8\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffffPa\\xffc8\\x0b\\x00\\x00\\x00\\x00`\\xffe0\\xffaa\\x0c\\x00\\x00\\x00\\x00`\\xffe0\\xffaa\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffe0w\\xffa7\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00Y\\x1a\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x006\\xff8cYX\\xffff\\x7f\\x00\\x00p\\xffa4\\xffa3\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\xffe8\\xff89\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\xffe8\\xff89\r\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 30975 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "2336", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002710" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Json.JsonObject\\ActivationType" } ], "repeated": 0, "id": 30976 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "2336", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002710" }, { "name": "ValueName", "value": "Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Json.JsonObject\\Server" } ], "repeated": 0, "id": 30977 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "2336", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff585700bb", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002710" }, { "name": "ValueName", "value": "DllPath" }, { "name": "Data", "value": "C:\\Windows\\System32\\Windows.Web.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Json.JsonObject\\DllPath" } ], "repeated": 0, "id": 30978 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "2336", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002710" }, { "name": "ValueName", "value": "Threading" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Json.JsonObject\\Threading" } ], "repeated": 0, "id": 30979 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "2336", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002710" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Json.JsonObject\\TrustLevel" } ], "repeated": 0, "id": 30980 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "2336", "caller": "0x7fff584bc0fc", "parentcaller": "0x7fff58554170", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00002710" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Json.JsonObject\\CustomAttributes" } ], "repeated": 0, "id": 30981 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "2336", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002710" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Json.JsonObject\\RemoteServer" } ], "repeated": 0, "id": 30982 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "2336", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002710" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Json.JsonObject\\ActivateAsUser" } ], "repeated": 0, "id": 30983 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "2336", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002710" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Json.JsonObject\\ActivateInSharedBroker" } ], "repeated": 0, "id": 30984 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "2336", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002710" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Json.JsonObject\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 30985 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "2336", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58562222", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002710" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Json.JsonObject\\Permissions" } ], "repeated": 0, "id": 30986 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "2336", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002710" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Json.JsonObject\\ActivateOnHostFlags" } ], "repeated": 0, "id": 30987 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "2336", "caller": "0x7fff58557226", "parentcaller": "0x7fff5855ca23", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002710" } ], "repeated": 0, "id": 30988 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "2336", "caller": "0x7fff5855dd9d", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002710" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000430" }, { "name": "ObjectAttributesName", "value": "Windows.Data.Json.JsonValue" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Json.JsonValue" } ], "repeated": 0, "id": 30989 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "2336", "caller": "0x7fff5855ddf7", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002710" }, { "name": "KeyInformation", "value": "\\xff97\\xfffc\\xffe7\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x006\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00D\\x00a\\x00t\\x00a\\x00.\\x00J\\x00s\\x00o\\x00n\\x00.\\x00J\\x00s\\x00o\\x00n\\x00V\\x00a\\x00l\\x00u\\x00e\\x00\\x00\\x00\\xff80\r%\\x01\\x00\\x00\\x00\\x00\r\\x00.\\x00\\x00\\x00\\x00\\x00k\\xffb8\\xfff7Y\\xffff\\x7f\\x00\\x00\\x0c\\x00\\x1e\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffe0\\xffdd\\xffa3\\x0c\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x15\\x01\\x00\\x00\\x00\\x009\\xffe3\\xff89\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xff8c%\\x01\\x00\\x00\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\xffc4\\x02%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\r%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0EzX\\xffff\\x7f\\x00\\x00X\\x1ap\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xffe4\\xff89\r\\x00\\x00\\x00\\x00\\xff87\\xff9dNX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80h\\xffa7\\x0c\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x1ap\\x0c\\x00\\x00\\x00\\x00\\xff80h\\xffa7\\x0c\\x00\\x00\\x00\\x00\\xff90l\\xffc8\\x0b\\x00\\x00\\x00\\x00\\xffc7\\xffb3\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\xfff6sNX\\xffff\\x7f\\x00\\x00\\xff90\\x02\\xffa8\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xff90l\\xffc8\\x0b\\x00\\x00\\x00\\x00\\x10\\xffdf\\xffaa\\x0c\\x00\\x00\\x00\\x00\\x10\\xffdf\\xffaa\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80h\\xffa7\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x006\\xff8cYX\\xffff\\x7f\\x00\\x00@\\xff9d\\xffa3\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffe5\\xff89\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffe5\\xff89\r\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 30990 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "2336", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002710" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Json.JsonValue\\ActivationType" } ], "repeated": 0, "id": 30991 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "2336", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002710" }, { "name": "ValueName", "value": "Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Json.JsonValue\\Server" } ], "repeated": 0, "id": 30992 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "2336", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff585700bb", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002710" }, { "name": "ValueName", "value": "DllPath" }, { "name": "Data", "value": "C:\\Windows\\System32\\Windows.Web.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Json.JsonValue\\DllPath" } ], "repeated": 0, "id": 30993 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "2336", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002710" }, { "name": "ValueName", "value": "Threading" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Json.JsonValue\\Threading" } ], "repeated": 0, "id": 30994 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "2336", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002710" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Json.JsonValue\\TrustLevel" } ], "repeated": 0, "id": 30995 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "2336", "caller": "0x7fff584bc0fc", "parentcaller": "0x7fff58554170", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00002710" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Json.JsonValue\\CustomAttributes" } ], "repeated": 0, "id": 30996 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "2336", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002710" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Json.JsonValue\\RemoteServer" } ], "repeated": 0, "id": 30997 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "2336", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002710" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Json.JsonValue\\ActivateAsUser" } ], "repeated": 0, "id": 30998 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "2336", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002710" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Json.JsonValue\\ActivateInSharedBroker" } ], "repeated": 0, "id": 30999 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "2336", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002710" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Json.JsonValue\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 31000 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "2336", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58562222", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002710" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Json.JsonValue\\Permissions" } ], "repeated": 0, "id": 31001 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "2336", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002710" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Json.JsonValue\\ActivateOnHostFlags" } ], "repeated": 0, "id": 31002 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "2336", "caller": "0x7fff58557226", "parentcaller": "0x7fff5855ca23", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002710" } ], "repeated": 0, "id": 31003 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "2336", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff40c58e4b", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 31004 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "2336", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff40c58e4b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002710" }, { "name": "Milliseconds", "value": "1000" } ], "repeated": 0, "id": 31005 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "2336", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00 \t\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2336" } ], "repeated": 0, "id": 31006 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "8572", "caller": "0x7fff40c07e93", "parentcaller": "0x7fff45dc916a", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 31007 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "8572", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xe3\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00|!\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "8572" } ], "repeated": 0, "id": 31008 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 31009 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4620", "caller": "0x7fff5781026b", "parentcaller": "0x7fff45dcb132", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000022e0" } ], "repeated": 0, "id": 31010 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4620", "caller": "0x7fff584d7b74", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000034a" }, { "name": "SubKey", "value": "CLSID\\{37987DB6-9D85-4381-8D7D-3189661223D1}" }, { "name": "Handle", "value": "0x000022e2" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{37987DB6-9D85-4381-8D7D-3189661223D1}" } ], "repeated": 0, "id": 31011 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4620", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000022e2" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{37987DB6-9D85-4381-8D7D-3189661223D1}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 31012 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4620", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000022e2" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 31013 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4620", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x00\\xd4 \\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\xe2\"\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd5 \\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 31014 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4620", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{37987DB6-9D85-4381-8D7D-3189661223D1}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{37987DB6-9D85-4381-8D7D-3189661223D1}\\TreatAs" } ], "repeated": 0, "id": 31015 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4620", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000022e2" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 31016 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4620", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000022e2" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{37987DB6-9D85-4381-8D7D-3189661223D1}\\TreatAs" } ], "repeated": 0, "id": 31017 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4620", "caller": "0x7fff585622e1", "parentcaller": "0x7fff584d7c1d", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000022e2" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{37987DB6-9D85-4381-8D7D-3189661223D1}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 31018 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4620", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d81f5", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e2" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{37987DB6-9D85-4381-8D7D-3189661223D1}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 31019 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4620", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e2" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{37987DB6-9D85-4381-8D7D-3189661223D1}\\(Default)" } ], "repeated": 0, "id": 31020 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4620", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e2" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "CDPComActivityStoreReader" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{37987DB6-9D85-4381-8D7D-3189661223D1}\\(Default)" } ], "repeated": 0, "id": 31021 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4620", "caller": "0x7fff584d8485", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000022e2" }, { "name": "SubKey", "value": "InprocServer32" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{37987DB6-9D85-4381-8D7D-3189661223D1}\\InprocServer32" } ], "repeated": 0, "id": 31022 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4620", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000022e2" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{37987DB6-9D85-4381-8D7D-3189661223D1}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 31023 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4620", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000022e2" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 31024 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4620", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x90\\xd2 \\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\xe2\"\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xd3 \\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 31025 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4620", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{37987DB6-9D85-4381-8D7D-3189661223D1}\\InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{37987DB6-9D85-4381-8D7D-3189661223D1}\\InprocHandler32" } ], "repeated": 0, "id": 31026 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4620", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000022e2" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 31027 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4620", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000022e2" }, { "name": "ObjectAttributesName", "value": "InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{37987DB6-9D85-4381-8D7D-3189661223D1}\\InprocHandler32" } ], "repeated": 0, "id": 31028 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4620", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000022e2" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{37987DB6-9D85-4381-8D7D-3189661223D1}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 31029 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4620", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000022e2" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 31030 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4620", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x90\\xd2 \\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\xe2\"\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xd3 \\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 31031 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4620", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{37987DB6-9D85-4381-8D7D-3189661223D1}\\InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{37987DB6-9D85-4381-8D7D-3189661223D1}\\InprocHandler" } ], "repeated": 0, "id": 31032 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4620", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000022e2" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 31033 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4620", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000022e2" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{37987DB6-9D85-4381-8D7D-3189661223D1}\\InprocHandler" } ], "repeated": 0, "id": 31034 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4620", "caller": "0x7fff584d8010", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e2" } ], "repeated": 0, "id": 31035 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4620", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 31036 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4620", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000360" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 31037 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 31038 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4620", "caller": "0x7fff40c092ad", "parentcaller": "0x7fff40c0a354", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 31039 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4620", "caller": "0x7fff40c1e634", "parentcaller": "0x7fff40c1e545", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000011e4" }, { "name": "ValueName", "value": "02091777-C187-951A-0E4E-E98CEC442EC9" }, { "name": "Type", "value": "7", "pretty_value": "REG_MULTI_SZ" }, { "name": "Buffer", "value": "l" }, { "name": "BufferLength", "value": "268" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ActivityDataModel\\ReaderRevisionInfo\\02091777-C187-951A-0E4E-E98CEC442EC9" } ], "repeated": 0, "id": 31040 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4620", "caller": "0x7fff5781026b", "parentcaller": "0x7fff45dcb132", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002138" } ], "repeated": 0, "id": 31041 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4620", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 31042 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4620", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000360" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 31043 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4620", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 31044 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4620", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000360" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 31045 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 31046 }, { "timestamp": "2026-05-29 01:06:12,462", "thread_id": "4620", "caller": "0x7fff40c092ad", "parentcaller": "0x7fff40c0a354", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 31047 }, { "timestamp": "2026-05-29 01:06:12,477", "thread_id": "4620", "caller": "0x7fff40c1e634", "parentcaller": "0x7fff40c1e545", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000011e4" }, { "name": "ValueName", "value": "02091777-C187-951A-0E4E-E98CEC442EC9" }, { "name": "Type", "value": "7", "pretty_value": "REG_MULTI_SZ" }, { "name": "Buffer", "value": "l" }, { "name": "BufferLength", "value": "268" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ActivityDataModel\\ReaderRevisionInfo\\02091777-C187-951A-0E4E-E98CEC442EC9" } ], "repeated": 0, "id": 31048 }, { "timestamp": "2026-05-29 01:06:12,477", "thread_id": "4620", "caller": "0x7fff5781026b", "parentcaller": "0x7fff45dcb132", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002408" } ], "repeated": 0, "id": 31049 }, { "timestamp": "2026-05-29 01:06:12,477", "thread_id": "4620", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 31050 }, { "timestamp": "2026-05-29 01:06:12,477", "thread_id": "4620", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000360" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 31051 }, { "timestamp": "2026-05-29 01:06:12,477", "thread_id": "4620", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 31052 }, { "timestamp": "2026-05-29 01:06:12,477", "thread_id": "4620", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000360" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 31053 }, { "timestamp": "2026-05-29 01:06:12,477", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 31054 }, { "timestamp": "2026-05-29 01:06:12,477", "thread_id": "4620", "caller": "0x7fff40c092ad", "parentcaller": "0x7fff40c0a354", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 31055 }, { "timestamp": "2026-05-29 01:06:12,477", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 31056 }, { "timestamp": "2026-05-29 01:06:12,493", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc68e6a", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 2, "id": 31057 }, { "timestamp": "2026-05-29 01:06:12,493", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xdf\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x005\\x18\\xff\\x7f\\x00\\x00X\\xe0\\\\x03\\x00\\x00\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 31058 }, { "timestamp": "2026-05-29 01:06:12,493", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002408" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 31059 }, { "timestamp": "2026-05-29 01:06:12,493", "thread_id": "4696", "caller": "0x7ff79bc8a418", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002408" } ], "repeated": 0, "id": 31060 }, { "timestamp": "2026-05-29 01:06:12,508", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc68e6a", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 2, "id": 31061 }, { "timestamp": "2026-05-29 01:06:12,508", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xdf\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x005\\x18\\xff\\x7f\\x00\\x00X\\xe0\\\\x03\\x00\\x00\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 31062 }, { "timestamp": "2026-05-29 01:06:12,508", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002710" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 31063 }, { "timestamp": "2026-05-29 01:06:12,508", "thread_id": "4696", "caller": "0x7ff79bc8a418", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002710" } ], "repeated": 0, "id": 31064 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc68e6a", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 2, "id": 31065 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xdf\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x005\\x18\\xff\\x7f\\x00\\x00X\\xe0\\\\x03\\x00\\x00\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 31066 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002710" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 31067 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "4696", "caller": "0x7ff79bc8a418", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002710" } ], "repeated": 0, "id": 31068 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "synchronization", "api": "NtOpenEvent", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "Handle", "value": "0x035cf7c0" }, { "name": "EventName", "value": "Local\\1ImmersiveFocusTrackingActiveEvent" } ], "repeated": 0, "id": 31069 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "4696", "caller": "0x7ff79be2a062", "parentcaller": "0x7ff79be29c09", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00001016" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 31070 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "4696", "caller": "0x7ff79be2a062", "parentcaller": "0x7ff79be29c09", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00001018" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 31071 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "4696", "caller": "0x7ff79bc220d4", "parentcaller": "0x7ff79bc2204d", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001680" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 31072 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "4696", "caller": "0x7ff79bc220d4", "parentcaller": "0x7ff79bc2204d", "category": "registry", "api": "NtCreateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002408" }, { "name": "DesiredAccess", "value": "0x00000002", "pretty_value": "KEY_SET_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00001680" }, { "name": "ObjectAttributesName", "value": "TrayButtonClicked" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FeatureUsage\\TrayButtonClicked" }, { "name": "Class", "value": "" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 31073 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "4696", "caller": "0x7ff79bc220d4", "parentcaller": "0x7ff79bc2204d", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002408" }, { "name": "ValueName", "value": "StartButton" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Buffer", "value": "28" }, { "name": "BufferLength", "value": "4" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FeatureUsage\\TrayButtonClicked\\StartButton" } ], "repeated": 0, "id": 31074 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "4696", "caller": "0x7ff79bc220d4", "parentcaller": "0x7ff79bc2204d", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002408" } ], "repeated": 0, "id": 31075 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "4696", "caller": "0x7ff79be2974a", "parentcaller": "0x7ff79be29c11", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 31076 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "4696", "caller": "0x7ff79bc6b631", "parentcaller": "0x7ff79bc6b527", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "TaskbarMonitor" }, { "name": "Atom", "value": "0x0000c045" } ], "repeated": 0, "id": 31077 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc69953", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 31078 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "4696", "caller": "0x7ff79be2976d", "parentcaller": "0x7ff79be29c11", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 31079 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "5000", "caller": "0x7fff42591d97", "parentcaller": "0x7fff42591e22", "category": "windows", "api": "FindWindowW", "status": false, "return": "0x00000000", "arguments": [ { "name": "ClassName", "value": "32768" }, { "name": "WindowName", "value": "" } ], "repeated": 0, "id": 31080 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "5000", "caller": "0x7fff42595b7f", "parentcaller": "0x7fff42595aa9", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CloudExperienceHost" }, { "name": "Handle", "value": "0x00002138" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CloudExperienceHost" } ], "repeated": 0, "id": 31081 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002138" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 31082 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00002138" }, { "name": "ObjectAttributesName", "value": "Fullscreen" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CloudExperienceHost\\Fullscreen" } ], "repeated": 0, "id": 31083 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "5000", "caller": "0x7fff426bfce2", "parentcaller": "0x7fff42595aa9", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002138" } ], "repeated": 0, "id": 31084 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "5000", "caller": "0x7fff42595b7f", "parentcaller": "0x7fff42595aa9", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CloudExperienceHost" }, { "name": "Handle", "value": "0x00002138" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CloudExperienceHost" } ], "repeated": 0, "id": 31085 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002138" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 31086 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00002138" }, { "name": "ObjectAttributesName", "value": "Fullscreen" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CloudExperienceHost\\Fullscreen" } ], "repeated": 0, "id": 31087 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "5000", "caller": "0x7fff426bfce2", "parentcaller": "0x7fff42595aa9", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002138" } ], "repeated": 0, "id": 31088 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "5000", "caller": "0x7fff4259fa9e", "parentcaller": "0x7fff425cea9e", "category": "windows", "api": "FindWindowW", "status": true, "return": "0x00010094", "arguments": [ { "name": "ClassName", "value": "Shell_TrayWnd" }, { "name": "WindowName", "value": "" } ], "repeated": 0, "id": 31089 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "5000", "caller": "0x7fff57fc2eeb", "parentcaller": "0x7fff581ba00f", "category": "synchronization", "api": "NtFindAtom", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "AtomName", "value": "IsAutoHideEnabled" }, { "name": "Atom", "value": "0x00000000" } ], "repeated": 0, "id": 31090 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 31091 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58085ee4", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002048" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 31092 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 31093 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 31094 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 31095 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "2192", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x08\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2192" } ], "repeated": 0, "id": 31096 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "2192", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5978ef53", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000213c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 31097 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "2192", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff584c6d2f", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001c50" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 31098 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "2192", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 31099 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "2192", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000360" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 31100 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "2192", "caller": "0x7fff58552db5", "parentcaller": "0x7fff58552d47", "category": "registry", "api": "RegNotifyChangeKeyValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\" }, { "name": "NotifyFilter", "value": "0x10000005" }, { "name": "WatchSubtree", "value": "1" }, { "name": "Asynchronous", "value": "1" } ], "repeated": 0, "id": 31101 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "2192", "caller": "0x7fff584d7b74", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000034a" }, { "name": "SubKey", "value": "CLSID\\{11659A23-5884-4D1B-9CF6-67D6F4F90B36}" }, { "name": "Handle", "value": "0x000022e2" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{11659A23-5884-4D1B-9CF6-67D6F4F90B36}" } ], "repeated": 0, "id": 31102 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "2192", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000022e2" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 31103 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "2192", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000022e2" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 31104 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "2192", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xc0\\xcay\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\xe2\"\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\xcby\r\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 31105 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "2192", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\TreatAs" } ], "repeated": 0, "id": 31106 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "2192", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000022e2" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 31107 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "2192", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000022e2" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\TreatAs" } ], "repeated": 0, "id": 31108 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "2192", "caller": "0x7fff585622e1", "parentcaller": "0x7fff584d7c1d", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000022e2" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 31109 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "2192", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d81f5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000022e2" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 31110 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "6160", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff584fb0ca", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 31111 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "6160", "caller": "0x7fff584d7b74", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000034a" }, { "name": "SubKey", "value": "CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "Handle", "value": "0x00002262" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" } ], "repeated": 0, "id": 31112 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "6160", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002262" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 31113 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "6160", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002262" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 31114 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "6160", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xbai\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00b\"\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xbbi\r\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 31115 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "6160", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\TreatAs" } ], "repeated": 0, "id": 31116 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "6160", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002262" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 31117 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "6160", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00002262" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\TreatAs" } ], "repeated": 0, "id": 31118 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "6160", "caller": "0x7fff585622e1", "parentcaller": "0x7fff584d7c1d", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002262" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 31119 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "6160", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d81f5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002262" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 31120 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "6160", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002262" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)" } ], "repeated": 0, "id": 31121 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "6160", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002262" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "PSFactoryBuffer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)" } ], "repeated": 0, "id": 31122 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "6160", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002262" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 31123 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "6160", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002262" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 31124 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "6160", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xd0\\xb9i\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00b\"\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xbai\r\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 31125 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "6160", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocServer32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocServer32" } ], "repeated": 0, "id": 31126 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "6160", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002262" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 31127 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "6160", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002414" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00002262" }, { "name": "ObjectAttributesName", "value": "InprocServer32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocServer32" } ], "repeated": 0, "id": 31128 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "6160", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002416" }, { "name": "ValueName", "value": "InprocServer32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\InprocServer32" } ], "repeated": 0, "id": 31129 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "6160", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002416" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 31130 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "6160", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002416" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "C:\\Windows\\System32\\OneCoreUAPCommonProxyStub.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 31131 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "6160", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d8d32", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002416" }, { "name": "ValueName", "value": "ThreadingModel" }, { "name": "Data", "value": "Both" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\ThreadingModel" } ], "repeated": 0, "id": 31132 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "6160", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002262" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 31133 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "6160", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00002262" }, { "name": "ObjectAttributesName", "value": "InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler32" } ], "repeated": 0, "id": 31134 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "6160", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002262" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 31135 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "6160", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002262" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 31136 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "6160", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x10\\xb9i\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00b\"\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xbai\r\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 31137 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "6160", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler" } ], "repeated": 0, "id": 31138 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "6160", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002262" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 31139 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "6160", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00002262" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler" } ], "repeated": 0, "id": 31140 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "6160", "caller": "0x7fff584d8010", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002262" } ], "repeated": 0, "id": 31141 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "6160", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 31142 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "6160", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000360" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 31143 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "2192", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e2" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "Ptype_PSFactory" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\(Default)" } ], "repeated": 0, "id": 31144 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "2192", "caller": "0x7fff584d8485", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000022e2" }, { "name": "SubKey", "value": "InprocServer32" }, { "name": "Handle", "value": "0x00001ab6" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\InprocServer32" } ], "repeated": 0, "id": 31145 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "2192", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001ab6" }, { "name": "ValueName", "value": "InprocServer32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\InProcServer32\\InprocServer32" } ], "repeated": 0, "id": 31146 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "2192", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab6" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 31147 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "2192", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab6" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "C:\\Windows\\System32\\WinTypes.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 31148 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "2192", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d8d32", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab6" }, { "name": "ValueName", "value": "ThreadingModel" }, { "name": "Data", "value": "Both" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\InProcServer32\\ThreadingModel" } ], "repeated": 0, "id": 31149 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "2192", "caller": "0x7fff584d855f", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab6" } ], "repeated": 0, "id": 31150 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "2192", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000022e2" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 31151 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "2192", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000022e2" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 31152 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "2192", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xc9y\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\xe2\"\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xcay\r\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 31153 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "2192", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\InprocHandler32" } ], "repeated": 0, "id": 31154 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "2192", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000022e2" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 31155 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "2192", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000022e2" }, { "name": "ObjectAttributesName", "value": "InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\InprocHandler32" } ], "repeated": 0, "id": 31156 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "2192", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000022e2" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 31157 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "2192", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000022e2" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 31158 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "2192", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xc9y\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\xe2\"\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xcay\r\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 31159 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "2192", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\InprocHandler" } ], "repeated": 0, "id": 31160 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "2192", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000022e2" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 31161 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "2192", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000022e2" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\InprocHandler" } ], "repeated": 0, "id": 31162 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "2192", "caller": "0x7fff584d8010", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e2" } ], "repeated": 0, "id": 31163 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "2192", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x08\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2192" } ], "repeated": 0, "id": 31164 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 31165 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "2192", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x08\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2192" } ], "repeated": 0, "id": 31166 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 31167 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000360" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 31168 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 31169 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 31170 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "6160", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff584fb0ca", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 31171 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "2192", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x08\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2192" } ], "repeated": 0, "id": 31172 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "6160", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 31173 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "6160", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000360" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 31174 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "2192", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x08\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2192" } ], "repeated": 0, "id": 31175 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 31176 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58085ee4", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002048" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 31177 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 31178 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "4620", "caller": "0x7fff425966ba", "parentcaller": "0x7fff425c804a", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "25" }, { "name": "ProcessInformation", "value": "\\x01" } ], "repeated": 1, "id": 31179 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 31180 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "5000", "caller": "0x7fff42595b7f", "parentcaller": "0x7fff42595aa9", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CloudExperienceHost" }, { "name": "Handle", "value": "0x00002408" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CloudExperienceHost" } ], "repeated": 0, "id": 31181 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002408" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 31182 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00002408" }, { "name": "ObjectAttributesName", "value": "Fullscreen" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CloudExperienceHost\\Fullscreen" } ], "repeated": 0, "id": 31183 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "5000", "caller": "0x7fff426bfce2", "parentcaller": "0x7fff42595aa9", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002408" } ], "repeated": 0, "id": 31184 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "5000", "caller": "0x7fff4274356a", "parentcaller": "0x7fff42799839", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x00000002", "pretty_value": "KEY_SET_VALUE" }, { "name": "Handle", "value": "0x00002408" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 31185 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "5000", "caller": "0x7fff427435a9", "parentcaller": "0x7fff42799839", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002408" }, { "name": "ValueName", "value": "TraySearchBoxVisible" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Buffer", "value": "0" }, { "name": "BufferLength", "value": "4" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\TraySearchBoxVisible" } ], "repeated": 0, "id": 31186 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "5000", "caller": "0x7fff427435c1", "parentcaller": "0x7fff42799839", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002408" } ], "repeated": 0, "id": 31187 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 31188 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 31189 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002408" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced" } ], "repeated": 0, "id": 31190 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "5000", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff425e8fa6", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002408" }, { "name": "ValueName", "value": "TaskbarSmallIcons" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\TaskbarSmallIcons" } ], "repeated": 0, "id": 31191 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "5000", "caller": "0x7fff577d3018", "parentcaller": "0x7fff425e8fa6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002408" } ], "repeated": 0, "id": 31192 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 31193 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 31194 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" } ], "repeated": 0, "id": 31195 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 31196 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 31197 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002408" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" } ], "repeated": 0, "id": 31198 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "5000", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002408" }, { "name": "ValueName", "value": "Current" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Current" } ], "repeated": 0, "id": 31199 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "5000", "caller": "0x7fff577d3018", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002408" } ], "repeated": 0, "id": 31200 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 31201 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 31202 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002408" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" } ], "repeated": 0, "id": 31203 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "5000", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff425d8e48", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002408" }, { "name": "ValueName", "value": "ColorPrevalence" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\\ColorPrevalence" } ], "repeated": 0, "id": 31204 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "5000", "caller": "0x7fff577d3018", "parentcaller": "0x7fff425d8e48", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002408" } ], "repeated": 0, "id": 31205 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 31206 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 31207 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002408" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" } ], "repeated": 0, "id": 31208 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "5000", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff425d8ef6", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002408" }, { "name": "ValueName", "value": "AppsUseLightTheme" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\\AppsUseLightTheme" } ], "repeated": 0, "id": 31209 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "5000", "caller": "0x7fff577d3018", "parentcaller": "0x7fff425d8ef6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002408" } ], "repeated": 0, "id": 31210 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 31211 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 31212 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002408" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced" } ], "repeated": 0, "id": 31213 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "5000", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff425da184", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002408" }, { "name": "ValueName", "value": "HideFileExt" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\HideFileExt" } ], "repeated": 0, "id": 31214 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "5000", "caller": "0x7fff577d3018", "parentcaller": "0x7fff425da184", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002408" } ], "repeated": 0, "id": 31215 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 31216 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 31217 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002408" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search" } ], "repeated": 0, "id": 31218 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "5000", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff425940dd", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002408" }, { "name": "ValueName", "value": "SearchboxTaskbarMode" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\SearchboxTaskbarMode" } ], "repeated": 0, "id": 31219 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "5000", "caller": "0x7fff577d3018", "parentcaller": "0x7fff425940dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002408" } ], "repeated": 0, "id": 31220 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 31221 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "4620", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 31222 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 31223 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58085ee4", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002048" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 31224 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "2192", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x08\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2192" } ], "repeated": 0, "id": 31225 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "4620", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff517e2bd6", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002710" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "6136" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" } ], "repeated": 0, "id": 31226 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "4620", "caller": "0x7fff5781026b", "parentcaller": "0x7fff517e2c2a", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002710" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000024cc" } ], "repeated": 0, "id": 31227 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "4620", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff517e2c87", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 31228 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "4620", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff517e29b1", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002710" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "6136" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" } ], "repeated": 0, "id": 31229 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "4620", "caller": "0x7fff5781026b", "parentcaller": "0x7fff517e29fb", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002710" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000024cc" } ], "repeated": 0, "id": 31230 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "4620", "caller": "0x7fff59f9413e", "parentcaller": "0x7fff517e2a39", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 31231 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "4620", "caller": "0x7fff59f9416d", "parentcaller": "0x7fff517e2a39", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "31" }, { "name": "TokenInformation", "value": "\\xd8\\xf3 \\x03\\x00\\x00\\x00\\x00\\x01\\x08\\x00\\x00\\x00\\x00\\x00\\x0f\\x02\\x00\\x00\\x00<\\xe6\\xf3\\x1f\\x8a.\\x82*u\\xa8\\x8a?\\x1b(\\xed\\xbf9\\x8fA\\x14\\x0c\\xfc9u]5\n`\\x10'\\x00\\x00\\x00\\x00\\x00\\x00\\xc2Tc\\x1a\\xff\\x7f\\x00\\x00\\x10'\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 31232 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "4620", "caller": "0x7fff59f941a8", "parentcaller": "0x7fff517e2a39", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "42" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 31233 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "4620", "caller": "0x7fff59f941df", "parentcaller": "0x7fff517e2a39", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "12" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 31234 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "4620", "caller": "0x7fff59f94256", "parentcaller": "0x7fff517e2a39", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "44" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x1c*y^t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xc8\\xf9 \\x03\\x00\\x00\\x00\\x00\\xf8\\x17\\x00\\x00\\x00\\x00\\x00\\x00@b\\x88\\x10\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 31235 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "4620", "caller": "0x7fff577cf588", "parentcaller": "0x7fff517ead8b", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002710" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "Global\\Session\\1\\AppContainerNamedObjects\\S-1-15-2-536077884-713174666-1066051701-3219990555-339840825-1966734348-1611281757\\17f8HWNDInterface:1019e" } ], "repeated": 0, "id": 31236 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "4620", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c232", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002710" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09fe0000" }, { "name": "SectionOffset", "value": "0x0320f950" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 31237 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "4620", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff517eae5e", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09fe0000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 31238 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "2192", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x08\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2192" } ], "repeated": 0, "id": 31239 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "2336", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00 \t\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2336" } ], "repeated": 0, "id": 31240 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "2192", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x08\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2192" } ], "repeated": 0, "id": 31241 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "2336", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00 \t\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2336" } ], "repeated": 0, "id": 31242 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 31243 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58085ee4", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002048" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 31244 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "4620", "caller": "0x7fff4cbd12d2", "parentcaller": "0x7fff577adc16", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache" }, { "name": "Handle", "value": "0x00002408" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache" } ], "repeated": 0, "id": 31245 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "2192", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x08\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2192" } ], "repeated": 0, "id": 31246 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "4620", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002408" }, { "name": "KeyInformation", "value": "\\x00\\x01\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 31247 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "4620", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002260" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00002408" }, { "name": "ObjectAttributesName", "value": "Metadata" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Metadata" } ], "repeated": 0, "id": 31248 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "4696", "caller": "0x7ff79be2976d", "parentcaller": "0x7ff79be29c11", "category": "synchronization", "api": "NtOpenEvent", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "Handle", "value": "0x035cdb80" }, { "name": "EventName", "value": "Local\\1ImmersiveFocusTrackingActiveEvent" } ], "repeated": 0, "id": 31249 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577af579", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002408" }, { "name": "SubKey", "value": "Package\\Index\\PackageFullName\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy" }, { "name": "Handle", "value": "0x00002414" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Index\\PackageFullName\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy" } ], "repeated": 0, "id": 31250 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "4696", "caller": "0x7ff79be2976d", "parentcaller": "0x7ff79be29c11", "category": "misc", "api": "GetKeyboardLayout", "status": true, "return": "0x04090409", "arguments": [ { "name": "KeyboardLayout", "value": "0x00000409" }, { "name": "LanguageName", "value": "English (United States)" } ], "repeated": 0, "id": 31251 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "4620", "caller": "0x7fff4cbd1732", "parentcaller": "0x7fff577af7dc", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002414" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "1a" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Index\\PackageFullName\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\\1a" } ], "repeated": 0, "id": 31252 }, { "timestamp": "2026-05-29 01:06:12,524", "thread_id": "4620", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577af5fd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002414" } ], "repeated": 0, "id": 31253 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577af308", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002408" }, { "name": "SubKey", "value": "Package\\Data\\1a" }, { "name": "Handle", "value": "0x00002414" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\1a" } ], "repeated": 0, "id": 31254 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4696", "caller": "0x7ff79be2976d", "parentcaller": "0x7ff79be29c11", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 31255 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4696", "caller": "0x7ff79be2976d", "parentcaller": "0x7ff79be29c11", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002710" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 31256 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4620", "caller": "0x7fff4cbd16ad", "parentcaller": "0x7fff5781d320", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002414" }, { "name": "ValueName", "value": "PackageOrigin" }, { "name": "Data", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\1a\\PackageOrigin" } ], "repeated": 0, "id": 31257 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "2192", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x08\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2192" } ], "repeated": 0, "id": 31258 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 31259 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4620", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577aed38", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002414" } ], "repeated": 0, "id": 31260 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4620", "caller": "0x7fff4cbd17f2", "parentcaller": "0x7fff577adcce", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002260" } ], "repeated": 0, "id": 31261 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4620", "caller": "0x7fff4cbd180b", "parentcaller": "0x7fff577adcce", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002408" } ], "repeated": 0, "id": 31262 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4620", "caller": "0x7fff59f93f7a", "parentcaller": "0x7fff59770ed7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 31263 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4620", "caller": "0x7fff59770cd1", "parentcaller": "0x7fff597a1530", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00002408" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 31264 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4620", "caller": "0x7fff5781026b", "parentcaller": "0x7fff59770daf", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002260" } ], "repeated": 0, "id": 31265 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4620", "caller": "0x7fff59f88cde", "parentcaller": "0x7fff59fc9c4e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": " \\xf1\\x02\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 31266 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4620", "caller": "0x7fff59fb6e9b", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "p\\x85\\xa7\\x0c\\x00\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xf7\\xa7\\x0c" } ], "repeated": 0, "id": 31267 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4620", "caller": "0x7fff59fb6ec0", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 31268 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4620", "caller": "0x7fff59fb6f0e", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xc8\\xfe\\xa6\\x0c\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 31269 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4620", "caller": "0x7fff59fb6f37", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 31270 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4620", "caller": "0x7fff59fb6f8f", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "h\\x88\\xa7\\x0c\\x00\\x00\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 31271 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4620", "caller": "0x7fff59fb7048", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x81\\x1a\\xff\\x7f\\x00\\x00\\xebPY\\x1a\\xff\\x7f\\x00\\x00\\x889*y^t\\x00\\x00(N}\\x1a\\xff\\x7f\\x00\\x00\\xd0\\xdc \\x03\\x00\\x00\\x00\\x00\\xc8\\xdc \\x03\\x00\\x00\\x00\\x00\\x98\\xdc \\x03\\x00\\x00\\x00\\x00\\xb8\\xdc \\x03" } ], "repeated": 0, "id": 31272 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4620", "caller": "0x7fff59fb707b", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\x88\\xa7\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8Z\\x1a\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xb8\\xda \\x03\\x00\\x00\\x00\\x00`\"\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00$\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2}\\x1a" } ], "repeated": 0, "id": 31273 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4620", "caller": "0x7fff59f88cde", "parentcaller": "0x7fff59f8953a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": " \\xf1\\x02\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 31274 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4620", "caller": "0x7fff59fb6e46", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\x88\\x86\\xa7\\x0c\\x00\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x008\\x0e\\xe4R\\xff\\x7f\\x00\\x00\\xe8\\x9f7G\\xff\\x7f\\x00\\x00 \\x0f\\xa7\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00$QB\\x16\\xaa\\x86\t,\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x0e\\xe4R" } ], "repeated": 0, "id": 31275 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4620", "caller": "0x7fff59fb6e9b", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xd0\\x8e\\xa7\\x0c\\x00\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xa07G" } ], "repeated": 0, "id": 31276 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4620", "caller": "0x7fff59fb6ec0", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 31277 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4620", "caller": "0x7fff59fb6f0e", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\x18\\x00\\xa7\\x0c\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 31278 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4620", "caller": "0x7fff59fb6f37", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 31279 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4620", "caller": "0x7fff59fb6f8f", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xe8\\x80\\xa7\\x0c\\x00\\x00\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 31280 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4620", "caller": "0x7fff59fb7048", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x81\\x1a\\xff\\x7f\\x00\\x00\\xebPY\\x1a\\xff\\x7f\\x00\\x00h=*y^t\\x00\\x00(N}\\x1a\\xff\\x7f\\x00\\x000\\xd9 \\x03\\x00\\x00\\x00\\x00(\\xd9 \\x03\\x00\\x00\\x00\\x00\\xf8\\xd8 \\x03\\x00\\x00\\x00\\x00\\x18\\xd9 \\x03" } ], "repeated": 0, "id": 31281 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4620", "caller": "0x7fff59fb707b", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\x80\\xa7\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8Z\\x1a\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x18\\xd7 \\x03\\x00\\x00\\x00\\x00`\"\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00$\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2}\\x1a" } ], "repeated": 0, "id": 31282 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4620", "caller": "0x7fff597a1630", "parentcaller": "0x7fff597a12cd", "category": "system", "api": "NtQuerySystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 31283 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "2336", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00 \t\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2336" } ], "repeated": 0, "id": 31284 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "2336", "caller": "0x7fff425966ba", "parentcaller": "0x7fff425c804a", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "25" }, { "name": "ProcessInformation", "value": "\\x01" } ], "repeated": 1, "id": 31285 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4620", "caller": "0x7fff59767be3", "parentcaller": "0x7fff597a15ab", "category": "system", "api": "NtQuerySystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 31286 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "5108", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002260" }, { "name": "DesiredAccess", "value": "0x00000410", "pretty_value": "PROCESS_VM_READ|PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "6136" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" } ], "repeated": 0, "id": 31287 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4696", "caller": "0x7ff79bc89973", "parentcaller": "0x7ff79bc897dc", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00001016" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 31288 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "5108", "caller": "0x7fff5781026b", "parentcaller": "0x7fff42570dc8", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002260" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002408" } ], "repeated": 0, "id": 31289 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "5108", "caller": "0x7fff42570e03", "parentcaller": "0x7fff42570a6b", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 31290 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "5108", "caller": "0x7fff42570e77", "parentcaller": "0x7fff42570a6b", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\xc0\\xbd\\x85\\x0c\\x00\\x00\\x00\\x00\\x1c\\x00\\x1c\\x00\\x00\\x00\\x00\\x00`\\xbe\\x85\\x0c\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xbe\\x85\\x0c\\x00\\x00\\x00\\x00\\x12\\x00\\x12\\x00\\x00\\x00\\x00\\x00\\x96\\xbf\\x85\\x0c\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa8\\xbf\\x85\\x0c\\x00\\x00\\x00\\x00\\x1e\\x00\\x1e\\x00\\x00\\x00\\x00\\x00\\xb0\\xbf\\x85\\x0c\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xbf\\x85\\x0c\\x00\\x00\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00\\xd8\\xbf\\x85\\x0c\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\\xbf\\x85\\x0c\\x00\\x00\\x00\\x00W\\x00I\\x00N\\x00:\\x00/\\x00/\\x00S\\x00Y\\x00S\\x00A\\x00P\\x00P\\x00I\\x00D\\x00\\x00\\x00\\x00\\x00\\x88\\x00\\x88\\x00\\x00\\x00\\x00\\x00\\xb0\\xbe\\x85\\x0c\\x00\\x00\\x00\\x00\\x12\\x00\\x12\\x00\\x00\\x00\\x00\\x008\\xbf\\x85\\x0c\\x00\\x00\\x00\\x00L\\x00L\\x00\\x00\\x00\\x00\\x00J\\xbf\\x85\\x0c\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 31291 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "5108", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff426da18b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000ea0" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 31292 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000100a8" }, { "name": "Message", "value": "0x00000060" } ], "repeated": 0, "id": 31293 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4696", "caller": "0x7ff79bc76bd8", "parentcaller": "0x7ff79bc8a0c8", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00010110" }, { "name": "Message", "value": "0x0000c028" } ], "repeated": 0, "id": 31294 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4696", "caller": "0x7ff79bc76b70", "parentcaller": "0x7ff79bc8a0c8", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "WindowShouldReportLayoutCompletedTelemetryProp" }, { "name": "Atom", "value": "0x0000c058" } ], "repeated": 0, "id": 31295 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "2336", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00 \t\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2336" } ], "repeated": 0, "id": 31296 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4696", "caller": "0x7ff79bc76bd8", "parentcaller": "0x7ff79bc8a0c8", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00010110" }, { "name": "Message", "value": "0x0000c028" } ], "repeated": 0, "id": 31297 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "5000", "caller": "0x7fff57fc2eeb", "parentcaller": "0x7fff581ba00f", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "WindowShouldReportLayoutCompletedTelemetryProp" }, { "name": "Atom", "value": "0x0000c058" } ], "repeated": 0, "id": 31298 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 31299 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "2192", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x08\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2192" } ], "repeated": 0, "id": 31300 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "2192", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 31301 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 31302 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "2336", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00 \t\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2336" } ], "repeated": 0, "id": 31303 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "2336", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00 \t\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2336" } ], "repeated": 0, "id": 31304 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "5000", "caller": "0x7fff42595b7f", "parentcaller": "0x7fff42595aa9", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CloudExperienceHost" }, { "name": "Handle", "value": "0x00001b00" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CloudExperienceHost" } ], "repeated": 0, "id": 31305 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001b00" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 31306 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00001b00" }, { "name": "ObjectAttributesName", "value": "Fullscreen" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CloudExperienceHost\\Fullscreen" } ], "repeated": 0, "id": 31307 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "5000", "caller": "0x7fff426bfce2", "parentcaller": "0x7fff42595aa9", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001b00" } ], "repeated": 0, "id": 31308 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "5000", "caller": "0x7fff42595b7f", "parentcaller": "0x7fff42595aa9", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CloudExperienceHost" }, { "name": "Handle", "value": "0x00001b00" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CloudExperienceHost" } ], "repeated": 0, "id": 31309 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc68e6a", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 31310 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001b00" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 31311 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00001b00" }, { "name": "ObjectAttributesName", "value": "Fullscreen" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CloudExperienceHost\\Fullscreen" } ], "repeated": 0, "id": 31312 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "5000", "caller": "0x7fff426bfce2", "parentcaller": "0x7fff42595aa9", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001b00" } ], "repeated": 0, "id": 31313 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 31314 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "2336", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00 \t\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2336" } ], "repeated": 0, "id": 31315 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc686b4", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 31316 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xdf\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x005\\x18\\xff\\x7f\\x00\\x00X\\xe0\\\\x03\\x00\\x00\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 31317 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "2336", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00 \t\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2336" } ], "repeated": 0, "id": 31318 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002414" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 31319 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "2192", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 1, "id": 31320 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xd0\\xf1\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xa7=\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xaa\\x01\\x03I\\xff\\x7f\\x00\\x00\\xb0\\xef\\x08I\\xff\\x7f\\x00\\x00" } ], "repeated": 0, "id": 31321 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001b00" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 31322 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00001b00" }, { "name": "SubKey", "value": "Software\\Policies\\Microsoft\\InputMethod\\Settings\\JPN" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\InputMethod\\Settings\\JPN" } ], "repeated": 0, "id": 31323 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001b00" } ], "repeated": 0, "id": 31324 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4504", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff584fb0ca", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 31325 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\default\\TextInput\\ConfigureJapaneseIMEVersion" }, { "name": "Handle", "value": "0x00001b00" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\TextInput\\ConfigureJapaneseIMEVersion" } ], "repeated": 0, "id": 31326 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4504", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 31327 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4504", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000360" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 31328 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4504", "caller": "0x7fff58552db5", "parentcaller": "0x7fff58552d47", "category": "registry", "api": "RegNotifyChangeKeyValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\" }, { "name": "NotifyFilter", "value": "0x10000005" }, { "name": "WatchSubtree", "value": "1" }, { "name": "Asynchronous", "value": "1" } ], "repeated": 0, "id": 31329 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001b00" }, { "name": "ValueName", "value": "Behavior" }, { "name": "Data", "value": "73760" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\TextInput\\ConfigureJapaneseIMEVersion\\Behavior" } ], "repeated": 0, "id": 31330 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4504", "caller": "0x7fff584d7b74", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000034a" }, { "name": "SubKey", "value": "CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "Handle", "value": "0x0000248a" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" } ], "repeated": 0, "id": 31331 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001b00" }, { "name": "ValueName", "value": "MergeAlgorithm" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\TextInput\\ConfigureJapaneseIMEVersion\\MergeAlgorithm" } ], "repeated": 0, "id": 31332 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4696", "caller": "0x7fff522d739f", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001b00" }, { "name": "ValueName", "value": "RegKeyPathRedirectMapped" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\TextInput\\ConfigureJapaneseIMEVersion\\RegKeyPathRedirectMapped" } ], "repeated": 0, "id": 31333 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4504", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000248a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 31334 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4504", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xb8F\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\x8a$\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\xb9F\n\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 31335 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4504", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\TreatAs" } ], "repeated": 0, "id": 31336 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001b00" }, { "name": "ValueName", "value": "grouppolicyname" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\TextInput\\ConfigureJapaneseIMEVersion\\grouppolicyname" } ], "repeated": 0, "id": 31337 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4504", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000248a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 31338 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4504", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000248a" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\TreatAs" } ], "repeated": 0, "id": 31339 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001b00" }, { "name": "ValueName", "value": "ADMXMetadataUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\TextInput\\ConfigureJapaneseIMEVersion\\ADMXMetadataUser" } ], "repeated": 0, "id": 31340 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4504", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d81f5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000248a" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 31341 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001b00" }, { "name": "ValueName", "value": "ADMXMetadataBoth" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\TextInput\\ConfigureJapaneseIMEVersion\\ADMXMetadataBoth" } ], "repeated": 0, "id": 31342 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4504", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000248a" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)" } ], "repeated": 0, "id": 31343 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4504", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000248a" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "PSFactoryBuffer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)" } ], "repeated": 0, "id": 31344 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001b00" }, { "name": "ValueName", "value": "Value" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\TextInput\\ConfigureJapaneseIMEVersion\\Value" } ], "repeated": 0, "id": 31345 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4504", "caller": "0x7fff584d8485", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000248a" }, { "name": "SubKey", "value": "InprocServer32" }, { "name": "Handle", "value": "0x000023be" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocServer32" } ], "repeated": 0, "id": 31346 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001b00" } ], "repeated": 0, "id": 31347 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4504", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000023be" }, { "name": "ValueName", "value": "InprocServer32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\InprocServer32" } ], "repeated": 0, "id": 31348 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\TextInput" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\TextInput" } ], "repeated": 0, "id": 31349 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4504", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000023be" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 31350 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\TextInput" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\TextInput" } ], "repeated": 0, "id": 31351 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 31352 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4504", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000023be" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "C:\\Windows\\System32\\OneCoreUAPCommonProxyStub.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 31353 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 31354 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4504", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d8d32", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000023be" }, { "name": "ValueName", "value": "ThreadingModel" }, { "name": "Data", "value": "Both" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\ThreadingModel" } ], "repeated": 0, "id": 31355 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 31356 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4504", "caller": "0x7fff584d855f", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000023be" } ], "repeated": 0, "id": 31357 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4504", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000248a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 31358 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4504", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000248a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 31359 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4504", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "@\\xb7F\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\x8a$\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xb8F\n\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 31360 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4504", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler32" } ], "repeated": 0, "id": 31361 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4504", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000248a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 31362 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4696", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "synchronization", "api": "NtFindAtom", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "AtomName", "value": "Microsoft.Windows.ShellManagedWindowAsNormalWindow" }, { "name": "Atom", "value": "0x00000000" } ], "repeated": 0, "id": 31363 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4504", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000248a" }, { "name": "ObjectAttributesName", "value": "InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler32" } ], "repeated": 0, "id": 31364 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4504", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000248a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 31365 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4696", "caller": "0x7ff79bc521d5", "parentcaller": "0x7ff79bc51a67", "category": "system", "api": "GetLastInputInfo", "status": true, "return": "0x00000001", "arguments": [], "repeated": 0, "id": 31366 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4504", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000248a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 31367 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4504", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "@\\xb7F\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\x8a$\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xb8F\n\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 31368 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4504", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler" } ], "repeated": 0, "id": 31369 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4504", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000248a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 31370 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4504", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000248a" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler" } ], "repeated": 0, "id": 31371 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4696", "caller": "0x7ff79bc521fe", "parentcaller": "0x7ff79bc51a67", "category": "device", "api": "NtPowerInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "InformationLevel", "value": "16" }, { "name": "InputBuffer", "value": "" }, { "name": "OutputBuffer", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 31372 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4504", "caller": "0x7fff584d8010", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000248a" } ], "repeated": 0, "id": 31373 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4560", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff557c3a98", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\x11\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4560" } ], "repeated": 0, "id": 31374 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4696", "caller": "0x7ff79bc76bd8", "parentcaller": "0x7ff79bc8a0c8", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00010110" }, { "name": "Message", "value": "0x0000c028" } ], "repeated": 1, "id": 31375 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "5000", "caller": "0x7fff57fc2eeb", "parentcaller": "0x7fff581ba00f", "category": "synchronization", "api": "NtFindAtom", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "AtomName", "value": "Microsoft.Windows.ShellManagedWindowAsNormalWindow" }, { "name": "Atom", "value": "0x00000000" } ], "repeated": 0, "id": 31376 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "5000", "caller": "0x7fff57fc2eeb", "parentcaller": "0x7fff581ba00f", "category": "synchronization", "api": "NtFindAtom", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "AtomName", "value": "Windows.Internal.Shell.Holographic.Win32PortedView" }, { "name": "Atom", "value": "0x00000000" } ], "repeated": 1, "id": 31377 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff455848a6", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002260" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "6136" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" } ], "repeated": 0, "id": 31378 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "5000", "caller": "0x7fff5781026b", "parentcaller": "0x7fff45584920", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002260" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000024cc" } ], "repeated": 0, "id": 31379 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "5000", "caller": "0x7fff45584c45", "parentcaller": "0x7fff45584941", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 31380 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "5000", "caller": "0x7fff45584ce5", "parentcaller": "0x7fff45584941", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\xc0\\xbd\\x85\\x0c\\x00\\x00\\x00\\x00\\x1c\\x00\\x1c\\x00\\x00\\x00\\x00\\x00`\\xbe\\x85\\x0c\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xbe\\x85\\x0c\\x00\\x00\\x00\\x00\\x12\\x00\\x12\\x00\\x00\\x00\\x00\\x00\\x96\\xbf\\x85\\x0c\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa8\\xbf\\x85\\x0c\\x00\\x00\\x00\\x00\\x1e\\x00\\x1e\\x00\\x00\\x00\\x00\\x00\\xb0\\xbf\\x85\\x0c\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xbf\\x85\\x0c\\x00\\x00\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00\\xd8\\xbf\\x85\\x0c\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\\xbf\\x85\\x0c\\x00\\x00\\x00\\x00W\\x00I\\x00N\\x00:\\x00/\\x00/\\x00S\\x00Y\\x00S\\x00A\\x00P\\x00P\\x00I\\x00D\\x00\\x00\\x00\\x00\\x00\\x88\\x00\\x88\\x00\\x00\\x00\\x00\\x00\\xb0\\xbe\\x85\\x0c\\x00\\x00\\x00\\x00\\x12\\x00\\x12\\x00\\x00\\x00\\x00\\x008\\xbf\\x85\\x0c\\x00\\x00\\x00\\x00L\\x00L\\x00\\x00\\x00\\x00\\x00J\\xbf\\x85\\x0c\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 31381 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "5000", "caller": "0x7fff425ce2da", "parentcaller": "0x7fff4257d46e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 31382 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "5000", "caller": "0x7fff57fc2eeb", "parentcaller": "0x7fff581ba00f", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "MultimonitorActivationException" }, { "name": "Atom", "value": "0x0000c049" } ], "repeated": 0, "id": 31383 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 31384 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "2192", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x08\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2192" } ], "repeated": 0, "id": 31385 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 31386 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "2336", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00 \t\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2336" } ], "repeated": 0, "id": 31387 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4620", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 31388 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4620", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000360" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 31389 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "5000", "caller": "0x7fff57fcb8ed", "parentcaller": "0x7fff58085341", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x00002684", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x7fff580853d0" }, { "name": "Parameter", "value": "0x04b8b210" }, { "name": "CreationFlags", "value": "0x00000004" }, { "name": "ThreadId", "value": "2584" }, { "name": "ProcessId", "value": "4484" } ], "repeated": 0, "id": 31390 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "5000", "caller": "0x7fff5781f430", "parentcaller": "0x7fff58085379", "category": "threading", "api": "NtResumeThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00002684" }, { "name": "SuspendCount", "value": "1" }, { "name": "ThreadId", "value": "2584" }, { "name": "ProcessId", "value": "4484" } ], "repeated": 0, "id": 31391 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58085f99", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024cc" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 31392 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4560", "caller": "0x7ff79bc79d10", "parentcaller": "0x7ff79bc79c74", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 31393 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4560", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "CLSID\\{56AD4C5D-B908-4F85-8FF1-7940C29B3BCF}\\Instance" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\CLSID\\{56AD4C5D-B908-4F85-8FF1-7940C29B3BCF}\\Instance" } ], "repeated": 0, "id": 31394 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4560", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 31395 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4560", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff58be0000", "arguments": [ { "name": "lpLibFileName", "value": "shell32.dll" }, { "name": "dwFlags", "value": "0x00004000" } ], "repeated": 0, "id": 31396 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "2584", "caller": "0x7fff59fc507d", "parentcaller": "0x7fff59fc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 31397 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4560", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "SHELL32.dll" }, { "name": "ModuleHandle", "value": "0x7fff58be0000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff58c378f0" } ], "repeated": 0, "id": 31398 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "2584", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7fff580853d0" }, { "name": "Parameter", "value": "0x04b8b210" } ], "repeated": 0, "id": 31399 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "2584", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x18\n\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2584" } ], "repeated": 0, "id": 31400 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 31401 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4560", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "{9F4C2855-9F79-4B39-A8D0-E1D42DE1D5F3} 5" }, { "name": "Atom", "value": "0x0000c067" } ], "repeated": 0, "id": 31402 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58085ee4", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002048" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 31403 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4560", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002414" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "6136" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" } ], "repeated": 0, "id": 31404 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "2192", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x08\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2192" } ], "repeated": 0, "id": 31405 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbd423", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000022c0" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "6136" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" } ], "repeated": 0, "id": 31406 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4560", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002414" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002408" } ], "repeated": 0, "id": 31407 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "5000", "caller": "0x7fff41dbd59f", "parentcaller": "0x7fff41dfc80c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001e78" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "\\Device\\Bam" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 31408 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4560", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\xc0\\xbd\\x85\\x0c\\x00\\x00\\x00\\x00\\x1c\\x00\\x1c\\x00\\x00\\x00\\x00\\x00`\\xbe\\x85\\x0c\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xbe\\x85\\x0c\\x00\\x00\\x00\\x00\\x12\\x00\\x12\\x00\\x00\\x00\\x00\\x00\\x96\\xbf\\x85\\x0c\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa8\\xbf\\x85\\x0c\\x00\\x00\\x00\\x00\\x1e\\x00\\x1e\\x00\\x00\\x00\\x00\\x00\\xb0\\xbf\\x85\\x0c\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xbf\\x85\\x0c\\x00\\x00\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00\\xd8\\xbf\\x85\\x0c\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\\xbf\\x85\\x0c\\x00\\x00\\x00\\x00W\\x00I\\x00N\\x00:\\x00/\\x00/\\x00S\\x00Y\\x00S\\x00A\\x00P\\x00P\\x00I\\x00D\\x00\\x00\\x00\\x00\\x00\\x88\\x00\\x88\\x00\\x00\\x00\\x00\\x00\\xb0\\xbe\\x85\\x0c\\x00\\x00\\x00\\x00\\x12\\x00\\x12\\x00\\x00\\x00\\x00\\x008\\xbf\\x85\\x0c\\x00\\x00\\x00\\x00L\\x00L\\x00\\x00\\x00\\x00\\x00J\\xbf\\x85\\x0c\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 31409 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4560", "caller": "0x7ff79bc79e89", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "CreateTimerQueueTimer", "status": true, "return": "0x00000001", "arguments": [ { "name": "phNewTimer", "value": "0x0c8013f0" }, { "name": "TimerQueue", "value": "0x00000000" }, { "name": "Callback", "value": "0x9bc79ab0" }, { "name": "Parameter", "value": "0x07622ee0" }, { "name": "DueTime", "value": "3000" }, { "name": "Period", "value": "0" }, { "name": "Flags", "value": "8" } ], "repeated": 0, "id": 31410 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "5000", "caller": "0x7fff41dbd603", "parentcaller": "0x7fff41dfc80c", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001e78" }, { "name": "HandleName", "value": "\\Device\\Bam" }, { "name": "IoControlCode", "value": "0x00220004" }, { "name": "InputBuffer", "value": "\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\"\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 31411 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "6160", "caller": "0x7fff58520e98", "parentcaller": "0x7fff5859b785", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 31412 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "6160", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff584fb0ca", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 31413 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "2336", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 31414 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbddbb", "category": "process", "api": "NtOpenProcess", "status": false, "return": "0xffffffffc0000022", "pretty_return": "ACCESS_DENIED", "arguments": [ { "name": "ProcessHandle", "value": "0x7fff59f75ba1" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "1048" } ], "repeated": 0, "id": 31415 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbddbb", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002684" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 31416 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbddbb", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002344" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "6136" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" } ], "repeated": 0, "id": 31417 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbddbb", "category": "process", "api": "NtOpenProcess", "status": false, "return": "0xffffffffc0000022", "pretty_return": "ACCESS_DENIED", "arguments": [ { "name": "ProcessHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "1180" } ], "repeated": 0, "id": 31418 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbddbb", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000026b0" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "5624" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" } ], "repeated": 0, "id": 31419 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbddbb", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000022a0" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "12844" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" } ], "repeated": 0, "id": 31420 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbddbb", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000231c" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "5128" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" } ], "repeated": 0, "id": 31421 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbddbb", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000025d8" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "6400" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" } ], "repeated": 0, "id": 31422 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 1, "id": 31423 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "2192", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x08\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2192" } ], "repeated": 0, "id": 31424 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 3, "id": 31425 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "2192", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x08\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2192" } ], "repeated": 0, "id": 31426 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 3, "id": 31427 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "2192", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x08\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2192" } ], "repeated": 0, "id": 31428 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 31429 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "2192", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x08\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2192" } ], "repeated": 0, "id": 31430 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 1, "id": 31431 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "2192", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x08\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2192" } ], "repeated": 0, "id": 31432 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 2, "id": 31433 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "2192", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x08\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2192" } ], "repeated": 0, "id": 31434 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 1, "id": 31435 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "2192", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x08\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2192" } ], "repeated": 0, "id": 31436 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 31437 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "2192", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x08\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2192" } ], "repeated": 0, "id": 31438 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 3, "id": 31439 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "2192", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x08\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2192" } ], "repeated": 0, "id": 31440 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 31441 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "2192", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x08\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2192" } ], "repeated": 0, "id": 31442 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "5000", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 31443 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "5000", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "F6C29334-47DC-4397-9150-F549CF1D4861" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 31444 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 31445 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "2192", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x08\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2192" } ], "repeated": 0, "id": 31446 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "5000", "caller": "0x7fff57fc2755", "parentcaller": "0x7fff57fc2699", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "{\\x00D\\x00A\\x00D\\x00E\\x00F\\x009\\x002\\x00C\\x00-\\x002\\x002\\x007\\x00E\\x00-\\x004\\x006\\x00C\\x000\\x00-\\x009\\x003\\x00C\\x000\\x00-\\x009\\x00F\\x00F\\x00F\\x00A\\x004\\x00D\\x00C\\x000\\x007\\x00D\\x009\\x00}\\x00" }, { "name": "Size", "value": "76" }, { "name": "Atom", "value": "0x0000c04e" } ], "repeated": 0, "id": 31447 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "2336", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 31448 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "5000", "caller": "0x7fff5486cf1d", "parentcaller": "0x7fff4075ad28", "category": "system", "api": "GetSystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 2, "id": 31449 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "6160", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff584fb0ca", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 31450 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "2584", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5978ef53", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002488" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 31451 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000022c0" }, { "name": "ObjectAttributesName", "value": "Fullscreen" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CloudExperienceHost\\Fullscreen" } ], "repeated": 0, "id": 31452 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "5000", "caller": "0x7fff426bfce2", "parentcaller": "0x7fff42595b24", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022c0" } ], "repeated": 0, "id": 31453 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "2336", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 31454 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 31455 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58085ee4", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002048" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 31456 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "6160", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x18\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6160" } ], "repeated": 0, "id": 31457 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "6160", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x18\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6160" } ], "repeated": 0, "id": 31458 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "2584", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000100c4" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 31459 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "5000", "caller": "0x7fff57fc2755", "parentcaller": "0x7fff57fc2699", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "{\\x00C\\x005\\x006\\x00C\\x005\\x007\\x009\\x009\\x00-\\x004\\x00B\\x00B\\x003\\x00-\\x007\\x00F\\x00A\\x00E\\x00-\\x007\\x00F\\x00A\\x00D\\x00-\\x004\\x00D\\x00B\\x002\\x00F\\x006\\x00A\\x005\\x003\\x00E\\x00F\\x00F\\x00}\\x00" }, { "name": "Size", "value": "76" }, { "name": "Atom", "value": "0x0000c05f" } ], "repeated": 0, "id": 31460 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "2336", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 1, "id": 31461 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "5000", "caller": "0x7fff57fc2755", "parentcaller": "0x7fff57fc2699", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "{\\x00C\\x005\\x006\\x00C\\x005\\x007\\x009\\x009\\x00-\\x004\\x00B\\x00B\\x003\\x00-\\x007\\x00F\\x00A\\x00E\\x00-\\x007\\x00F\\x00A\\x00D\\x00-\\x004\\x00D\\x00B\\x002\\x00F\\x006\\x00A\\x005\\x003\\x00E\\x00F\\x00F\\x00}\\x00" }, { "name": "Size", "value": "76" }, { "name": "Atom", "value": "0x0000c05f" } ], "repeated": 0, "id": 31462 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "2584", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000100c4" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 31463 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4504", "caller": "0x7fff58520e98", "parentcaller": "0x7fff5859b785", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 1, "id": 31464 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff517e2bd6", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001e78" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "6136" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" } ], "repeated": 0, "id": 31465 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "5000", "caller": "0x7fff5781026b", "parentcaller": "0x7fff517e2c2a", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001e78" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002308" } ], "repeated": 0, "id": 31466 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "2584", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000100c4" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 31467 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "5000", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff517e2c87", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 31468 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff517e29b1", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001e78" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "6136" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" } ], "repeated": 0, "id": 31469 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "5000", "caller": "0x7fff5781026b", "parentcaller": "0x7fff517e29fb", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001e78" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002308" } ], "repeated": 0, "id": 31470 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "5000", "caller": "0x7fff59f9413e", "parentcaller": "0x7fff517e2a39", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 31471 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "5000", "caller": "0x7fff59f9416d", "parentcaller": "0x7fff517e2a39", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "31" }, { "name": "TokenInformation", "value": "\\x98\\xdf\\x19\\x08\\x00\\x00\\x00\\x00\\x01\\x08\\x00\\x00\\x00\\x00\\x00\\x0f\\x02\\x00\\x00\\x00<\\xe6\\xf3\\x1f\\x8a.\\x82*u\\xa8\\x8a?\\x1b(\\xed\\xbf9\\x8fA\\x14\\x0c\\xfc9u]5\n`x\\x1e\\x00\\x00\\x00\\x00\\x00\\x00\\xc2Tc\\x1a\\xff\\x7f\\x00\\x00x\\x1e\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 31472 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "5000", "caller": "0x7fff59f941a8", "parentcaller": "0x7fff517e2a39", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "42" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 31473 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "5000", "caller": "0x7fff59f941df", "parentcaller": "0x7fff517e2a39", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "12" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 31474 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "5000", "caller": "0x7fff59f94256", "parentcaller": "0x7fff517e2a39", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "44" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb1&\\xfaY\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x880\\x13r^t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\xe5\\x19\\x08\\x00\\x00\\x00\\x00\\xf8\\x17\\x00\\x00\\x00\\x00\\x00\\x00@b\\x88\\x10\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 31475 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "2584", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000100c4" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 31476 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "5000", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c232", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001e78" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09fe0000" }, { "name": "SectionOffset", "value": "0x0819e510" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 31477 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "2584", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x18\n\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2584" } ], "repeated": 0, "id": 31478 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "5000", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff517eae5e", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09fe0000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 31479 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "5000", "caller": "0x7fff58519794", "parentcaller": "0x7fff517eb1dd", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "F6C29334-47DC-4397-9150-F549CF1D4861" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 31480 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 31481 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "2192", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x08\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2192" } ], "repeated": 0, "id": 31482 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "2336", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 2, "id": 31483 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "2336", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00 \t\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2336" } ], "repeated": 0, "id": 31484 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 31485 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "2192", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 31486 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4504", "caller": "0x7ff79bcd3bb4", "parentcaller": "0x00000000", "category": "registry", "api": "RegNotifyChangeKeyValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\" }, { "name": "NotifyFilter", "value": "0x10000005" }, { "name": "WatchSubtree", "value": "1" }, { "name": "Asynchronous", "value": "1" } ], "repeated": 1, "id": 31487 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4504", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd15e8a", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 3, "id": 31488 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "5000", "caller": "0x7fff4274356a", "parentcaller": "0x7fff42799839", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x00000002", "pretty_value": "KEY_SET_VALUE" }, { "name": "Handle", "value": "0x00001b00" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 31489 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4504", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd15e8a", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 1, "id": 31490 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "5000", "caller": "0x7fff427435c1", "parentcaller": "0x7fff42799839", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001b00" } ], "repeated": 0, "id": 31491 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4504", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd15e8a", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001e78" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search" } ], "repeated": 0, "id": 31492 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 31493 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001b00" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced" } ], "repeated": 0, "id": 31494 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "2440", "caller": "0x7fff58520e98", "parentcaller": "0x7fff5859b785", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 31495 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "6148", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd15e8a", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000271c" }, { "name": "ValueName", "value": "BackgroundAppGlobalToggle" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\BackgroundAppGlobalToggle" } ], "repeated": 0, "id": 31496 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "5000", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff425e8fa6", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001b00" }, { "name": "ValueName", "value": "TaskbarSmallIcons" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\TaskbarSmallIcons" } ], "repeated": 0, "id": 31497 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "4504", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd15e8a", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001e78" } ], "repeated": 0, "id": 31498 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "6148", "caller": "0x7ff79bc55095", "parentcaller": "0x7ff79bd15e8a", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000271c" } ], "repeated": 0, "id": 31499 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "5000", "caller": "0x7fff577d3018", "parentcaller": "0x7fff425e8fa6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001b00" } ], "repeated": 0, "id": 31500 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 31501 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 31502 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" } ], "repeated": 0, "id": 31503 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 31504 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 31505 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001b00" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" } ], "repeated": 0, "id": 31506 }, { "timestamp": "2026-05-29 01:06:12,540", "thread_id": "5000", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001b00" }, { "name": "ValueName", "value": "Current" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Current" } ], "repeated": 0, "id": 31507 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "5000", "caller": "0x7fff577d3018", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001b00" } ], "repeated": 0, "id": 31508 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "5000", "caller": "0x7fff4bfd299f", "parentcaller": "0x7fff425e9098", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Accessibility" }, { "name": "Handle", "value": "0x00001b00" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Accessibility" } ], "repeated": 0, "id": 31509 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff4bfd2a24", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001b00" }, { "name": "ValueName", "value": "TextScaleFactor" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Accessibility\\TextScaleFactor" } ], "repeated": 0, "id": 31510 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "5000", "caller": "0x7fff4bfd2a6a", "parentcaller": "0x7fff425e9098", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001b00" } ], "repeated": 0, "id": 31511 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 31512 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 31513 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" } ], "repeated": 0, "id": 31514 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 31515 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 31516 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001b00" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" } ], "repeated": 0, "id": 31517 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "5000", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001b00" }, { "name": "ValueName", "value": "Current" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Current" } ], "repeated": 0, "id": 31518 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "5000", "caller": "0x7fff577d3018", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001b00" } ], "repeated": 0, "id": 31519 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 31520 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 31521 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "4696", "caller": "0x7ff79bc1faf5", "parentcaller": "0x7ff79bc1fa75", "category": "synchronization", "api": "NtOpenMutant", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "Handle", "value": "0x7ff79bc7fc22" }, { "name": "MutexName", "value": "Local\\__DDrawCheckExclMode__" } ], "repeated": 0, "id": 31522 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" } ], "repeated": 0, "id": 31523 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "4696", "caller": "0x7ff79bc19217", "parentcaller": "0x7ff79bc1fa94", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 2, "id": 31524 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 31525 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000271c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" } ], "repeated": 0, "id": 31526 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "5000", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000271c" }, { "name": "ValueName", "value": "Current" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Current" } ], "repeated": 0, "id": 31527 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "4696", "caller": "0x7ff79bc19217", "parentcaller": "0x7ff79bc1fa94", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001e78" }, { "name": "DesiredAccess", "value": "0x00000101", "pretty_value": "KEY_QUERY_VALUE|KEY_WOW64_64KEY" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\RetailDemo\\OobeWrite" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\RetailDemo\\OobeWrite" } ], "repeated": 0, "id": 31528 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 31529 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "4696", "caller": "0x7ff79bc19217", "parentcaller": "0x7ff79bc1fa94", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001e78" }, { "name": "ValueName", "value": "Enabled" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RetailDemo\\OobeWrite\\Enabled" } ], "repeated": 0, "id": 31530 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "4696", "caller": "0x7ff79bc19217", "parentcaller": "0x7ff79bc1fa94", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001e78" } ], "repeated": 0, "id": 31531 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 31532 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "4696", "caller": "0x7ff79bc19232", "parentcaller": "0x7ff79bc1fa94", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 31533 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" } ], "repeated": 0, "id": 31534 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 31535 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 31536 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000023bc" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" } ], "repeated": 0, "id": 31537 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "4696", "caller": "0x7ff79bc89973", "parentcaller": "0x7ff79bc897dc", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00001016" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 31538 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "5000", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000023bc" }, { "name": "ValueName", "value": "Current" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Current" } ], "repeated": 0, "id": 31539 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "4696", "caller": "0x7ff79bc89973", "parentcaller": "0x7ff79bc897dc", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00001018" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 31540 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "5000", "caller": "0x7fff577d3018", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000023bc" } ], "repeated": 0, "id": 31541 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "5000", "caller": "0x7fff4bfd299f", "parentcaller": "0x7fff425e9098", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Accessibility" }, { "name": "Handle", "value": "0x000023bc" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Accessibility" } ], "repeated": 0, "id": 31542 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff4bfd2a24", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000023bc" }, { "name": "ValueName", "value": "TextScaleFactor" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Accessibility\\TextScaleFactor" } ], "repeated": 0, "id": 31543 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "5000", "caller": "0x7fff4bfd2a6a", "parentcaller": "0x7fff425e9098", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000023bc" } ], "repeated": 0, "id": 31544 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 31545 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 31546 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" } ], "repeated": 0, "id": 31547 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 31548 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 31549 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000023bc" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" } ], "repeated": 0, "id": 31550 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "5000", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000023bc" }, { "name": "ValueName", "value": "Current" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Current" } ], "repeated": 0, "id": 31551 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "5000", "caller": "0x7fff577d3018", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000023bc" } ], "repeated": 0, "id": 31552 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 31553 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 31554 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" } ], "repeated": 0, "id": 31555 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 31556 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 31557 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000023bc" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" } ], "repeated": 0, "id": 31558 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "5000", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000023bc" }, { "name": "ValueName", "value": "Current" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Current" } ], "repeated": 0, "id": 31559 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "5000", "caller": "0x7fff577d3018", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000023bc" } ], "repeated": 0, "id": 31560 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 31561 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 31562 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" } ], "repeated": 0, "id": 31563 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 31564 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 31565 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000023bc" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" } ], "repeated": 0, "id": 31566 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "5000", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000023bc" }, { "name": "ValueName", "value": "Current" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Current" } ], "repeated": 0, "id": 31567 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "5000", "caller": "0x7fff577d3018", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000023bc" } ], "repeated": 0, "id": 31568 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 31569 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58085ee4", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002048" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 31570 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "2336", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00 \t\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2336" } ], "repeated": 0, "id": 31571 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "2336", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00 \t\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2336" } ], "repeated": 0, "id": 31572 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "2192", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 31573 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "5000", "caller": "0x7fff58519794", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "F6C29334-47DC-4397-9150-F549CF1D4861" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 31574 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 31575 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "2192", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x08\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2192" } ], "repeated": 1, "id": 31576 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "2192", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 1, "id": 31577 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 31578 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58085ee4", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002048" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 31579 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "2336", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00 \t\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2336" } ], "repeated": 0, "id": 31580 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "5000", "caller": "0x7fff577cf84f", "parentcaller": "0x7fff425db035", "category": "synchronization", "api": "NtOpenEvent", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "Handle", "value": "0x00000000" }, { "name": "EventName", "value": "ShellSearchReadyEvent" } ], "repeated": 0, "id": 31581 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "2336", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00 \t\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2336" } ], "repeated": 0, "id": 31582 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "2192", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 31583 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "2192", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x08\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2192" } ], "repeated": 0, "id": 31584 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "5000", "caller": "0x7fff5486c24a", "parentcaller": "0x7fff54899913", "category": "system", "api": "GetSystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 31585 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "2192", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x08\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2192" } ], "repeated": 0, "id": 31586 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 31587 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 31588 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000271c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Input" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Input" } ], "repeated": 0, "id": 31589 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "5000", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000271c" }, { "name": "ValueName", "value": "InputAppId" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Input\\InputAppId" } ], "repeated": 0, "id": 31590 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "5000", "caller": "0x7fff577d3018", "parentcaller": "0x7fff42900714", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000271c" } ], "repeated": 0, "id": 31591 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff5781026b", "parentcaller": "0x7fff43953518", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x0000000a" }, { "name": "TokenHandle", "value": "0x00002128" } ], "repeated": 0, "id": 31592 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff4258f854", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000271c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 31593 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff59f8fd9e", "parentcaller": "0x7fff5992d7d3", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002128" }, { "name": "DesiredAccess", "value": "0x80000000", "pretty_value": "0x80000000" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\SecurityManager\\AdminCapabilities" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SecurityManager\\AdminCapabilities" } ], "repeated": 0, "id": 31594 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff59f8fdc8", "parentcaller": "0x7fff5992d7d3", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00002128" }, { "name": "ValueName", "value": "packageQuery" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\AdminCapabilities\\packageQuery" } ], "repeated": 0, "id": 31595 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff59f8c6d8", "parentcaller": "0x7fff59f8fed4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xeaQ\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00 \\x02\\x00\\x00^{\t)\\xdd\\x82\\xdf\\xd4\\xceAI\\xd8\\x0eg\\xd6/\\xe3\\xe1\\x97r8\\x8aJ\\x0cy\\x0b\\xd0\\xc6\\x00\\x00\\x18\\x00\\x01\\x00\\x00\\x00\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 31596 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff43954325", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 31597 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff43954373", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xa0\")\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00" } ], "repeated": 0, "id": 31598 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x18\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6148" } ], "repeated": 0, "id": 31599 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "2336", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00 \t\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2336" } ], "repeated": 0, "id": 31600 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "2336", "caller": "0x7fff5855dd9d", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002720" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000430" }, { "name": "ObjectAttributesName", "value": "Windows.Internal.StateRepository.AppExtension" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.AppExtension" } ], "repeated": 0, "id": 31601 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "2336", "caller": "0x7fff5855ddf7", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002720" }, { "name": "KeyInformation", "value": "y\\x1f\\x10\\xffd4\\xffde\\xffac\\xffd5\\x01\\x00\\x00\\x00\\x00Z\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00I\\x00n\\x00t\\x00e\\x00r\\x00n\\x00a\\x00l\\x00.\\x00S\\x00t\\x00a\\x00t\\x00e\\x00R\\x00e\\x00p\\x00o\\x00s\\x00i\\x00t\\x00o\\x00r\\x00y\\x00.\\x00A\\x00p\\x00p\\x00E\\x00x\\x00t\\x00e\\x00n\\x00s\\x00i\\x00o\\x00n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffa0\\xffe3n\\x07\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x15\\x01\\x00\\x00\\x00\\x00\t\\xffec\\xff89\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffc0\\xff8a%\\x01\\x00\\x00\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\xffc4\\x02%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \r%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0EzX\\xffff\\x7f\\x00\\x00\\x18|\\xffad\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffe0\\xffec\\xff89\r\\x00\\x00\\x00\\x00\\xff87\\xff9dNX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffc0u\\xffad\\x0c\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff0{\\xffad\\x0c\\x00\\x00\\x00\\x00\\xffc0u\\xffad\\x0c\\x00\\x00\\x00\\x00P\\xffda\\xffc5\\x0b\\x00\\x00\\x00\\x00\\xffc7\\xffb3\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\xfff6sNX\\xffff\\x7f\\x00\\x000\\xffda\\xffb1\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffffP\\xffda\\xffc5\\x0b\\x00\\x00\\x00\\x00\\x10T\\xffad\\x0c\\x00\\x00\\x00\\x00\\x10T\\xffad\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffc0u\\xffad\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x006\\xff8cYX\\xffff\\x7f\\x00\\x00\\xffa0x\\xffb3\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xffed\\xff89\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xffed\\xff89\r\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 31602 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "2336", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002720" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.AppExtension\\ActivationType" } ], "repeated": 0, "id": 31603 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "2336", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002720" }, { "name": "ValueName", "value": "Server" }, { "name": "Data", "value": "StateRepository" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.AppExtension\\Server" } ], "repeated": 0, "id": 31604 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "2336", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff585700bb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002720" }, { "name": "ValueName", "value": "DllPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.AppExtension\\DllPath" } ], "repeated": 0, "id": 31605 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "2336", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002720" }, { "name": "ValueName", "value": "Threading" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.AppExtension\\Threading" } ], "repeated": 0, "id": 31606 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "4696", "caller": "0x7ff79bc76bd8", "parentcaller": "0x7ff79bc8a0c8", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00010110" }, { "name": "Message", "value": "0x0000c028" } ], "repeated": 0, "id": 31607 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "2336", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002720" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.AppExtension\\TrustLevel" } ], "repeated": 0, "id": 31608 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "2336", "caller": "0x7fff584bc0fc", "parentcaller": "0x7fff58554170", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00002720" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.AppExtension\\CustomAttributes" } ], "repeated": 0, "id": 31609 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "2336", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002720" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.AppExtension\\RemoteServer" } ], "repeated": 0, "id": 31610 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "2336", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002720" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.AppExtension\\ActivateAsUser" } ], "repeated": 0, "id": 31611 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "4696", "caller": "0x7ff79bc76bd8", "parentcaller": "0x7ff79bc8a0c8", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00010110" }, { "name": "Message", "value": "0x0000c028" } ], "repeated": 0, "id": 31612 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "2336", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002720" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.AppExtension\\ActivateInSharedBroker" } ], "repeated": 0, "id": 31613 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "4504", "caller": "0x7fff58520e98", "parentcaller": "0x7fff5859b785", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 31614 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "2336", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002720" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.AppExtension\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 31615 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "2336", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58562222", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002720" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.AppExtension\\Permissions" } ], "repeated": 0, "id": 31616 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "2336", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002720" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.AppExtension\\ActivateOnHostFlags" } ], "repeated": 0, "id": 31617 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "2336", "caller": "0x7fff58557226", "parentcaller": "0x7fff5855ca23", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002720" } ], "repeated": 0, "id": 31618 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "2336", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 31619 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "2336", "caller": "0x7fff584d7b74", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000034a" }, { "name": "SubKey", "value": "CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}" }, { "name": "Handle", "value": "0x00002526" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}" } ], "repeated": 0, "id": 31620 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "2336", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002526" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 31621 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "2336", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002526" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 31622 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "2336", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xa0\\xc4\\x89\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00&%\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xc5\\x89\r\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 31623 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "2336", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\TreatAs" } ], "repeated": 0, "id": 31624 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "2336", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002526" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 31625 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "2336", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00002526" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\TreatAs" } ], "repeated": 0, "id": 31626 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "2336", "caller": "0x7fff585622e1", "parentcaller": "0x7fff584d7c1d", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002526" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 31627 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "2336", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d81f5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002526" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 31628 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "2336", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002526" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\(Default)" } ], "repeated": 0, "id": 31629 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "2336", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002526" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "PSFactoryBuffer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\(Default)" } ], "repeated": 0, "id": 31630 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "2336", "caller": "0x7fff584d8485", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00002526" }, { "name": "SubKey", "value": "InprocServer32" }, { "name": "Handle", "value": "0x000026ae" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocServer32" } ], "repeated": 0, "id": 31631 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "2336", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000026ae" }, { "name": "ValueName", "value": "InprocServer32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\InprocServer32" } ], "repeated": 0, "id": 31632 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "2336", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ae" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 31633 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "2336", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ae" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "C:\\Windows\\System32\\\\Windows.StateRepositoryPS.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 31634 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "2336", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d8d32", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ae" }, { "name": "ValueName", "value": "ThreadingModel" }, { "name": "Data", "value": "Both" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\ThreadingModel" } ], "repeated": 0, "id": 31635 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "2336", "caller": "0x7fff584d855f", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ae" } ], "repeated": 0, "id": 31636 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "2336", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002526" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 31637 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "2336", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002526" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 31638 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "2336", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "0\\xc3\\x89\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00&%\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xc4\\x89\r\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 31639 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "2336", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler32" } ], "repeated": 0, "id": 31640 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "2336", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002526" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 31641 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "2336", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00002526" }, { "name": "ObjectAttributesName", "value": "InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler32" } ], "repeated": 0, "id": 31642 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "2336", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002526" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 31643 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "2336", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002526" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 31644 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "2336", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "0\\xc3\\x89\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00&%\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xc4\\x89\r\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 31645 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "2336", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler" } ], "repeated": 0, "id": 31646 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "2336", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002526" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 31647 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "2336", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00002526" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler" } ], "repeated": 0, "id": 31648 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "2336", "caller": "0x7fff584d8010", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002526" } ], "repeated": 0, "id": 31649 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "2336", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 31650 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "2336", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000360" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 31651 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "2336", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 31652 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "2336", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000360" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 31653 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "2336", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 31654 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "2336", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000360" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 31655 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "2336", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 31656 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "2336", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000360" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 31657 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "2336", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 31658 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "2336", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 31659 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "2336", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateChange\\PackageList\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateChange\\PackageList\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" } ], "repeated": 0, "id": 31660 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "2336", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00 \t\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2336" } ], "repeated": 0, "id": 31661 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 31662 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 31663 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000360" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 31664 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 31665 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000360" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 31666 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 31667 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 31668 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000360" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 31669 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 31670 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000360" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 31671 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 31672 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff5855dd9d", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002524" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000430" }, { "name": "ObjectAttributesName", "value": "Windows.Internal.StateRepository.PackageUser" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.PackageUser" } ], "repeated": 0, "id": 31673 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff5855ddf7", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002524" }, { "name": "KeyInformation", "value": "\\xfffci\\x0e\\xffd4\\xffde\\xffac\\xffd5\\x01\\x00\\x00\\x00\\x00X\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00I\\x00n\\x00t\\x00e\\x00r\\x00n\\x00a\\x00l\\x00.\\x00S\\x00t\\x00a\\x00t\\x00e\\x00R\\x00e\\x00p\\x00o\\x00s\\x00i\\x00t\\x00o\\x00r\\x00y\\x00.\\x00P\\x00a\\x00c\\x00k\\x00a\\x00g\\x00e\\x00U\\x00s\\x00e\\x00r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\xffa6\\xffb6\\x08\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x15\\x01\\x00\\x00\\x00\\x00\\xffc9\\xffe3Q\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x15%\\x01\\x00\\x00\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\xffc4\\x02%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffc0\\x0c%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0EzX\\xffff\\x7f\\x00\\x00\\xffc8'\\xffc5\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffa0\\xffe4Q\r\\x00\\x00\\x00\\x00\\xff87\\xff9dNX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffa0Y\\xffc5\\x0b\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffa0'\\xffc5\\x0b\\x00\\x00\\x00\\x00\\xffa0Y\\xffc5\\x0b\\x00\\x00\\x00\\x00\\xff90\\\\xffc3\\x0b\\x00\\x00\\x00\\x00\\xffc7\\xffb3\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\xfff6sNX\\xffff\\x7f\\x00\\x00 Z\\xffc5\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xff90\\\\xffc3\\x0b\\x00\\x00\\x00\\x00\\xff80K~\\x03\\x00\\x00\\x00\\x00\\xff80K~\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffa0Y\\xffc5\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00pX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x006\\xff8cYX\\xffff\\x7f\\x00\\x00\\xff90\\xffcd\\xffda\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\xffe5Q\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\xffe5Q\r\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 31674 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002524" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.PackageUser\\ActivationType" } ], "repeated": 0, "id": 31675 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002524" }, { "name": "ValueName", "value": "Server" }, { "name": "Data", "value": "StateRepository" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.PackageUser\\Server" } ], "repeated": 0, "id": 31676 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff585700bb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002524" }, { "name": "ValueName", "value": "DllPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.PackageUser\\DllPath" } ], "repeated": 0, "id": 31677 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002524" }, { "name": "ValueName", "value": "Threading" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.PackageUser\\Threading" } ], "repeated": 0, "id": 31678 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002524" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.PackageUser\\TrustLevel" } ], "repeated": 0, "id": 31679 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff584bc0fc", "parentcaller": "0x7fff58554170", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00002524" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.PackageUser\\CustomAttributes" } ], "repeated": 0, "id": 31680 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002524" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.PackageUser\\RemoteServer" } ], "repeated": 0, "id": 31681 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002524" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.PackageUser\\ActivateAsUser" } ], "repeated": 0, "id": 31682 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002524" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.PackageUser\\ActivateInSharedBroker" } ], "repeated": 0, "id": 31683 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002524" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.PackageUser\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 31684 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58562222", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002524" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.PackageUser\\Permissions" } ], "repeated": 0, "id": 31685 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002524" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.PackageUser\\ActivateOnHostFlags" } ], "repeated": 0, "id": 31686 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff58557226", "parentcaller": "0x7fff5855ca23", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002524" } ], "repeated": 0, "id": 31687 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 31688 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 31689 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000360" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 31690 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff4cbd12d2", "parentcaller": "0x7fff577adc16", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache" }, { "name": "Handle", "value": "0x0000237c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache" } ], "repeated": 0, "id": 31691 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff4cbd1a81", "parentcaller": "0x7fff4cbd138a", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000237c" }, { "name": "SubKey", "value": "Metadata" }, { "name": "Handle", "value": "0x00002438" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Metadata" } ], "repeated": 0, "id": 31692 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577af579", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000237c" }, { "name": "SubKey", "value": "Package\\Index\\PackageFullName\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" }, { "name": "Handle", "value": "0x00002540" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Index\\PackageFullName\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" } ], "repeated": 0, "id": 31693 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff4cbd1732", "parentcaller": "0x7fff577af7dc", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002540" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "22" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Index\\PackageFullName\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\22" } ], "repeated": 0, "id": 31694 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577af5fd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002540" } ], "repeated": 0, "id": 31695 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577af308", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000237c" }, { "name": "SubKey", "value": "Package\\Data\\22" }, { "name": "Handle", "value": "0x00002540" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\22" } ], "repeated": 0, "id": 31696 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff4cbd16ad", "parentcaller": "0x7fff5781d320", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002540" }, { "name": "ValueName", "value": "PackageOrigin" }, { "name": "Data", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\22\\PackageOrigin" } ], "repeated": 0, "id": 31697 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577aed38", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002540" } ], "repeated": 0, "id": 31698 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff4cbd17f2", "parentcaller": "0x7fff577adcce", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002438" } ], "repeated": 0, "id": 31699 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff4cbd180b", "parentcaller": "0x7fff577adcce", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000237c" } ], "repeated": 0, "id": 31700 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff5855dd9d", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000237c" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000430" }, { "name": "ObjectAttributesName", "value": "Windows.ApplicationModel.AppInfo" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.AppInfo" } ], "repeated": 0, "id": 31701 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff5855ddf7", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000237c" }, { "name": "KeyInformation", "value": "[\\xff9a\\xffe5\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00@\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00A\\x00p\\x00p\\x00l\\x00i\\x00c\\x00a\\x00t\\x00i\\x00o\\x00n\\x00M\\x00o\\x00d\\x00e\\x00l\\x00.\\x00A\\x00p\\x00p\\x00I\\x00n\\x00f\\x00o\\x00_\\x00/\\x00\\x00\\x00\\x00\\x00k\\xffb8\\xfff7Y\\xffff\\x7f\\x00\\x00^\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\xffa6\\xffb6\\x08\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x15\\x01\\x00\\x00\\x00\\x00\\xffd9\\xffe3Q\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x15%\\x01\\x00\\x00\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\xffc4\\x02%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffc0\\x0c%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0EzX\\xffff\\x7f\\x00\\x00\\xffc8\\x15\\xffc5\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0\\xffe4Q\r\\x00\\x00\\x00\\x00\\xff87\\xff9dNX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@i~\\x03\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffa0\\x15\\xffc5\\x0b\\x00\\x00\\x00\\x00@i~\\x03\\x00\\x00\\x00\\x00PO\\xffc3\\x0b\\x00\\x00\\x00\\x00\\xffc7\\xffb3\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\xfff6sNX\\xffff\\x7f\\x00\\x00\\xffa0T\\xffc5\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffffPO\\xffc3\\x0b\\x00\\x00\\x00\\x00\\xff80Y~\\x03\\x00\\x00\\x00\\x00\\xff80Y~\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@i~\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff83Y\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x006\\xff8cYX\\xffff\\x7f\\x00\\x000\\xffc4\\xffda\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffa0\\xffe5Q\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffa0\\xffe5Q\r\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 31702 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000237c" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.AppInfo\\ActivationType" } ], "repeated": 0, "id": 31703 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000237c" }, { "name": "ValueName", "value": "Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.AppInfo\\Server" } ], "repeated": 0, "id": 31704 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff585700bb", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000237c" }, { "name": "ValueName", "value": "DllPath" }, { "name": "Data", "value": "C:\\Windows\\System32\\Windows.StateRepositoryClient.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.AppInfo\\DllPath" } ], "repeated": 0, "id": 31705 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000237c" }, { "name": "ValueName", "value": "Threading" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.AppInfo\\Threading" } ], "repeated": 0, "id": 31706 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000237c" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.AppInfo\\TrustLevel" } ], "repeated": 0, "id": 31707 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff584bc0fc", "parentcaller": "0x7fff58554170", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x0000237c" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.AppInfo\\CustomAttributes" } ], "repeated": 0, "id": 31708 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000237c" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.AppInfo\\RemoteServer" } ], "repeated": 0, "id": 31709 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000237c" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.AppInfo\\ActivateAsUser" } ], "repeated": 0, "id": 31710 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000237c" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.AppInfo\\ActivateInSharedBroker" } ], "repeated": 0, "id": 31711 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000237c" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.AppInfo\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 31712 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58562222", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000237c" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.AppInfo\\Permissions" } ], "repeated": 0, "id": 31713 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000237c" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.AppInfo\\ActivateOnHostFlags" } ], "repeated": 0, "id": 31714 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff58557226", "parentcaller": "0x7fff5855ca23", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000237c" } ], "repeated": 0, "id": 31715 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 31716 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff5855dd9d", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000023bc" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000430" }, { "name": "ObjectAttributesName", "value": "Windows.ApplicationModel.AppDisplayInfo" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.AppDisplayInfo" } ], "repeated": 0, "id": 31717 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff5855ddf7", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000023bc" }, { "name": "KeyInformation", "value": "[\\xff9a\\xffe5\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00N\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00A\\x00p\\x00p\\x00l\\x00i\\x00c\\x00a\\x00t\\x00i\\x00o\\x00n\\x00M\\x00o\\x00d\\x00e\\x00l\\x00.\\x00A\\x00p\\x00p\\x00D\\x00i\\x00s\\x00p\\x00l\\x00a\\x00y\\x00I\\x00n\\x00f\\x00o\\x00\\x00\\x00]\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\xffa6\\xffb6\\x08\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x15\\x01\\x00\\x00\\x00\\x00\\xff89\\xffe2Q\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x15%\\x01\\x00\\x00\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\xffc4\\x02%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffc0\\x0c%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0EzX\\xffff\\x7f\\x00\\x00\\xff98\\x18\\xffc5\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xffe3Q\r\\x00\\x00\\x00\\x00\\xff87\\xff9dNX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffa0Q\\xffc5\\x0b\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\x18\\xffc5\\x0b\\x00\\x00\\x00\\x00\\xffa0Q\\xffc5\\x0b\\x00\\x00\\x00\\x00\\xff90W\\xffc3\\x0b\\x00\\x00\\x00\\x00\\xffc7\\xffb3\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\xfff6sNX\\xffff\\x7f\\x00\\x00\\xffa0W\\xffc5\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xff90W\\xffc3\\x0b\\x00\\x00\\x00\\x00\\xffc0^~\\x03\\x00\\x00\\x00\\x00\\xffc0^~\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffa0Q\\xffc5\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00g\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x006\\xff8cYX\\xffff\\x7f\\x00\\x00\\xfff0\\xffd1\\xffda\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xffe4Q\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xffe4Q\r\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 31718 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000023bc" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.AppDisplayInfo\\ActivationType" } ], "repeated": 0, "id": 31719 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000023bc" }, { "name": "ValueName", "value": "Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.AppDisplayInfo\\Server" } ], "repeated": 0, "id": 31720 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff585700bb", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000023bc" }, { "name": "ValueName", "value": "DllPath" }, { "name": "Data", "value": "C:\\Windows\\System32\\Windows.StateRepositoryClient.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.AppDisplayInfo\\DllPath" } ], "repeated": 0, "id": 31721 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000023bc" }, { "name": "ValueName", "value": "Threading" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.AppDisplayInfo\\Threading" } ], "repeated": 0, "id": 31722 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000023bc" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.AppDisplayInfo\\TrustLevel" } ], "repeated": 0, "id": 31723 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff584bc0fc", "parentcaller": "0x7fff58554170", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000023bc" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.AppDisplayInfo\\CustomAttributes" } ], "repeated": 0, "id": 31724 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000023bc" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.AppDisplayInfo\\RemoteServer" } ], "repeated": 0, "id": 31725 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000023bc" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.AppDisplayInfo\\ActivateAsUser" } ], "repeated": 0, "id": 31726 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000023bc" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.AppDisplayInfo\\ActivateInSharedBroker" } ], "repeated": 0, "id": 31727 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000023bc" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.AppDisplayInfo\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 31728 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58562222", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000023bc" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.AppDisplayInfo\\Permissions" } ], "repeated": 0, "id": 31729 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000023bc" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.AppDisplayInfo\\ActivateOnHostFlags" } ], "repeated": 0, "id": 31730 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff58557226", "parentcaller": "0x7fff5855ca23", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000023bc" } ], "repeated": 0, "id": 31731 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 31732 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff5855dd9d", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001e78" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000430" }, { "name": "ObjectAttributesName", "value": "Windows.Internal.StateRepository.ApplicationResourceResolver" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.ApplicationResourceResolver" } ], "repeated": 0, "id": 31733 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff5855ddf7", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001e78" }, { "name": "KeyInformation", "value": "7_\\xffea\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00x\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00I\\x00n\\x00t\\x00e\\x00r\\x00n\\x00a\\x00l\\x00.\\x00S\\x00t\\x00a\\x00t\\x00e\\x00R\\x00e\\x00p\\x00o\\x00s\\x00i\\x00t\\x00o\\x00r\\x00y\\x00.\\x00A\\x00p\\x00p\\x00l\\x00i\\x00c\\x00a\\x00t\\x00i\\x00o\\x00n\\x00R\\x00e\\x00s\\x00o\\x00u\\x00r\\x00c\\x00e\\x00R\\x00e\\x00s\\x00o\\x00l\\x00v\\x00e\\x00r\\x00\\xff99\\xffe1Q\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x15%\\x01\\x00\\x00\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\xffc4\\x02%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffc0\\x0c%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0EzX\\xffff\\x7f\\x00\\x00\\xffe81\\xffc5\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xffe2Q\r\\x00\\x00\\x00\\x00\\xff87\\xff9dNX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffa0#\\xffc2\\x0b\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffc01\\xffc5\\x0b\\x00\\x00\\x00\\x00\\xffa0#\\xffc2\\x0b\\x00\\x00\\x00\\x00\\xff90W\\xffc3\\x0b\\x00\\x00\\x00\\x00\\xffc7\\xffb3\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\xfff6sNX\\xffff\\x7f\\x00\\x00\\xffe0}\\xffbf\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xff90W\\xffc3\\x0b\\x00\\x00\\x00\\x00\\xffe0k~\\x03\\x00\\x00\\x00\\x00\\xffe0k~\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffa0#\\xffc2\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x15\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x006\\xff8cYX\\xffff\\x7f\\x00\\x00\\xff90\\xffc3\\xffda\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xffe3Q\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xffe3Q\r\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 31734 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001e78" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.ApplicationResourceResolver\\ActivationType" } ], "repeated": 0, "id": 31735 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001e78" }, { "name": "ValueName", "value": "Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.ApplicationResourceResolver\\Server" } ], "repeated": 0, "id": 31736 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff585700bb", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001e78" }, { "name": "ValueName", "value": "DllPath" }, { "name": "Data", "value": "C:\\Windows\\System32\\Windows.StateRepositoryBroker.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.ApplicationResourceResolver\\DllPath" } ], "repeated": 0, "id": 31737 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001e78" }, { "name": "ValueName", "value": "Threading" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.ApplicationResourceResolver\\Threading" } ], "repeated": 0, "id": 31738 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001e78" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.ApplicationResourceResolver\\TrustLevel" } ], "repeated": 0, "id": 31739 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff584bc0fc", "parentcaller": "0x7fff58554170", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00001e78" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.ApplicationResourceResolver\\CustomAttributes" } ], "repeated": 0, "id": 31740 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001e78" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.ApplicationResourceResolver\\RemoteServer" } ], "repeated": 0, "id": 31741 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001e78" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.ApplicationResourceResolver\\ActivateAsUser" } ], "repeated": 0, "id": 31742 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001e78" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.ApplicationResourceResolver\\ActivateInSharedBroker" } ], "repeated": 0, "id": 31743 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001e78" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.ApplicationResourceResolver\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 31744 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58562222", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001e78" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.ApplicationResourceResolver\\Permissions" } ], "repeated": 0, "id": 31745 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001e78" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.ApplicationResourceResolver\\ActivateOnHostFlags" } ], "repeated": 0, "id": 31746 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff58557226", "parentcaller": "0x7fff5855ca23", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001e78" } ], "repeated": 0, "id": 31747 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff5855dd9d", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001e78" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000430" }, { "name": "ObjectAttributesName", "value": "Windows.Internal.StateRepository.MrtApplication" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.MrtApplication" } ], "repeated": 0, "id": 31748 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff5855ddf7", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001e78" }, { "name": "KeyInformation", "value": "y\\x1f\\x10\\xffd4\\xffde\\xffac\\xffd5\\x01\\x00\\x00\\x00\\x00^\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00I\\x00n\\x00t\\x00e\\x00r\\x00n\\x00a\\x00l\\x00.\\x00S\\x00t\\x00a\\x00t\\x00e\\x00R\\x00e\\x00p\\x00o\\x00s\\x00i\\x00t\\x00o\\x00r\\x00y\\x00.\\x00M\\x00r\\x00t\\x00A\\x00p\\x00p\\x00l\\x00i\\x00c\\x00a\\x00t\\x00i\\x00o\\x00n\\x00\\x00\\x00\\xff80\\xffa6\\xffb6\\x08\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x15\\x01\\x00\\x00\\x00\\x00\\xffd9\\xffe0Q\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x15%\\x01\\x00\\x00\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\xffc4\\x02%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffc0\\x0c%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0EzX\\xffff\\x7f\\x00\\x00\\x18\\x1d\\xffc5\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0\\xffe1Q\r\\x00\\x00\\x00\\x00\\xff87\\xff9dNX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffa0\\x15\\xffc5\\x0b\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff0\\x1c\\xffc5\\x0b\\x00\\x00\\x00\\x00\\xffa0\\x15\\xffc5\\x0b\\x00\\x00\\x00\\x00\\xff90W\\xffc3\\x0b\\x00\\x00\\x00\\x00\\xffc7\\xffb3\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\xfff6sNX\\xffff\\x7f\\x00\\x00\\xffe0}\\xffbf\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xff90W\\xffc3\\x0b\\x00\\x00\\x00\\x00pk~\\x03\\x00\\x00\\x00\\x00pk~\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffa0\\x15\\xffc5\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00Q\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x006\\xff8cYX\\xffff\\x7f\\x00\\x00\\xff90\\xffcd\\xffda\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffa0\\xffe2Q\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffa0\\xffe2Q\r\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 31749 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001e78" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.MrtApplication\\ActivationType" } ], "repeated": 0, "id": 31750 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001e78" }, { "name": "ValueName", "value": "Server" }, { "name": "Data", "value": "StateRepository" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.MrtApplication\\Server" } ], "repeated": 0, "id": 31751 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff585700bb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001e78" }, { "name": "ValueName", "value": "DllPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.MrtApplication\\DllPath" } ], "repeated": 0, "id": 31752 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001e78" }, { "name": "ValueName", "value": "Threading" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.MrtApplication\\Threading" } ], "repeated": 0, "id": 31753 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001e78" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.MrtApplication\\TrustLevel" } ], "repeated": 0, "id": 31754 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff584bc0fc", "parentcaller": "0x7fff58554170", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00001e78" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.MrtApplication\\CustomAttributes" } ], "repeated": 0, "id": 31755 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001e78" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.MrtApplication\\RemoteServer" } ], "repeated": 0, "id": 31756 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001e78" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.MrtApplication\\ActivateAsUser" } ], "repeated": 0, "id": 31757 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001e78" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.MrtApplication\\ActivateInSharedBroker" } ], "repeated": 0, "id": 31758 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001e78" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.MrtApplication\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 31759 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58562222", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001e78" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.MrtApplication\\Permissions" } ], "repeated": 0, "id": 31760 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001e78" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.MrtApplication\\ActivateOnHostFlags" } ], "repeated": 0, "id": 31761 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff58557226", "parentcaller": "0x7fff5855ca23", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001e78" } ], "repeated": 0, "id": 31762 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 31763 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 31764 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000360" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 31765 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 31766 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000360" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 31767 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 31768 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 31769 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateChange\\PackageList\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateChange\\PackageList\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" } ], "repeated": 0, "id": 31770 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff577b26e8", "parentcaller": "0x7fff577b279b", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x90\\xecQ\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00c\\x00r\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00l\\x00i\\x00e\\x00n\\x00t\\x00.\\x00C\\x00B\\x00S\\x00_\\x001\\x000\\x000\\x000\\x00.\\x001\\x009\\x000\\x005\\x003\\x00" } ], "repeated": 0, "id": 31771 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 31772 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001258" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 31773 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002524" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00001258" }, { "name": "ObjectAttributesName", "value": "S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 31774 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002524" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 31775 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000026ac" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00002524" }, { "name": "ObjectAttributesName", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" } ], "repeated": 0, "id": 31776 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff577b4086", "parentcaller": "0x7fff577b27b6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002524" } ], "repeated": 0, "id": 31777 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff577b40c3", "parentcaller": "0x7fff577b27b6", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "ValueName", "value": "PackageStatus" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\PackageStatus" } ], "repeated": 0, "id": 31778 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff577b40d4", "parentcaller": "0x7fff577b27b6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" } ], "repeated": 0, "id": 31779 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x18\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6148" } ], "repeated": 0, "id": 31780 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff40432de3", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026ac" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 31781 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 31782 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "4620", "caller": "0x7fff584d7b74", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000034a" }, { "name": "SubKey", "value": "CLSID\\{11659A23-5884-4D1B-9CF6-67D6F4F90B36}" }, { "name": "Handle", "value": "0x0000237e" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{11659A23-5884-4D1B-9CF6-67D6F4F90B36}" } ], "repeated": 0, "id": 31783 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "4620", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000237e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 31784 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "4620", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000237e" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 31785 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "4620", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xa0\\xd1 \\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00~#\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xd2 \\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 31786 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "4620", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\TreatAs" } ], "repeated": 0, "id": 31787 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "4620", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000237e" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 31788 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "4620", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000237e" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\TreatAs" } ], "repeated": 0, "id": 31789 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "4620", "caller": "0x7fff585622e1", "parentcaller": "0x7fff584d7c1d", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000237e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 31790 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "4620", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d81f5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000237e" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 31791 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "4620", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000237e" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\(Default)" } ], "repeated": 0, "id": 31792 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "4620", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000237e" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "Ptype_PSFactory" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\(Default)" } ], "repeated": 0, "id": 31793 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "4620", "caller": "0x7fff584d8485", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000237e" }, { "name": "SubKey", "value": "InprocServer32" }, { "name": "Handle", "value": "0x0000243a" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\InprocServer32" } ], "repeated": 0, "id": 31794 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "4620", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000243a" }, { "name": "ValueName", "value": "InprocServer32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\InProcServer32\\InprocServer32" } ], "repeated": 0, "id": 31795 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "4620", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000243a" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 31796 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "4620", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000243a" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "C:\\Windows\\System32\\WinTypes.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 31797 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "4620", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d8d32", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000243a" }, { "name": "ValueName", "value": "ThreadingModel" }, { "name": "Data", "value": "Both" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\InProcServer32\\ThreadingModel" } ], "repeated": 0, "id": 31798 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "4620", "caller": "0x7fff584d855f", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000243a" } ], "repeated": 0, "id": 31799 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "4620", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000237e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 31800 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "4620", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000237e" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 31801 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "4620", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "0\\xd0 \\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00~#\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xd1 \\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 31802 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "4620", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\InprocHandler32" } ], "repeated": 0, "id": 31803 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "4620", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000237e" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 31804 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "4620", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000237e" }, { "name": "ObjectAttributesName", "value": "InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\InprocHandler32" } ], "repeated": 0, "id": 31805 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "4620", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000237e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 31806 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "4620", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000237e" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 31807 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "4620", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "0\\xd0 \\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00~#\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xd1 \\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 31808 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "4620", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\InprocHandler" } ], "repeated": 0, "id": 31809 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "4620", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000237e" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 31810 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "4620", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000237e" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\InprocHandler" } ], "repeated": 0, "id": 31811 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "4620", "caller": "0x7fff584d8010", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000237e" } ], "repeated": 0, "id": 31812 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 31813 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 31814 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "6148", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000360" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 31815 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "5000", "caller": "0x7fff428ef240", "parentcaller": "0x7fff428eb9c1", "category": "misc", "api": "GetSystemMetrics", "status": false, "return": "0x00000000", "arguments": [ { "name": "SystemMetricIndex", "value": "8192" } ], "repeated": 0, "id": 31816 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 31817 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 31818 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "5000", "caller": "0x7fff5489080f", "parentcaller": "0x7fff5486709a", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00010128" }, { "name": "Message", "value": "0x00000060" } ], "repeated": 0, "id": 31819 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "4620", "caller": "0x7fff428ef240", "parentcaller": "0x7fff4260a2a2", "category": "misc", "api": "GetSystemMetrics", "status": false, "return": "0x00000000", "arguments": [ { "name": "SystemMetricIndex", "value": "8192" } ], "repeated": 0, "id": 31820 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "4620", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf8\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x12\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4620" } ], "repeated": 0, "id": 31821 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "5000", "caller": "0x7fff57fc2eeb", "parentcaller": "0x7fff581ba00f", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "WindowShouldReportLayoutCompletedTelemetryProp" }, { "name": "Atom", "value": "0x0000c058" } ], "repeated": 0, "id": 31822 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 31823 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "4620", "caller": "0x7fff57fcb8ed", "parentcaller": "0x7fff58085341", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x00002450", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x7fff580853d0" }, { "name": "Parameter", "value": "0x04b8b3d0" }, { "name": "CreationFlags", "value": "0x00000004" }, { "name": "ThreadId", "value": "2632" }, { "name": "ProcessId", "value": "4484" } ], "repeated": 0, "id": 31824 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "4620", "caller": "0x7fff5781f430", "parentcaller": "0x7fff58085379", "category": "threading", "api": "NtResumeThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00002450" }, { "name": "SuspendCount", "value": "1" }, { "name": "ThreadId", "value": "2632" }, { "name": "ProcessId", "value": "4484" } ], "repeated": 0, "id": 31825 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "4620", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58085f99", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 31826 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "2336", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00 \t\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2336" } ], "repeated": 0, "id": 31827 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 31828 }, { "timestamp": "2026-05-29 01:06:12,555", "thread_id": "2336", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 1, "id": 31829 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "2632", "caller": "0x7fff59fc507d", "parentcaller": "0x7fff59fc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 31830 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "2632", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7fff580853d0" }, { "name": "Parameter", "value": "0x04b8b3d0" } ], "repeated": 0, "id": 31831 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "2632", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00H\n\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2632" } ], "repeated": 0, "id": 31832 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58085ee4", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002048" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 31833 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "2584", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x18\n\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2584" } ], "repeated": 0, "id": 31834 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "5000", "caller": "0x7fff4274356a", "parentcaller": "0x7fff42799839", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x00000002", "pretty_value": "KEY_SET_VALUE" }, { "name": "Handle", "value": "0x00001e78" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 31835 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "5000", "caller": "0x7fff427435a9", "parentcaller": "0x7fff42799839", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001e78" }, { "name": "ValueName", "value": "TraySearchBoxVisible" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Buffer", "value": "0" }, { "name": "BufferLength", "value": "4" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\TraySearchBoxVisible" } ], "repeated": 0, "id": 31836 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "5000", "caller": "0x7fff427435c1", "parentcaller": "0x7fff42799839", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001e78" } ], "repeated": 0, "id": 31837 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 31838 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001e78" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced" } ], "repeated": 0, "id": 31839 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "5000", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001e78" }, { "name": "ValueName", "value": "TaskbarSmallIcons" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\TaskbarSmallIcons" } ], "repeated": 0, "id": 31840 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "5000", "caller": "0x7fff577d3018", "parentcaller": "0x7fff425e8fa6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001e78" } ], "repeated": 0, "id": 31841 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 31842 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 31843 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" } ], "repeated": 0, "id": 31844 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 31845 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 31846 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001e78" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" } ], "repeated": 0, "id": 31847 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "5000", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00001e78" }, { "name": "ValueName", "value": "Current" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Current" } ], "repeated": 0, "id": 31848 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "5000", "caller": "0x7fff577d3018", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001e78" } ], "repeated": 0, "id": 31849 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc686b4", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 31850 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "5000", "caller": "0x7fff57fc2a0e", "parentcaller": "0x7fff581d409e", "category": "synchronization", "api": "NtAddAtomEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "CrossProcessParentHWND" }, { "name": "Atom", "value": "0x0000c083" } ], "repeated": 0, "id": 31851 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xdf\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x005\\x18\\xff\\x7f\\x00\\x00X\\xe0\\\\x03\\x00\\x00\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 31852 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "5000", "caller": "0x7fff57fc2a0e", "parentcaller": "0x7fff581d409e", "category": "synchronization", "api": "NtAddAtomEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "CrossProcessChildHWND" }, { "name": "Atom", "value": "0x0000c06d" } ], "repeated": 0, "id": 31853 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "5000", "caller": "0x7fff57fc2a0e", "parentcaller": "0x7fff581d409e", "category": "synchronization", "api": "NtAddAtomEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "NonComponentUIWindow" }, { "name": "Atom", "value": "0x0000c07d" } ], "repeated": 0, "id": 31854 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4696", "caller": "0x7ff79bc8a3f0", "parentcaller": "0x7ff79bc686b4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002128" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 31855 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "5000", "caller": "0x7fff57fc2eeb", "parentcaller": "0x7fff581d609e", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "UIA_WindowPatternEnabled" }, { "name": "Atom", "value": "0x0000c057" } ], "repeated": 0, "id": 31856 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "5000", "caller": "0x7fff4259fa9e", "parentcaller": "0x7fff425937e3", "category": "windows", "api": "FindWindowW", "status": true, "return": "0x00010094", "arguments": [ { "name": "ClassName", "value": "Shell_TrayWnd" }, { "name": "WindowName", "value": "" } ], "repeated": 0, "id": 31857 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "5000", "caller": "0x7fff57fc2eeb", "parentcaller": "0x7fff581ba00f", "category": "synchronization", "api": "NtFindAtom", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "AtomName", "value": "IsAutoHideEnabled" }, { "name": "Atom", "value": "0x00000000" } ], "repeated": 0, "id": 31858 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "2584", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x18\n\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2584" } ], "repeated": 0, "id": 31859 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 31860 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "5000", "caller": "0x7fff4274356a", "parentcaller": "0x7fff42799839", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x00000002", "pretty_value": "KEY_SET_VALUE" }, { "name": "Handle", "value": "0x000024b4" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 31861 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "5000", "caller": "0x7fff427435a9", "parentcaller": "0x7fff42799839", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" }, { "name": "ValueName", "value": "TraySearchBoxVisible" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Buffer", "value": "0" }, { "name": "BufferLength", "value": "4" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\TraySearchBoxVisible" } ], "repeated": 0, "id": 31862 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "2584", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x18\n\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2584" } ], "repeated": 0, "id": 31863 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "5000", "caller": "0x7fff427435c1", "parentcaller": "0x7fff42799839", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" } ], "repeated": 0, "id": 31864 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 31865 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "2584", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff517e2bd6", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000024b4" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "6136" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" } ], "repeated": 0, "id": 31866 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "2584", "caller": "0x7fff5781026b", "parentcaller": "0x7fff517e2c2a", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000024b4" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00001e78" } ], "repeated": 0, "id": 31867 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "2584", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff517e2c87", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 31868 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 31869 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002128" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced" } ], "repeated": 0, "id": 31870 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "5000", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff425e8fa6", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002128" }, { "name": "ValueName", "value": "TaskbarSmallIcons" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\TaskbarSmallIcons" } ], "repeated": 0, "id": 31871 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "5000", "caller": "0x7fff577d3018", "parentcaller": "0x7fff425e8fa6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002128" } ], "repeated": 0, "id": 31872 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 31873 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 31874 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" } ], "repeated": 0, "id": 31875 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 31876 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 31877 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002128" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" } ], "repeated": 0, "id": 31878 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "2584", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff517e29b1", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000024b4" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "6136" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" } ], "repeated": 0, "id": 31879 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "2584", "caller": "0x7fff5781026b", "parentcaller": "0x7fff517e29fb", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000024b4" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000271c" } ], "repeated": 0, "id": 31880 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "5000", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002128" }, { "name": "ValueName", "value": "Current" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Current" } ], "repeated": 0, "id": 31881 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "2584", "caller": "0x7fff59f941df", "parentcaller": "0x7fff517e2a39", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "12" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 31882 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "2584", "caller": "0x7fff59f94256", "parentcaller": "0x7fff517e2a39", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "44" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb8\\x03\\xccw^t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x98\\xf6\\xc6\r\\x00\\x00\\x00\\x00\\xf8\\x17\\x00\\x00\\x00\\x00\\x00\\x00@b\\x88\\x10\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 31883 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "5000", "caller": "0x7fff577d3018", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002128" } ], "repeated": 0, "id": 31884 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "2584", "caller": "0x7fff577cf588", "parentcaller": "0x7fff517ead8b", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000024b4" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "Global\\Session\\1\\AppContainerNamedObjects\\S-1-15-2-536077884-713174666-1066051701-3219990555-339840825-1966734348-1611281757\\17f8HWNDInterface:1019e" } ], "repeated": 0, "id": 31885 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 31886 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "2584", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c232", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000024b4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09fe0000" }, { "name": "SectionOffset", "value": "0x0dc6f620" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 31887 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "5000", "caller": "0x7fff4bfd299f", "parentcaller": "0x7fff425e9098", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Accessibility" }, { "name": "Handle", "value": "0x00002128" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Accessibility" } ], "repeated": 0, "id": 31888 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff4bfd2a24", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002128" }, { "name": "ValueName", "value": "TextScaleFactor" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Accessibility\\TextScaleFactor" } ], "repeated": 0, "id": 31889 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "2584", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff517eae5e", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09fe0000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 31890 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "5000", "caller": "0x7fff4bfd2a6a", "parentcaller": "0x7fff425e9098", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002128" } ], "repeated": 0, "id": 31891 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 31892 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 31893 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" } ], "repeated": 0, "id": 31894 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 31895 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002128" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" } ], "repeated": 0, "id": 31896 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "2584", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache" }, { "name": "Handle", "value": "0x000024b4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache" } ], "repeated": 0, "id": 31897 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "5000", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002128" }, { "name": "ValueName", "value": "Current" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Current" } ], "repeated": 0, "id": 31898 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "5000", "caller": "0x7fff577d3018", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002128" } ], "repeated": 0, "id": 31899 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "2584", "caller": "0x7fff4cbd1a81", "parentcaller": "0x7fff4cbd138a", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000024b4" }, { "name": "SubKey", "value": "Metadata" }, { "name": "Handle", "value": "0x0000271c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Metadata" } ], "repeated": 0, "id": 31900 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "5000", "caller": "0x7fff577d3b20", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 31901 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 31902 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "2584", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577af579", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000024b4" }, { "name": "SubKey", "value": "Package\\Index\\PackageFullName\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy" }, { "name": "Handle", "value": "0x00002720" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Index\\PackageFullName\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy" } ], "repeated": 0, "id": 31903 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" } ], "repeated": 0, "id": 31904 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "2584", "caller": "0x7fff4cbd1732", "parentcaller": "0x7fff577af7dc", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002720" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "1a" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Index\\PackageFullName\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\\1a" } ], "repeated": 0, "id": 31905 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "5000", "caller": "0x7fff577d3b20", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 31906 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "2584", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577af5fd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002720" } ], "repeated": 0, "id": 31907 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 31908 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "2584", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577af308", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000024b4" }, { "name": "SubKey", "value": "Package\\Data\\1a" }, { "name": "Handle", "value": "0x00002720" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\1a" } ], "repeated": 0, "id": 31909 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002128" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" } ], "repeated": 0, "id": 31910 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "2584", "caller": "0x7fff4cbd16ad", "parentcaller": "0x7fff5781d320", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002720" }, { "name": "ValueName", "value": "PackageOrigin" }, { "name": "Data", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\1a\\PackageOrigin" } ], "repeated": 0, "id": 31911 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "5000", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002128" }, { "name": "ValueName", "value": "Current" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Current" } ], "repeated": 0, "id": 31912 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "2584", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577aed38", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002720" } ], "repeated": 0, "id": 31913 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "2584", "caller": "0x7fff4cbd17f2", "parentcaller": "0x7fff577adcce", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000271c" } ], "repeated": 0, "id": 31914 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "5000", "caller": "0x7fff577d3018", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002128" } ], "repeated": 0, "id": 31915 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "2584", "caller": "0x7fff4cbd180b", "parentcaller": "0x7fff577adcce", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000024b4" } ], "repeated": 0, "id": 31916 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "2584", "caller": "0x7fff59f93f7a", "parentcaller": "0x7fff59770ed7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 31917 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "5000", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 31918 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "2584", "caller": "0x7fff59770cd1", "parentcaller": "0x7fff597a1530", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x000024b4" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 31919 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "5000", "caller": "0x7fff577d3b20", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 31920 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "2584", "caller": "0x7fff5781026b", "parentcaller": "0x7fff59770daf", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000271c" } ], "repeated": 0, "id": 31921 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 31922 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "2584", "caller": "0x7fff59fb6e46", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\xd8\\x04p\\x0c\\x00\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00o\\x00r\\x00e\\x00-\\x00w\\x00i\\x00n\\x003\\x002\\x00k\\x00-\\x00f\\x00u\\x00l\\x00l\\x00u\\x00s\\x00e\\x00r\\x00-\\x00l\\x001\\x00-\\x001\\x00-\\x000\\x00" } ], "repeated": 0, "id": 31923 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "2584", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xc0\\xfao\\x0c\\x00\\x00\\x00\\x00`\\x00\\x00\\x00-\\x00w\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00e\\x00-\\x00w\\x00i\\x00n\\x003\\x002\\x00k\\x00-\\x00m\\x00i\\x00n\\x00u\\x00s\\x00e\\x00r\\x00-\\x00l\\x001\\x00-\\x001\\x00-\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00e\\x00" } ], "repeated": 0, "id": 31924 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002128" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" } ], "repeated": 0, "id": 31925 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "2584", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 31926 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "2584", "caller": "0x7fff59fb6f8f", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "x\\xfeo\\x0c\\x00\\x00\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 31927 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "5000", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002128" }, { "name": "ValueName", "value": "Current" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Current" } ], "repeated": 0, "id": 31928 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "2584", "caller": "0x7fff59fb7048", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x81\\x1a\\xff\\x7f\\x00\\x00\\xebPY\\x1a\\xff\\x7f\\x00\\x00\\xf8<\\xccw^t\\x00\\x00(N}\\x1a\\xff\\x7f\\x00\\x00\\xa0\\xd9\\xc6\r\\x00\\x00\\x00\\x00\\x98\\xd9\\xc6\r\\x00\\x00\\x00\\x00h\\xd9\\xc6\r\\x00\\x00\\x00\\x00\\x88\\xd9\\xc6\r" } ], "repeated": 0, "id": 31929 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "2584", "caller": "0x7fff59fb707b", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xfeo\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8Z\\x1a\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x88\\xd7\\xc6\r\\x00\\x00\\x00\\x00\\x1c'\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00$\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2}\\x1a" } ], "repeated": 0, "id": 31930 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "5000", "caller": "0x7fff577d3018", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002128" } ], "repeated": 0, "id": 31931 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "2584", "caller": "0x7fff59f88cde", "parentcaller": "0x7fff59f8953a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": " \\xf1\\x02\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 31932 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "2584", "caller": "0x7fff59fb6e46", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\x18\\xf2o\\x0c\\x00\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00o\\x00r\\x00e\\x00-\\x00w\\x00i\\x00n\\x003\\x002\\x00k\\x00-\\x00m\\x00i\\x00n\\x00u\\x00s\\x00e\\x00r\\x00-\\x00l\\x001\\x00-\\x001\\x00-\\x000\\x00\\x00\\x00" } ], "repeated": 0, "id": 31933 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "2584", "caller": "0x7fff59fb6e9b", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\x00\\xfdo\\x0c\\x00\\x00\\x00\\x00`\\x00\\x00\\x00o\\xe7j_\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\xc0V?*K\\x14a\\x06\\x80\\x08Af\\x1d-8T\\x0e\\xd4\\x06\\x00\\x84\\x11\\x00\\x00\\xf7B\\xb9\\x8d\\xcd\\xdc\\xab\\x08PN\\x1a\\x01\\x00\\x00\\x00\\x00-\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00" } ], "repeated": 0, "id": 31934 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "2584", "caller": "0x7fff59fb6ec0", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 31935 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "2584", "caller": "0x7fff59fb6f37", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 31936 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "2584", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "8\\x02p\\x0c\\x00\\x00\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 31937 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "5000", "caller": "0x7fff4bfd299f", "parentcaller": "0x7fff425e9098", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Accessibility" }, { "name": "Handle", "value": "0x00002128" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Accessibility" } ], "repeated": 0, "id": 31938 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "2584", "caller": "0x7fff59fb707b", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x02p\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8Z\\x1a\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xd3\\xc6\r\\x00\\x00\\x00\\x00\\x1c'\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00$\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2}\\x1a" } ], "repeated": 0, "id": 31939 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "2584", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "NtQuerySystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 31940 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff4bfd2a24", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002128" }, { "name": "ValueName", "value": "TextScaleFactor" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Accessibility\\TextScaleFactor" } ], "repeated": 0, "id": 31941 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "5000", "caller": "0x7fff4bfd2a6a", "parentcaller": "0x7fff425e9098", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002128" } ], "repeated": 0, "id": 31942 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "5000", "caller": "0x7fff577d3b20", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 31943 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "2584", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000271c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 31944 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 31945 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" } ], "repeated": 0, "id": 31946 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 31947 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 31948 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002128" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" } ], "repeated": 0, "id": 31949 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "5000", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002128" }, { "name": "ValueName", "value": "Current" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Current" } ], "repeated": 0, "id": 31950 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "5000", "caller": "0x7fff577d3018", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002128" } ], "repeated": 0, "id": 31951 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 31952 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 31953 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "5000", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" } ], "repeated": 0, "id": 31954 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "5000", "caller": "0x7fff577d3b20", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 31955 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "5000", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 31956 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002128" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" } ], "repeated": 0, "id": 31957 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "5000", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002128" }, { "name": "ValueName", "value": "Current" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Current" } ], "repeated": 0, "id": 31958 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "5000", "caller": "0x7fff577d3018", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002128" } ], "repeated": 0, "id": 31959 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 31960 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 31961 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" } ], "repeated": 0, "id": 31962 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 31963 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "2632", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00H\n\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2632" } ], "repeated": 0, "id": 31964 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "5000", "caller": "0x7fff577d3b20", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 31965 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 31966 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002128" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" } ], "repeated": 0, "id": 31967 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "5000", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002128" }, { "name": "ValueName", "value": "Current" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Current" } ], "repeated": 0, "id": 31968 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "5000", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002128" } ], "repeated": 0, "id": 31969 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 31970 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "6160", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x18\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6160" } ], "repeated": 0, "id": 31971 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "5000", "caller": "0x7fff57fc2a0e", "parentcaller": "0x7fff581d409e", "category": "synchronization", "api": "NtAddAtomEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "UIA_WindowVisibilityOverridden" }, { "name": "Atom", "value": "0x0000c042" } ], "repeated": 0, "id": 31972 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 31973 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58085ee4", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002048" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 31974 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "6148", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x18\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6148" } ], "repeated": 0, "id": 31975 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "6148", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x18\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6148" } ], "repeated": 0, "id": 31976 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "3424", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff557c3a98", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xfe\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00`\r\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "3424" } ], "repeated": 0, "id": 31977 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4504", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 31978 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "2192", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x08\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2192" } ], "repeated": 1, "id": 31979 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4696", "caller": "0x7ff79bc2151a", "parentcaller": "0x7ff79bc213ca", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 3, "id": 31980 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "736", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5978ef53", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002454" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 31981 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4696", "caller": "0x7ff79bc2153a", "parentcaller": "0x7ff79bc213ca", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 3, "id": 31982 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4696", "caller": "0x7ff79bc216ed", "parentcaller": "0x7ff79bc215c3", "category": "synchronization", "api": "NtAddAtomEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "TrayRaisedWindowProp" }, { "name": "Atom", "value": "0x0000c072" } ], "repeated": 0, "id": 31983 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "2192", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 31984 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "2336", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00 \t\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2336" } ], "repeated": 0, "id": 31985 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4504", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 1, "id": 31986 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "2192", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x08\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2192" } ], "repeated": 0, "id": 31987 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4696", "caller": "0x7ff79bc216ed", "parentcaller": "0x7ff79bc215c3", "category": "synchronization", "api": "NtAddAtomEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "TrayRaisedWindowProp" }, { "name": "Atom", "value": "0x0000c072" } ], "repeated": 0, "id": 31988 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 31989 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "2192", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x08\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2192" } ], "repeated": 0, "id": 31990 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4696", "caller": "0x7ff79bc216ed", "parentcaller": "0x7ff79bc215c3", "category": "synchronization", "api": "NtAddAtomEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "TrayRaisedWindowProp" }, { "name": "Atom", "value": "0x0000c072" } ], "repeated": 1, "id": 31991 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4504", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 31992 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff46713ec2", "parentcaller": "0x7fff584cb8f1", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "6C3EE638-B588-4D7D-B30A-E7E36759305D" }, { "name": "ClsContext", "value": "0x00000004", "pretty_value": "CLSCTX_LOCAL_SERVER" }, { "name": "riid", "value": "54E4C428-D1D4-47D4-ADE6-46C829114A7D" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 31993 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "736", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 31994 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4504", "caller": "0x7ff79bcaadd7", "parentcaller": "0x00000000", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00010094" }, { "name": "Message", "value": "0x000005bb" } ], "repeated": 0, "id": 31995 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4696", "caller": "0x7ff79bc2147d", "parentcaller": "0x7ff79bc213ca", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 1, "id": 31996 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "736", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe6\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\x02\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "736" } ], "repeated": 0, "id": 31997 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "3424", "caller": "0x7fff58520e98", "parentcaller": "0x7fff5855be33", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 31998 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4696", "caller": "0x7ff79bc69ac0", "parentcaller": "0x7ff79bc69f41", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 31999 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "2192", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 32000 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4696", "caller": "0x7ff79bc69b1e", "parentcaller": "0x7ff79bc69f41", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 32001 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "3424", "caller": "0x7fff58520e98", "parentcaller": "0x7fff5855be33", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 32002 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4696", "caller": "0x7ff79bc69b1e", "parentcaller": "0x7ff79bc69f41", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 32003 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "2192", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 32004 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4696", "caller": "0x7ff79bc69b1e", "parentcaller": "0x7ff79bc69f41", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000231c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" } ], "repeated": 0, "id": 32005 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "3424", "caller": "0x7fff58520e98", "parentcaller": "0x7fff5855be33", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 1, "id": 32006 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4696", "caller": "0x7ff79bc69b1e", "parentcaller": "0x7ff79bc69f41", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000231c" }, { "name": "ValueName", "value": "ColorPrevalence" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\\ColorPrevalence" } ], "repeated": 0, "id": 32007 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "2192", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 32008 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4696", "caller": "0x7ff79bc69b1e", "parentcaller": "0x7ff79bc69f41", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000231c" } ], "repeated": 0, "id": 32009 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "2192", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 32010 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4696", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff59f667b5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xc0\\xec\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xf7\\x7f\\x00\\x00\\x88\\x84\\xfc\\x9b\\xf7\\x7f\\x00\\x00\\x88\\x84\\xfc\\x9b\\xf7\\x7f\\x00\\x00\\x1c#\\x00\\x00\\x00\\x00\\x00\\x00\\xb9E[\\x1a\\xff\\x7f\\x00\\x00\\x10\\xed\\\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 32011 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "2192", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 32012 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4696", "caller": "0x7ff79bc69b4c", "parentcaller": "0x7ff79bc69f41", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000231c" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 32013 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "2192", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 32014 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4696", "caller": "0x7ff79bc69b4c", "parentcaller": "0x7ff79bc69f41", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000022a0" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000231c" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" } ], "repeated": 0, "id": 32015 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "2192", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x08\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2192" } ], "repeated": 0, "id": 32016 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4696", "caller": "0x7ff79bc69b4c", "parentcaller": "0x7ff79bc69f41", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022a0" }, { "name": "ValueName", "value": "SystemUsesLightTheme" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\\SystemUsesLightTheme" } ], "repeated": 0, "id": 32017 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4696", "caller": "0x7ff79bc69b4c", "parentcaller": "0x7ff79bc69f41", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022a0" } ], "repeated": 0, "id": 32018 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4696", "caller": "0x7ff79bc69b4c", "parentcaller": "0x7ff79bc69f41", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000231c" } ], "repeated": 0, "id": 32019 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4696", "caller": "0x7ff79bc69bb6", "parentcaller": "0x7ff79bc69f41", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 32020 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4696", "caller": "0x7ff79bc69bb6", "parentcaller": "0x7ff79bc69f41", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 32021 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4696", "caller": "0x7ff79bc69bb6", "parentcaller": "0x7ff79bc69f41", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000231c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" } ], "repeated": 0, "id": 32022 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "2584", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x18\n\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2584" } ], "repeated": 0, "id": 32023 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4696", "caller": "0x7ff79bc69bb6", "parentcaller": "0x7ff79bc69f41", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000231c" }, { "name": "ValueName", "value": "EnableTransparency" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\\EnableTransparency" } ], "repeated": 0, "id": 32024 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "2584", "caller": "0x7fff577ce76a", "parentcaller": "0x7fff584cea0e", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "oleaut32.dll" }, { "name": "ModuleHandle", "value": "0x7fff58860000" } ], "repeated": 0, "id": 32025 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4696", "caller": "0x7ff79bc69bb6", "parentcaller": "0x7ff79bc69f41", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000231c" } ], "repeated": 0, "id": 32026 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4696", "caller": "0x7ff79bc69ac0", "parentcaller": "0x7ff79bc69c05", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 32027 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "2584", "caller": "0x7fff5809b283", "parentcaller": "0x7fff58088b47", "category": "windows", "api": "PostThreadMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessId", "value": "4484" }, { "name": "ThreadId", "value": "4488" }, { "name": "Message", "value": "0" } ], "repeated": 1, "id": 32028 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "2584", "caller": "0x7fff59fa467e", "parentcaller": "0x7fff5781f79a", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "12" }, { "name": "ThreadInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2584" } ], "repeated": 0, "id": 32029 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4696", "caller": "0x7ff79bc69b1e", "parentcaller": "0x7ff79bc69c05", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 32030 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4696", "caller": "0x7ff79bc69b1e", "parentcaller": "0x7ff79bc69c05", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 32031 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4696", "caller": "0x7ff79bc69b1e", "parentcaller": "0x7ff79bc69c05", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002724" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" } ], "repeated": 0, "id": 32032 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "2584", "caller": "0x7fff581815b8", "parentcaller": "0x7fff59f69a1d", "category": "misc", "api": "GetKeyboardLayout", "status": true, "return": "0x04090409", "arguments": [ { "name": "KeyboardLayout", "value": "0x00000409" }, { "name": "LanguageName", "value": "English (United States)" } ], "repeated": 0, "id": 32033 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4696", "caller": "0x7ff79bc69b1e", "parentcaller": "0x7ff79bc69c05", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002724" }, { "name": "ValueName", "value": "ColorPrevalence" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\\ColorPrevalence" } ], "repeated": 0, "id": 32034 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "2584", "caller": "0x7fff59fa469e", "parentcaller": "0x7fff5781f79a", "category": "threading", "api": "NtTerminateThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00000000" }, { "name": "ExitStatus", "value": "0x00000000" }, { "name": "ThreadId", "value": "0" }, { "name": "ProcessId", "value": "0" } ], "repeated": 0, "id": 32035 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4696", "caller": "0x7ff79bc69b1e", "parentcaller": "0x7ff79bc69c05", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002724" } ], "repeated": 0, "id": 32036 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4696", "caller": "0x7ff79bc69b4c", "parentcaller": "0x7ff79bc69c05", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xec\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xf7\\x7f\\x00\\x00\\x88\\x84\\xfc\\x9b\\xf7\\x7f\\x00\\x00\\x88\\x84\\xfc\\x9b\\xf7\\x7f\\x00\\x00$'\\x00\\x00\\x00\\x00\\x00\\x00\\xb9E[\\x1a\\xff\\x7f\\x00\\x00\\xd0\\xec\\\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 32037 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4696", "caller": "0x7ff79bc69b4c", "parentcaller": "0x7ff79bc69c05", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002724" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 32038 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4696", "caller": "0x7ff79bc69b4c", "parentcaller": "0x7ff79bc69c05", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002724" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 32039 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4696", "caller": "0x7ff79bc69b4c", "parentcaller": "0x7ff79bc69c05", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000272c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00002724" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" } ], "repeated": 0, "id": 32040 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4696", "caller": "0x7ff79bc69b4c", "parentcaller": "0x7ff79bc69c05", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000272c" }, { "name": "ValueName", "value": "SystemUsesLightTheme" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\\SystemUsesLightTheme" } ], "repeated": 0, "id": 32041 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff425c54ef", "parentcaller": "0x7fff425c5361", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "45BA127D-10A8-46EA-8AB7-56EA9078943C" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "54E4C428-D1D4-47D4-ADE6-46C829114A7D" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 32042 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4696", "caller": "0x7ff79bc69b4c", "parentcaller": "0x7ff79bc69c05", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000272c" } ], "repeated": 0, "id": 32043 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4696", "caller": "0x7ff79bc69b4c", "parentcaller": "0x7ff79bc69c05", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002724" } ], "repeated": 0, "id": 32044 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff584d7b74", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000034a" }, { "name": "SubKey", "value": "CLSID\\{B03C2205-F02E-4D77-80DF-E1747AFDD39C}" }, { "name": "Handle", "value": "0x000022e6" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{B03C2205-F02E-4D77-80DF-E1747AFDD39C}" } ], "repeated": 0, "id": 32045 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000022e6" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 32046 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000022e6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 32047 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4696", "caller": "0x7ff79bc69bb6", "parentcaller": "0x7ff79bc69c05", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 32048 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xe0\\xda \\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\xe6\"\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xdb \\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 32049 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\TreatAs" } ], "repeated": 0, "id": 32050 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000022e6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 32051 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4696", "caller": "0x7ff79bc69bb6", "parentcaller": "0x7ff79bc69c05", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 32052 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000022e6" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\TreatAs" } ], "repeated": 0, "id": 32053 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff585622e1", "parentcaller": "0x7fff584d7c1d", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000022e6" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 32054 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4696", "caller": "0x7ff79bc69bb6", "parentcaller": "0x7ff79bc69c05", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 32055 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d81f5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000022e6" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 32056 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4696", "caller": "0x7ff79bc69bb6", "parentcaller": "0x7ff79bc69c05", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002724" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" } ], "repeated": 0, "id": 32057 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4696", "caller": "0x7ff79bc69bb6", "parentcaller": "0x7ff79bc69c05", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002724" }, { "name": "ValueName", "value": "EnableTransparency" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\\EnableTransparency" } ], "repeated": 0, "id": 32058 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4696", "caller": "0x7ff79bc69bb6", "parentcaller": "0x7ff79bc69c05", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002724" } ], "repeated": 0, "id": 32059 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4696", "caller": "0x7ff79bc8a9d0", "parentcaller": "0x7ff79bc69c32", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 32060 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4696", "caller": "0x7ff79bc8a9d0", "parentcaller": "0x7ff79bc69c32", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 32061 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4696", "caller": "0x7ff79bc8a9d0", "parentcaller": "0x7ff79bc69c32", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002724" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced" } ], "repeated": 0, "id": 32062 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4696", "caller": "0x7ff79bc8a9d0", "parentcaller": "0x7ff79bc69c32", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002724" }, { "name": "ValueName", "value": "UseOLEDTaskbarTransparency" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\UseOLEDTaskbarTransparency" } ], "repeated": 0, "id": 32063 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4696", "caller": "0x7ff79bc8a9d0", "parentcaller": "0x7ff79bc69c32", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002724" } ], "repeated": 0, "id": 32064 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e6" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\(Default)" } ], "repeated": 0, "id": 32065 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4696", "caller": "0x7ff79bc69b1e", "parentcaller": "0x7ff79bc6986f", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 32066 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4696", "caller": "0x7ff79bc69b1e", "parentcaller": "0x7ff79bc6986f", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 32067 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4696", "caller": "0x7ff79bc69b1e", "parentcaller": "0x7ff79bc6986f", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002724" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" } ], "repeated": 0, "id": 32068 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4696", "caller": "0x7ff79bc69b1e", "parentcaller": "0x7ff79bc6986f", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002724" }, { "name": "ValueName", "value": "ColorPrevalence" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\\ColorPrevalence" } ], "repeated": 0, "id": 32069 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e6" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "ExecModelProxy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\(Default)" } ], "repeated": 0, "id": 32070 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4696", "caller": "0x7ff79bc69b4c", "parentcaller": "0x7ff79bc6986f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x90\\xec\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xf7\\x7f\\x00\\x00\\x88\\x84\\xfc\\x9b\\xf7\\x7f\\x00\\x00\\x88\\x84\\xfc\\x9b\\xf7\\x7f\\x00\\x00$'\\x00\\x00\\x00\\x00\\x00\\x00\\xb9E[\\x1a\\xff\\x7f\\x00\\x00\\xe0\\xec\\\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 32071 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4696", "caller": "0x7ff79bc69b4c", "parentcaller": "0x7ff79bc6986f", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002724" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 32072 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4696", "caller": "0x7ff79bc69b4c", "parentcaller": "0x7ff79bc6986f", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002724" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 32073 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4696", "caller": "0x7ff79bc69b4c", "parentcaller": "0x7ff79bc6986f", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000272c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00002724" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" } ], "repeated": 0, "id": 32074 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4696", "caller": "0x7ff79bc69b4c", "parentcaller": "0x7ff79bc6986f", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000272c" }, { "name": "ValueName", "value": "SystemUsesLightTheme" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\\SystemUsesLightTheme" } ], "repeated": 0, "id": 32075 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000025da" }, { "name": "ValueName", "value": "InprocServer32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocServer32\\InprocServer32" } ], "repeated": 0, "id": 32076 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4696", "caller": "0x7ff79bc69b4c", "parentcaller": "0x7ff79bc6986f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000272c" } ], "repeated": 0, "id": 32077 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4696", "caller": "0x7ff79bc69b4c", "parentcaller": "0x7ff79bc6986f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002724" } ], "repeated": 0, "id": 32078 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4696", "caller": "0x7ff79bc69bb6", "parentcaller": "0x7ff79bc6986f", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 32079 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025da" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocServer32\\(Default)" } ], "repeated": 0, "id": 32080 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4696", "caller": "0x7ff79bc69bb6", "parentcaller": "0x7ff79bc6986f", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 32081 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4696", "caller": "0x7ff79bc69bb6", "parentcaller": "0x7ff79bc6986f", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002724" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" } ], "repeated": 0, "id": 32082 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4696", "caller": "0x7ff79bc69bb6", "parentcaller": "0x7ff79bc6986f", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002724" }, { "name": "ValueName", "value": "EnableTransparency" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\\EnableTransparency" } ], "repeated": 0, "id": 32083 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4696", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002724" } ], "repeated": 0, "id": 32084 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff577f4aa9", "parentcaller": "0x7fff577d31c6", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025da" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "%systemroot%\\system32\\execmodelproxy.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocServer32\\(Default)" } ], "repeated": 0, "id": 32085 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc69953", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 32086 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4696", "caller": "0x7ff79bc21348", "parentcaller": "0x7ff79bca8e5f", "category": "misc", "api": "GetCursorPos", "status": true, "return": "0x00000001", "arguments": [ { "name": "x", "value": "34" }, { "name": "y", "value": "1072" } ], "repeated": 0, "id": 32087 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4696", "caller": "0x7ff79bc6b631", "parentcaller": "0x7ff79bc6b527", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "TaskbarMonitor" }, { "name": "Atom", "value": "0x0000c045" } ], "repeated": 0, "id": 32088 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc69953", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 32089 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025da" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "%systemroot%\\system32\\execmodelproxy.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocServer32\\(Default)" } ], "repeated": 0, "id": 32090 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d8d32", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025da" }, { "name": "ValueName", "value": "ThreadingModel" }, { "name": "Data", "value": "Both" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocServer32\\ThreadingModel" } ], "repeated": 0, "id": 32091 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff584d855f", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000025da" } ], "repeated": 0, "id": 32092 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000022e6" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 32093 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000022e6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 32094 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "p\\xd9 \\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\xe6\"\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xda \\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 32095 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocHandler32" } ], "repeated": 0, "id": 32096 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000022e6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 32097 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000022e6" }, { "name": "ObjectAttributesName", "value": "InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocHandler32" } ], "repeated": 0, "id": 32098 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000022e6" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 32099 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000022e6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 32100 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "p\\xd9 \\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\xe6\"\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xda \\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 32101 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocHandler" } ], "repeated": 0, "id": 32102 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000022e6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 32103 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000022e6" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocHandler" } ], "repeated": 0, "id": 32104 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff584d8010", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e6" } ], "repeated": 0, "id": 32105 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff4f752c16", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 32106 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff4f752c7a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "@\\x8c\\xb3\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa2\\xd8\\x08\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00" } ], "repeated": 0, "id": 32107 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff4f749256", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages" }, { "name": "Handle", "value": "0x000022e4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages" } ], "repeated": 0, "id": 32108 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff4f7492f1", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": false, "return": "0x000000ea", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\" } ], "repeated": 0, "id": 32109 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff4f74950e", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000022e4" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "87" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 32110 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff4f7492f1", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "1527c705-839a-4832-9118-54d4Bd6a0c89_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy" } ], "repeated": 0, "id": 32111 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "1" }, { "name": "Name", "value": "c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy" } ], "repeated": 0, "id": 32112 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "2" }, { "name": "Name", "value": "E2A4F912-2574-4A75-9BB0-0D023378592B_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\E2A4F912-2574-4A75-9BB0-0D023378592B_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy" } ], "repeated": 0, "id": 32113 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "3" }, { "name": "Name", "value": "F46D4000-FD22-4DB4-AC8E-4E1DDDE828FE_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\F46D4000-FD22-4DB4-AC8E-4E1DDDE828FE_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy" } ], "repeated": 0, "id": 32114 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "4" }, { "name": "Name", "value": "Microsoft.549981C3F5F10_1.1911.21713.0_neutral_~_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.549981C3F5F10_1.1911.21713.0_neutral_~_8wekyb3d8bbwe" } ], "repeated": 0, "id": 32115 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "5" }, { "name": "Name", "value": "Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe" } ], "repeated": 0, "id": 32116 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "6" }, { "name": "Name", "value": "Microsoft.AAD.BrokerPlugin_1000.19041.3636.0_neutral_neutral_cw5n1h2txyewy" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.AAD.BrokerPlugin_1000.19041.3636.0_neutral_neutral_cw5n1h2txyewy" } ], "repeated": 0, "id": 32117 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "7" }, { "name": "Name", "value": "Microsoft.AccountsControl_10.0.19041.3636_neutral__cw5n1h2txyewy" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.AccountsControl_10.0.19041.3636_neutral__cw5n1h2txyewy" } ], "repeated": 0, "id": 32118 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "8" }, { "name": "Name", "value": "Microsoft.Advertising.Xaml_10.1808.3.0_x64__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.Advertising.Xaml_10.1808.3.0_x64__8wekyb3d8bbwe" } ], "repeated": 0, "id": 32119 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "9" }, { "name": "Name", "value": "Microsoft.AsyncTextService_10.0.19041.3636_neutral__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.AsyncTextService_10.0.19041.3636_neutral__8wekyb3d8bbwe" } ], "repeated": 0, "id": 32120 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "10" }, { "name": "Name", "value": "Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-100_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-100_8wekyb3d8bbwe" } ], "repeated": 0, "id": 32121 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "11" }, { "name": "Name", "value": "Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-150_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-150_8wekyb3d8bbwe" } ], "repeated": 0, "id": 32122 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "12" }, { "name": "Name", "value": "Microsoft.BingWeather_4.25.20211.0_neutral_~_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.BingWeather_4.25.20211.0_neutral_~_8wekyb3d8bbwe" } ], "repeated": 0, "id": 32123 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "13" }, { "name": "Name", "value": "Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe" } ], "repeated": 0, "id": 32124 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "14" }, { "name": "Name", "value": "Microsoft.BioEnrollment_10.0.19041.3636_neutral__cw5n1h2txyewy" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.BioEnrollment_10.0.19041.3636_neutral__cw5n1h2txyewy" } ], "repeated": 0, "id": 32125 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "15" }, { "name": "Name", "value": "Microsoft.CredDialogHost_10.0.19041.3636_neutral__cw5n1h2txyewy" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.CredDialogHost_10.0.19041.3636_neutral__cw5n1h2txyewy" } ], "repeated": 0, "id": 32126 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "16" }, { "name": "Name", "value": "Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe" } ], "repeated": 0, "id": 32127 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "17" }, { "name": "Name", "value": "Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe" } ], "repeated": 0, "id": 32128 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "18" }, { "name": "Name", "value": "Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe" } ], "repeated": 0, "id": 32129 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "19" }, { "name": "Name", "value": "Microsoft.DesktopAppInstaller_2019.125.2243.0_neutral_~_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.DesktopAppInstaller_2019.125.2243.0_neutral_~_8wekyb3d8bbwe" } ], "repeated": 0, "id": 32130 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "20" }, { "name": "Name", "value": "Microsoft.ECApp_10.0.19041.3636_neutral__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.ECApp_10.0.19041.3636_neutral__8wekyb3d8bbwe" } ], "repeated": 0, "id": 32131 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "21" }, { "name": "Name", "value": "Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-100_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-100_8wekyb3d8bbwe" } ], "repeated": 0, "id": 32132 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "22" }, { "name": "Name", "value": "Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-125_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-125_8wekyb3d8bbwe" } ], "repeated": 0, "id": 32133 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "23" }, { "name": "Name", "value": "Microsoft.GetHelp_10.1706.13331.0_neutral_~_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.GetHelp_10.1706.13331.0_neutral_~_8wekyb3d8bbwe" } ], "repeated": 0, "id": 32134 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "24" }, { "name": "Name", "value": "Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe" } ], "repeated": 0, "id": 32135 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "25" }, { "name": "Name", "value": "Microsoft.Getstarted_8.2.22942.0_neutral_split.scale-200_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.Getstarted_8.2.22942.0_neutral_split.scale-200_8wekyb3d8bbwe" } ], "repeated": 0, "id": 32136 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "26" }, { "name": "Name", "value": "Microsoft.Getstarted_8.2.22942.0_neutral_~_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.Getstarted_8.2.22942.0_neutral_~_8wekyb3d8bbwe" } ], "repeated": 0, "id": 32137 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "27" }, { "name": "Name", "value": "Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe" } ], "repeated": 0, "id": 32138 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "28" }, { "name": "Name", "value": "Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe" } ], "repeated": 0, "id": 32139 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "29" }, { "name": "Name", "value": "Microsoft.LockApp_10.0.19041.3636_neutral__cw5n1h2txyewy" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.LockApp_10.0.19041.3636_neutral__cw5n1h2txyewy" } ], "repeated": 0, "id": 32140 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "30" }, { "name": "Name", "value": "Microsoft.Microsoft3DViewer_6.1908.2042.0_neutral_~_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.Microsoft3DViewer_6.1908.2042.0_neutral_~_8wekyb3d8bbwe" } ], "repeated": 0, "id": 32141 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "31" }, { "name": "Name", "value": "Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe" } ], "repeated": 0, "id": 32142 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "32" }, { "name": "Name", "value": "Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe" } ], "repeated": 0, "id": 32143 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "33" }, { "name": "Name", "value": "Microsoft.MicrosoftEdgeDevToolsClient_1000.19041.3636.0_neutral_neutral_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.MicrosoftEdgeDevToolsClient_1000.19041.3636.0_neutral_neutral_8wekyb3d8bbwe" } ], "repeated": 0, "id": 32144 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "34" }, { "name": "Name", "value": "Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_split.scale-100_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_split.scale-100_8wekyb3d8bbwe" } ], "repeated": 0, "id": 32145 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "35" }, { "name": "Name", "value": "Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_split.scale-125_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_split.scale-125_8wekyb3d8bbwe" } ], "repeated": 0, "id": 32146 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "36" }, { "name": "Name", "value": "Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_~_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_~_8wekyb3d8bbwe" } ], "repeated": 0, "id": 32147 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "37" }, { "name": "Name", "value": "Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe" } ], "repeated": 0, "id": 32148 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "38" }, { "name": "Name", "value": "Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-125_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-125_8wekyb3d8bbwe" } ], "repeated": 0, "id": 32149 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "39" }, { "name": "Name", "value": "Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-200_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-200_8wekyb3d8bbwe" } ], "repeated": 0, "id": 32150 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "40" }, { "name": "Name", "value": "Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_~_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_~_8wekyb3d8bbwe" } ], "repeated": 0, "id": 32151 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "41" }, { "name": "Name", "value": "Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe" } ], "repeated": 0, "id": 32152 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "42" }, { "name": "Name", "value": "Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-100_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-100_8wekyb3d8bbwe" } ], "repeated": 0, "id": 32153 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "43" }, { "name": "Name", "value": "Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-125_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-125_8wekyb3d8bbwe" } ], "repeated": 0, "id": 32154 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "44" }, { "name": "Name", "value": "Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_~_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_~_8wekyb3d8bbwe" } ], "repeated": 0, "id": 32155 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "45" }, { "name": "Name", "value": "Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe" } ], "repeated": 0, "id": 32156 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "46" }, { "name": "Name", "value": "Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-100_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-100_8wekyb3d8bbwe" } ], "repeated": 0, "id": 32157 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "47" }, { "name": "Name", "value": "Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-125_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-125_8wekyb3d8bbwe" } ], "repeated": 0, "id": 32158 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "48" }, { "name": "Name", "value": "Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_~_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_~_8wekyb3d8bbwe" } ], "repeated": 0, "id": 32159 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "49" }, { "name": "Name", "value": "Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe" } ], "repeated": 0, "id": 32160 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "50" }, { "name": "Name", "value": "Microsoft.MSPaint_2019.729.2301.0_neutral_~_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.MSPaint_2019.729.2301.0_neutral_~_8wekyb3d8bbwe" } ], "repeated": 0, "id": 32161 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "51" }, { "name": "Name", "value": "Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe" } ], "repeated": 0, "id": 32162 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "52" }, { "name": "Name", "value": "Microsoft.NET.Native.Framework.1.7_1.7.25531.0_x64__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.NET.Native.Framework.1.7_1.7.25531.0_x64__8wekyb3d8bbwe" } ], "repeated": 0, "id": 32163 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "53" }, { "name": "Name", "value": "Microsoft.NET.Native.Framework.2.2_2.2.27405.0_x64__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.NET.Native.Framework.2.2_2.2.27405.0_x64__8wekyb3d8bbwe" } ], "repeated": 0, "id": 32164 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "54" }, { "name": "Name", "value": "Microsoft.NET.Native.Runtime.1.7_1.7.25531.0_x64__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.NET.Native.Runtime.1.7_1.7.25531.0_x64__8wekyb3d8bbwe" } ], "repeated": 0, "id": 32165 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "55" }, { "name": "Name", "value": "Microsoft.NET.Native.Runtime.2.2_2.2.27328.0_x64__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.NET.Native.Runtime.2.2_2.2.27328.0_x64__8wekyb3d8bbwe" } ], "repeated": 0, "id": 32166 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "56" }, { "name": "Name", "value": "Microsoft.Office.OneNote_16001.12026.20112.0_neutral_~_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.Office.OneNote_16001.12026.20112.0_neutral_~_8wekyb3d8bbwe" } ], "repeated": 0, "id": 32167 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "57" }, { "name": "Name", "value": "Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe" } ], "repeated": 0, "id": 32168 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "58" }, { "name": "Name", "value": "Microsoft.People_10.1902.633.0_neutral_split.scale-100_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.People_10.1902.633.0_neutral_split.scale-100_8wekyb3d8bbwe" } ], "repeated": 0, "id": 32169 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "59" }, { "name": "Name", "value": "Microsoft.People_10.1902.633.0_neutral_split.scale-125_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.People_10.1902.633.0_neutral_split.scale-125_8wekyb3d8bbwe" } ], "repeated": 0, "id": 32170 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "60" }, { "name": "Name", "value": "Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe" } ], "repeated": 0, "id": 32171 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "61" }, { "name": "Name", "value": "Microsoft.People_2019.305.632.0_neutral_~_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.People_2019.305.632.0_neutral_~_8wekyb3d8bbwe" } ], "repeated": 0, "id": 32172 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "62" }, { "name": "Name", "value": "Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-100_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-100_8wekyb3d8bbwe" } ], "repeated": 0, "id": 32173 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "63" }, { "name": "Name", "value": "Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-125_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-125_8wekyb3d8bbwe" } ], "repeated": 0, "id": 32174 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "64" }, { "name": "Name", "value": "Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe" } ], "repeated": 0, "id": 32175 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "65" }, { "name": "Name", "value": "Microsoft.ScreenSketch_2019.904.1644.0_neutral_~_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.ScreenSketch_2019.904.1644.0_neutral_~_8wekyb3d8bbwe" } ], "repeated": 0, "id": 32176 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "66" }, { "name": "Name", "value": "Microsoft.Services.Store.Engagement_10.0.18101.0_x64__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.Services.Store.Engagement_10.0.18101.0_x64__8wekyb3d8bbwe" } ], "repeated": 0, "id": 32177 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "67" }, { "name": "Name", "value": "Microsoft.Services.Store.Engagement_10.0.18101.0_x86__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.Services.Store.Engagement_10.0.18101.0_x86__8wekyb3d8bbwe" } ], "repeated": 0, "id": 32178 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "68" }, { "name": "Name", "value": "Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-100_kzf8qxf38zg5c" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-100_kzf8qxf38zg5c" } ], "repeated": 0, "id": 32179 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "69" }, { "name": "Name", "value": "Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-125_kzf8qxf38zg5c" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-125_kzf8qxf38zg5c" } ], "repeated": 0, "id": 32180 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "70" }, { "name": "Name", "value": "Microsoft.SkypeApp_14.53.77.0_neutral_~_kzf8qxf38zg5c" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.SkypeApp_14.53.77.0_neutral_~_kzf8qxf38zg5c" } ], "repeated": 0, "id": 32181 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "71" }, { "name": "Name", "value": "Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c" } ], "repeated": 0, "id": 32182 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "72" }, { "name": "Name", "value": "Microsoft.StorePurchaseApp_11811.1001.18.0_neutral_split.scale-100_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.StorePurchaseApp_11811.1001.18.0_neutral_split.scale-100_8wekyb3d8bbwe" } ], "repeated": 0, "id": 32183 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "73" }, { "name": "Name", "value": "Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe" } ], "repeated": 0, "id": 32184 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "74" }, { "name": "Name", "value": "Microsoft.StorePurchaseApp_11811.1001.1813.0_neutral_~_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.StorePurchaseApp_11811.1001.1813.0_neutral_~_8wekyb3d8bbwe" } ], "repeated": 0, "id": 32185 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "75" }, { "name": "Name", "value": "Microsoft.UI.Xaml.2.0_2.1810.18004.0_x64__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.UI.Xaml.2.0_2.1810.18004.0_x64__8wekyb3d8bbwe" } ], "repeated": 0, "id": 32186 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "76" }, { "name": "Name", "value": "Microsoft.VCLibs.140.00.UWPDesktop_14.0.27629.0_x64__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.VCLibs.140.00.UWPDesktop_14.0.27629.0_x64__8wekyb3d8bbwe" } ], "repeated": 0, "id": 32187 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "77" }, { "name": "Name", "value": "Microsoft.VCLibs.140.00_14.0.27323.0_x64__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.VCLibs.140.00_14.0.27323.0_x64__8wekyb3d8bbwe" } ], "repeated": 0, "id": 32188 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "78" }, { "name": "Name", "value": "Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe" } ], "repeated": 0, "id": 32189 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "79" }, { "name": "Name", "value": "Microsoft.Wallet_2.4.18324.0_neutral_~_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.Wallet_2.4.18324.0_neutral_~_8wekyb3d8bbwe" } ], "repeated": 0, "id": 32190 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "80" }, { "name": "Name", "value": "Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe" } ], "repeated": 0, "id": 32191 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "81" }, { "name": "Name", "value": "Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-100_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-100_8wekyb3d8bbwe" } ], "repeated": 0, "id": 32192 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "82" }, { "name": "Name", "value": "Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-125_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-125_8wekyb3d8bbwe" } ], "repeated": 0, "id": 32193 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "83" }, { "name": "Name", "value": "Microsoft.WebMediaExtensions_1.0.20875.0_neutral_~_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_~_8wekyb3d8bbwe" } ], "repeated": 0, "id": 32194 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "84" }, { "name": "Name", "value": "Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe" } ], "repeated": 0, "id": 32195 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "85" }, { "name": "Name", "value": "Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe" } ], "repeated": 0, "id": 32196 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "86" }, { "name": "Name", "value": "Microsoft.Win32WebViewHost_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.Win32WebViewHost_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy" } ], "repeated": 0, "id": 32197 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "87" }, { "name": "Name", "value": "Microsoft.Windows.Apprep.ChxApp_1000.19041.3636.0_neutral_neutral_cw5n1h2txyewy" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.Windows.Apprep.ChxApp_1000.19041.3636.0_neutral_neutral_cw5n1h2txyewy" } ], "repeated": 0, "id": 32198 }, { "timestamp": "2026-05-29 01:06:12,571", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "88" }, { "name": "Name", "value": "Microsoft.Windows.AssignedAccessLockApp_1000.19041.3636.0_neutral_neutral_cw5n1h2txyewy" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.Windows.AssignedAccessLockApp_1000.19041.3636.0_neutral_neutral_cw5n1h2txyewy" } ], "repeated": 0, "id": 32199 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "89" }, { "name": "Name", "value": "Microsoft.Windows.CallingShellApp_1000.19041.3636.0_neutral_neutral_cw5n1h2txyewy" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.Windows.CallingShellApp_1000.19041.3636.0_neutral_neutral_cw5n1h2txyewy" } ], "repeated": 0, "id": 32200 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "90" }, { "name": "Name", "value": "Microsoft.Windows.CapturePicker_10.0.19041.3636_neutral__cw5n1h2txyewy" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.Windows.CapturePicker_10.0.19041.3636_neutral__cw5n1h2txyewy" } ], "repeated": 0, "id": 32201 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "91" }, { "name": "Name", "value": "Microsoft.Windows.CloudExperienceHost_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.Windows.CloudExperienceHost_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy" } ], "repeated": 0, "id": 32202 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "92" }, { "name": "Name", "value": "Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy" } ], "repeated": 0, "id": 32203 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "93" }, { "name": "Name", "value": "Microsoft.Windows.NarratorQuickStart_10.0.19041.3636_neutral_neutral_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.Windows.NarratorQuickStart_10.0.19041.3636_neutral_neutral_8wekyb3d8bbwe" } ], "repeated": 0, "id": 32204 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "94" }, { "name": "Name", "value": "Microsoft.Windows.OOBENetworkCaptivePortal_10.0.19041.3636_neutral__cw5n1h2txyewy" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.Windows.OOBENetworkCaptivePortal_10.0.19041.3636_neutral__cw5n1h2txyewy" } ], "repeated": 0, "id": 32205 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "95" }, { "name": "Name", "value": "Microsoft.Windows.OOBENetworkConnectionFlow_10.0.19041.3636_neutral__cw5n1h2txyewy" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.Windows.OOBENetworkConnectionFlow_10.0.19041.3636_neutral__cw5n1h2txyewy" } ], "repeated": 0, "id": 32206 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "96" }, { "name": "Name", "value": "Microsoft.Windows.ParentalControls_1000.19041.3636.0_neutral_neutral_cw5n1h2txyewy" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.Windows.ParentalControls_1000.19041.3636.0_neutral_neutral_cw5n1h2txyewy" } ], "repeated": 0, "id": 32207 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "97" }, { "name": "Name", "value": "Microsoft.Windows.PeopleExperienceHost_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.Windows.PeopleExperienceHost_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy" } ], "repeated": 0, "id": 32208 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "98" }, { "name": "Name", "value": "Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-100_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-100_8wekyb3d8bbwe" } ], "repeated": 0, "id": 32209 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "99" }, { "name": "Name", "value": "Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-125_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-125_8wekyb3d8bbwe" } ], "repeated": 0, "id": 32210 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "100" }, { "name": "Name", "value": "Microsoft.Windows.Photos_2019.19071.12548.0_neutral_~_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_~_8wekyb3d8bbwe" } ], "repeated": 0, "id": 32211 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "101" }, { "name": "Name", "value": "Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe" } ], "repeated": 0, "id": 32212 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "102" }, { "name": "Name", "value": "Microsoft.Windows.PinningConfirmationDialog_1000.19041.3636.0_neutral__cw5n1h2txyewy" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.Windows.PinningConfirmationDialog_1000.19041.3636.0_neutral__cw5n1h2txyewy" } ], "repeated": 0, "id": 32213 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "103" }, { "name": "Name", "value": "Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy" } ], "repeated": 0, "id": 32214 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "104" }, { "name": "Name", "value": "Microsoft.Windows.SecHealthUI_10.0.19041.3636_neutral__cw5n1h2txyewy" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.Windows.SecHealthUI_10.0.19041.3636_neutral__cw5n1h2txyewy" } ], "repeated": 0, "id": 32215 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "105" }, { "name": "Name", "value": "Microsoft.Windows.SecureAssessmentBrowser_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.Windows.SecureAssessmentBrowser_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy" } ], "repeated": 0, "id": 32216 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "106" }, { "name": "Name", "value": "Microsoft.Windows.ShellExperienceHost_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.Windows.ShellExperienceHost_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy" } ], "repeated": 0, "id": 32217 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "107" }, { "name": "Name", "value": "Microsoft.Windows.StartMenuExperienceHost_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.Windows.StartMenuExperienceHost_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy" } ], "repeated": 0, "id": 32218 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "108" }, { "name": "Name", "value": "Microsoft.Windows.XGpuEjectDialog_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.Windows.XGpuEjectDialog_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy" } ], "repeated": 0, "id": 32219 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "109" }, { "name": "Name", "value": "Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-100_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-100_8wekyb3d8bbwe" } ], "repeated": 0, "id": 32220 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "110" }, { "name": "Name", "value": "Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe" } ], "repeated": 0, "id": 32221 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "111" }, { "name": "Name", "value": "Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe" } ], "repeated": 0, "id": 32222 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "112" }, { "name": "Name", "value": "Microsoft.WindowsAlarms_2019.807.41.0_neutral_~_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.WindowsAlarms_2019.807.41.0_neutral_~_8wekyb3d8bbwe" } ], "repeated": 0, "id": 32223 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "113" }, { "name": "Name", "value": "Microsoft.WindowsCalculator_10.1906.55.0_neutral_split.scale-100_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.WindowsCalculator_10.1906.55.0_neutral_split.scale-100_8wekyb3d8bbwe" } ], "repeated": 0, "id": 32224 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "114" }, { "name": "Name", "value": "Microsoft.WindowsCalculator_10.1906.55.0_neutral_split.scale-125_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.WindowsCalculator_10.1906.55.0_neutral_split.scale-125_8wekyb3d8bbwe" } ], "repeated": 0, "id": 32225 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "115" }, { "name": "Name", "value": "Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe" } ], "repeated": 0, "id": 32226 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "116" }, { "name": "Name", "value": "Microsoft.WindowsCalculator_2020.1906.55.0_neutral_~_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.WindowsCalculator_2020.1906.55.0_neutral_~_8wekyb3d8bbwe" } ], "repeated": 0, "id": 32227 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "117" }, { "name": "Name", "value": "Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-125_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-125_8wekyb3d8bbwe" } ], "repeated": 0, "id": 32228 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "118" }, { "name": "Name", "value": "Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-200_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-200_8wekyb3d8bbwe" } ], "repeated": 0, "id": 32229 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "119" }, { "name": "Name", "value": "Microsoft.WindowsCamera_2018.826.98.0_neutral_~_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.WindowsCamera_2018.826.98.0_neutral_~_8wekyb3d8bbwe" } ], "repeated": 0, "id": 32230 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "120" }, { "name": "Name", "value": "Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe" } ], "repeated": 0, "id": 32231 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "121" }, { "name": "Name", "value": "microsoft.windowscommunicationsapps_16005.11629.20316.0_neutral_~_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\microsoft.windowscommunicationsapps_16005.11629.20316.0_neutral_~_8wekyb3d8bbwe" } ], "repeated": 0, "id": 32232 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "122" }, { "name": "Name", "value": "microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe" } ], "repeated": 0, "id": 32233 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "123" }, { "name": "Name", "value": "Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-100_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-100_8wekyb3d8bbwe" } ], "repeated": 0, "id": 32234 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "124" }, { "name": "Name", "value": "Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-125_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-125_8wekyb3d8bbwe" } ], "repeated": 0, "id": 32235 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "125" }, { "name": "Name", "value": "Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe" } ], "repeated": 0, "id": 32236 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "126" }, { "name": "Name", "value": "Microsoft.WindowsFeedbackHub_2019.1111.2029.0_neutral_~_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.WindowsFeedbackHub_2019.1111.2029.0_neutral_~_8wekyb3d8bbwe" } ], "repeated": 0, "id": 32237 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "127" }, { "name": "Name", "value": "Microsoft.WindowsMaps_2019.716.2316.0_neutral_~_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.WindowsMaps_2019.716.2316.0_neutral_~_8wekyb3d8bbwe" } ], "repeated": 0, "id": 32238 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "128" }, { "name": "Name", "value": "Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe" } ], "repeated": 0, "id": 32239 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "129" }, { "name": "Name", "value": "Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe" } ], "repeated": 0, "id": 32240 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "130" }, { "name": "Name", "value": "Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe" } ], "repeated": 0, "id": 32241 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "131" }, { "name": "Name", "value": "Microsoft.WindowsSoundRecorder_10.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.WindowsSoundRecorder_10.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe" } ], "repeated": 0, "id": 32242 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "132" }, { "name": "Name", "value": "Microsoft.WindowsSoundRecorder_10.1906.1972.0_neutral_split.scale-200_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.WindowsSoundRecorder_10.1906.1972.0_neutral_split.scale-200_8wekyb3d8bbwe" } ], "repeated": 0, "id": 32243 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "133" }, { "name": "Name", "value": "Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe" } ], "repeated": 0, "id": 32244 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "134" }, { "name": "Name", "value": "Microsoft.WindowsSoundRecorder_2019.716.2313.0_neutral_~_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.WindowsSoundRecorder_2019.716.2313.0_neutral_~_8wekyb3d8bbwe" } ], "repeated": 0, "id": 32245 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "135" }, { "name": "Name", "value": "Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-100_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-100_8wekyb3d8bbwe" } ], "repeated": 0, "id": 32246 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "136" }, { "name": "Name", "value": "Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-125_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-125_8wekyb3d8bbwe" } ], "repeated": 0, "id": 32247 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "137" }, { "name": "Name", "value": "Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe" } ], "repeated": 0, "id": 32248 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "138" }, { "name": "Name", "value": "Microsoft.WindowsStore_11910.1002.513.0_neutral_~_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.WindowsStore_11910.1002.513.0_neutral_~_8wekyb3d8bbwe" } ], "repeated": 0, "id": 32249 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "139" }, { "name": "Name", "value": "Microsoft.Xbox.TCUI_1.23.28002.0_neutral_~_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.Xbox.TCUI_1.23.28002.0_neutral_~_8wekyb3d8bbwe" } ], "repeated": 0, "id": 32250 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "140" }, { "name": "Name", "value": "Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe" } ], "repeated": 0, "id": 32251 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "141" }, { "name": "Name", "value": "Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-125_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-125_8wekyb3d8bbwe" } ], "repeated": 0, "id": 32252 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "142" }, { "name": "Name", "value": "Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-200_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-200_8wekyb3d8bbwe" } ], "repeated": 0, "id": 32253 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "143" }, { "name": "Name", "value": "Microsoft.XboxApp_48.49.31001.0_neutral_~_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.XboxApp_48.49.31001.0_neutral_~_8wekyb3d8bbwe" } ], "repeated": 0, "id": 32254 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "144" }, { "name": "Name", "value": "Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe" } ], "repeated": 0, "id": 32255 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "145" }, { "name": "Name", "value": "Microsoft.XboxGameCallableUI_1000.19041.3636.0_neutral_neutral_cw5n1h2txyewy" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.XboxGameCallableUI_1000.19041.3636.0_neutral_neutral_cw5n1h2txyewy" } ], "repeated": 0, "id": 32256 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "146" }, { "name": "Name", "value": "Microsoft.XboxGameOverlay_1.46.11001.0_neutral_split.scale-100_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.XboxGameOverlay_1.46.11001.0_neutral_split.scale-100_8wekyb3d8bbwe" } ], "repeated": 0, "id": 32257 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "147" }, { "name": "Name", "value": "Microsoft.XboxGameOverlay_1.46.11001.0_neutral_~_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.XboxGameOverlay_1.46.11001.0_neutral_~_8wekyb3d8bbwe" } ], "repeated": 0, "id": 32258 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "148" }, { "name": "Name", "value": "Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe" } ], "repeated": 0, "id": 32259 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "149" }, { "name": "Name", "value": "Microsoft.XboxGamingOverlay_2.34.28001.0_neutral_split.scale-100_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.XboxGamingOverlay_2.34.28001.0_neutral_split.scale-100_8wekyb3d8bbwe" } ], "repeated": 0, "id": 32260 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "150" }, { "name": "Name", "value": "Microsoft.XboxGamingOverlay_2.34.28001.0_neutral_split.scale-125_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.XboxGamingOverlay_2.34.28001.0_neutral_split.scale-125_8wekyb3d8bbwe" } ], "repeated": 0, "id": 32261 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "151" }, { "name": "Name", "value": "Microsoft.XboxGamingOverlay_2.34.28001.0_neutral_~_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.XboxGamingOverlay_2.34.28001.0_neutral_~_8wekyb3d8bbwe" } ], "repeated": 0, "id": 32262 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "152" }, { "name": "Name", "value": "Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe" } ], "repeated": 0, "id": 32263 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "153" }, { "name": "Name", "value": "Microsoft.XboxIdentityProvider_12.50.6001.0_neutral_~_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.XboxIdentityProvider_12.50.6001.0_neutral_~_8wekyb3d8bbwe" } ], "repeated": 0, "id": 32264 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "154" }, { "name": "Name", "value": "Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe" } ], "repeated": 0, "id": 32265 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "155" }, { "name": "Name", "value": "Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_neutral_split.scale-100_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_neutral_split.scale-100_8wekyb3d8bbwe" } ], "repeated": 0, "id": 32266 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "156" }, { "name": "Name", "value": "Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_neutral_~_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_neutral_~_8wekyb3d8bbwe" } ], "repeated": 0, "id": 32267 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "157" }, { "name": "Name", "value": "Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe" } ], "repeated": 0, "id": 32268 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "158" }, { "name": "Name", "value": "Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-100_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-100_8wekyb3d8bbwe" } ], "repeated": 0, "id": 32269 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "159" }, { "name": "Name", "value": "Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-125_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-125_8wekyb3d8bbwe" } ], "repeated": 0, "id": 32270 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "160" }, { "name": "Name", "value": "Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe" } ], "repeated": 0, "id": 32271 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "161" }, { "name": "Name", "value": "Microsoft.YourPhone_2019.430.2026.0_neutral_~_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.YourPhone_2019.430.2026.0_neutral_~_8wekyb3d8bbwe" } ], "repeated": 0, "id": 32272 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "162" }, { "name": "Name", "value": "Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe" } ], "repeated": 0, "id": 32273 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "163" }, { "name": "Name", "value": "Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe" } ], "repeated": 0, "id": 32274 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "164" }, { "name": "Name", "value": "Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe" } ], "repeated": 0, "id": 32275 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "165" }, { "name": "Name", "value": "Microsoft.ZuneMusic_2019.19071.19011.0_neutral_~_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.ZuneMusic_2019.19071.19011.0_neutral_~_8wekyb3d8bbwe" } ], "repeated": 0, "id": 32276 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "166" }, { "name": "Name", "value": "Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe" } ], "repeated": 0, "id": 32277 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "167" }, { "name": "Name", "value": "Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe" } ], "repeated": 0, "id": 32278 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "168" }, { "name": "Name", "value": "Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe" } ], "repeated": 0, "id": 32279 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "169" }, { "name": "Name", "value": "Microsoft.ZuneVideo_2019.19071.19011.0_neutral_~_8wekyb3d8bbwe" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\Microsoft.ZuneVideo_2019.19071.19011.0_neutral_~_8wekyb3d8bbwe" } ], "repeated": 0, "id": 32280 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4f749427", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Index", "value": "170" }, { "name": "Name", "value": "MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" } ], "repeated": 0, "id": 32281 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4f749620", "parentcaller": "0x7fff4f748542", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" } ], "repeated": 0, "id": 32282 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff59f667b5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "@\\xe6 \\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\xb1\\xe8 \\x03\\x00\\x00\\x00\\x00,\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xe7 \\x03\\x00\\x00\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 32283 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff59f667ec", "parentcaller": "0x7fff577b5140", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000022e4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 32284 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000022e4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 32285 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000231c" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000022e4" }, { "name": "ObjectAttributesName", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Families\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Families\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy" } ], "repeated": 0, "id": 32286 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff577b50dc", "parentcaller": "0x7fff577b4da8", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" } ], "repeated": 0, "id": 32287 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff577b4e18", "parentcaller": "0x7fff577b4cae", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000231c" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Families\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" } ], "repeated": 0, "id": 32288 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000231c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 32289 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000022e4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000231c" }, { "name": "ObjectAttributesName", "value": "MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Families\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" } ], "repeated": 0, "id": 32290 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff577b4fee", "parentcaller": "0x7fff577b4e3e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "ValueName", "value": "Flags" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Families\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\Flags" } ], "repeated": 0, "id": 32291 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff577b4ffa", "parentcaller": "0x7fff577b4e3e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" } ], "repeated": 0, "id": 32292 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff577b4e18", "parentcaller": "0x7fff577b4cae", "category": "registry", "api": "RegEnumKeyExW", "status": false, "return": "0x00000103", "pretty_return": "NO_MORE_ITEMS", "arguments": [ { "name": "Handle", "value": "0x0000231c" }, { "name": "Index", "value": "1" }, { "name": "Name", "value": "" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Families\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\\" } ], "repeated": 0, "id": 32293 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff577b4ef4", "parentcaller": "0x7fff577b4cae", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000231c" } ], "repeated": 0, "id": 32294 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 32295 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 32296 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateChange\\PackageList\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateChange\\PackageList\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" } ], "repeated": 0, "id": 32297 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff577b26e8", "parentcaller": "0x7fff577b279b", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xf0\\xe9 \\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00c\\x00r\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00l\\x00i\\x00e\\x00n\\x00t\\x00.\\x00C\\x00B\\x00S\\x00_\\x001\\x000\\x000\\x000\\x00.\\x001\\x009\\x000\\x005\\x003\\x00" } ], "repeated": 0, "id": 32298 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 32299 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001258" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 32300 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000231c" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00001258" }, { "name": "ObjectAttributesName", "value": "S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 32301 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000231c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 32302 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000022e4" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x0000231c" }, { "name": "ObjectAttributesName", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" } ], "repeated": 0, "id": 32303 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff577b4086", "parentcaller": "0x7fff577b27b6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000231c" } ], "repeated": 0, "id": 32304 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff577b40c3", "parentcaller": "0x7fff577b27b6", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "ValueName", "value": "PackageStatus" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\PackageStatus" } ], "repeated": 0, "id": 32305 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff577b40d4", "parentcaller": "0x7fff577b27b6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" } ], "repeated": 0, "id": 32306 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4cbd12d2", "parentcaller": "0x7fff465d5c64", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache" }, { "name": "Handle", "value": "0x000022e4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache" } ], "repeated": 0, "id": 32307 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4cbd1a81", "parentcaller": "0x7fff4cbd138a", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000022e4" }, { "name": "SubKey", "value": "Metadata" }, { "name": "Handle", "value": "0x0000231c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Metadata" } ], "repeated": 0, "id": 32308 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff465c2594", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 32309 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff465c260f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x00\\x88\\xb3\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00r\\x00s\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00" } ], "repeated": 0, "id": 32310 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff465d5d02", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000022e4" }, { "name": "SubKey", "value": "User\\Index\\UserSid\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "Handle", "value": "0x000022a0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\User\\Index\\UserSid\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 32311 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4cbd1732", "parentcaller": "0x7fff466023a5", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022a0" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "3" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\User\\Index\\UserSid\\S-1-5-21-3968686040-3210279463-847977608-1001\\3" } ], "repeated": 0, "id": 32312 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff466023f4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022a0" } ], "repeated": 0, "id": 32313 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff465d5d02", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000022e4" }, { "name": "SubKey", "value": "ApplicationUser\\Index\\UserAndApplicationUserModelId\\3^MicrosoftWindows.Client.CBS_cw5n1h2txyewy!InputApp" }, { "name": "Handle", "value": "0x000022a0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\ApplicationUser\\Index\\UserAndApplicationUserModelId\\3^MicrosoftWindows.Client.CBS_cw5n1h2txyewy!InputApp" } ], "repeated": 0, "id": 32314 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4cbd1732", "parentcaller": "0x7fff46602f16", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022a0" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "c3" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\ApplicationUser\\Index\\UserAndApplicationUserModelId\\3^MicrosoftWindows.Client.CBS_cw5n1h2txyewy!InputApp\\c3" } ], "repeated": 0, "id": 32315 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff46602f7b", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022a0" } ], "repeated": 0, "id": 32316 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff465d5d02", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000022e4" }, { "name": "SubKey", "value": "ApplicationUser\\Data\\c3" }, { "name": "Handle", "value": "0x000022a0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\ApplicationUser\\Data\\c3" } ], "repeated": 0, "id": 32317 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4cbd16ad", "parentcaller": "0x7fff46602c7c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022a0" }, { "name": "ValueName", "value": "Application" }, { "name": "Data", "value": "41" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\ApplicationUser\\Data\\c3\\Application" } ], "repeated": 0, "id": 32318 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff46602cff", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022a0" } ], "repeated": 0, "id": 32319 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff465d5d02", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000022e4" }, { "name": "SubKey", "value": "Application\\Data\\29" }, { "name": "Handle", "value": "0x000022a0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Application\\Data\\29" } ], "repeated": 0, "id": 32320 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4cbd16ad", "parentcaller": "0x7fff46602599", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022a0" }, { "name": "ValueName", "value": "Package" }, { "name": "Data", "value": "34" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Application\\Data\\29\\Package" } ], "repeated": 0, "id": 32321 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4cbd16ad", "parentcaller": "0x7fff46602603", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022a0" }, { "name": "ValueName", "value": "Index" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Application\\Data\\29\\Index" } ], "repeated": 0, "id": 32322 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4cbd16ad", "parentcaller": "0x7fff46602655", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022a0" }, { "name": "ValueName", "value": "Flags" }, { "name": "Data", "value": "384" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Application\\Data\\29\\Flags" } ], "repeated": 0, "id": 32323 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4cbd15ac", "parentcaller": "0x7fff4cbd14ff", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022a0" }, { "name": "ValueName", "value": "PackageRelativeApplicationId" }, { "name": "Data", "value": "InputApp" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Application\\Data\\29\\PackageRelativeApplicationId" } ], "repeated": 0, "id": 32324 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4cbd15ac", "parentcaller": "0x7fff4cbd14ff", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022a0" }, { "name": "ValueName", "value": "ApplicationUserModelId" }, { "name": "Data", "value": "MicrosoftWindows.Client.CBS_cw5n1h2txyewy!InputApp" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Application\\Data\\29\\ApplicationUserModelId" } ], "repeated": 0, "id": 32325 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4cbd16ad", "parentcaller": "0x7fff466027c6", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022a0" }, { "name": "ValueName", "value": "Activation" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Application\\Data\\29\\Activation" } ], "repeated": 0, "id": 32326 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4cbd15ac", "parentcaller": "0x7fff4cbd14ff", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022a0" }, { "name": "ValueName", "value": "HostId" }, { "name": "Data", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Application\\Data\\29\\HostId" } ], "repeated": 0, "id": 32327 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4cbd15ac", "parentcaller": "0x7fff4cbd14ff", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022a0" }, { "name": "ValueName", "value": "Parameters" }, { "name": "Data", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Application\\Data\\29\\Parameters" } ], "repeated": 0, "id": 32328 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4cbd15ac", "parentcaller": "0x7fff4cbd14ff", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022a0" }, { "name": "ValueName", "value": "Executable" }, { "name": "Data", "value": "TextInputHost.exe" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Application\\Data\\29\\Executable" } ], "repeated": 0, "id": 32329 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4cbd15ac", "parentcaller": "0x7fff4cbd14ff", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022a0" }, { "name": "ValueName", "value": "Entrypoint" }, { "name": "Data", "value": "WindowsInternal.ComposableShell.Experiences.TextInputUndocked.InputApp.App" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Application\\Data\\29\\Entrypoint" } ], "repeated": 0, "id": 32330 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4cbd15ac", "parentcaller": "0x7fff4cbd14ff", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022a0" }, { "name": "ValueName", "value": "StartPage" }, { "name": "Data", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Application\\Data\\29\\StartPage" } ], "repeated": 0, "id": 32331 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff466021a7", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022a0" } ], "repeated": 0, "id": 32332 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4cbd12d2", "parentcaller": "0x7fff577adf5c", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache" }, { "name": "Handle", "value": "0x000022a0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache" } ], "repeated": 0, "id": 32333 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4cbd1a81", "parentcaller": "0x7fff4cbd138a", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000022a0" }, { "name": "SubKey", "value": "Metadata" }, { "name": "Handle", "value": "0x000026b0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Metadata" } ], "repeated": 0, "id": 32334 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577af579", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000022a0" }, { "name": "SubKey", "value": "Package\\Index\\PackageFullName\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" }, { "name": "Handle", "value": "0x00002344" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Index\\PackageFullName\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" } ], "repeated": 0, "id": 32335 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4cbd1732", "parentcaller": "0x7fff577af7dc", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "22" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Index\\PackageFullName\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\22" } ], "repeated": 0, "id": 32336 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577af5fd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" } ], "repeated": 0, "id": 32337 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff57815e2d", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 32338 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff57815e8b", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "@\\x8e\\xb3\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00r\\x00s\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00" } ], "repeated": 0, "id": 32339 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577aebe9", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000022a0" }, { "name": "SubKey", "value": "User\\Index\\UserSid\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "Handle", "value": "0x00002344" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\User\\Index\\UserSid\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 32340 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4cbd1732", "parentcaller": "0x7fff577af7dc", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "3" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\User\\Index\\UserSid\\S-1-5-21-3968686040-3210279463-847977608-1001\\3" } ], "repeated": 0, "id": 32341 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577aec6d", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" } ], "repeated": 0, "id": 32342 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577ae9b0", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000022a0" }, { "name": "SubKey", "value": "PackageExternalLocation\\Index\\UserAndPackage\\3^22" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\PackageExternalLocation\\Index\\UserAndPackage\\3^22" } ], "repeated": 0, "id": 32343 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577ae9b0", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000022a0" }, { "name": "SubKey", "value": "PackageExternalLocation\\Index\\UserAndPackage\\0^22" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\PackageExternalLocation\\Index\\UserAndPackage\\0^22" } ], "repeated": 0, "id": 32344 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577af308", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000022a0" }, { "name": "SubKey", "value": "Package\\Data\\22" }, { "name": "Handle", "value": "0x00002344" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\22" } ], "repeated": 0, "id": 32345 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4cbd15ac", "parentcaller": "0x7fff4cbd14ff", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "ValueName", "value": "InstalledLocation" }, { "name": "Data", "value": "C:\\Windows\\SystemApps\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\22\\InstalledLocation" } ], "repeated": 0, "id": 32346 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4cbd15ac", "parentcaller": "0x7fff4cbd14ff", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "ValueName", "value": "MutableLink" }, { "name": "Data", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\22\\MutableLink" } ], "repeated": 0, "id": 32347 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577aed38", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" } ], "repeated": 0, "id": 32348 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4cbd17f2", "parentcaller": "0x7fff577ae12f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026b0" } ], "repeated": 0, "id": 32349 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4cbd180b", "parentcaller": "0x7fff577ae12f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022a0" } ], "repeated": 0, "id": 32350 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4cbd12d2", "parentcaller": "0x7fff577adf5c", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache" }, { "name": "Handle", "value": "0x000022a0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache" } ], "repeated": 0, "id": 32351 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4cbd1a81", "parentcaller": "0x7fff4cbd138a", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000022a0" }, { "name": "SubKey", "value": "Metadata" }, { "name": "Handle", "value": "0x000026b0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Metadata" } ], "repeated": 0, "id": 32352 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577af579", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000022a0" }, { "name": "SubKey", "value": "Package\\Index\\PackageFullName\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" }, { "name": "Handle", "value": "0x00002344" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Index\\PackageFullName\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy" } ], "repeated": 0, "id": 32353 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4cbd1732", "parentcaller": "0x7fff577af7dc", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "22" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Index\\PackageFullName\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\22" } ], "repeated": 0, "id": 32354 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577af5fd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" } ], "repeated": 0, "id": 32355 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff57815e2d", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 32356 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff57815e8b", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x00\\x8b\\xb3\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00r\\x00s\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00" } ], "repeated": 0, "id": 32357 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577aebe9", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000022a0" }, { "name": "SubKey", "value": "User\\Index\\UserSid\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "Handle", "value": "0x00002344" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\User\\Index\\UserSid\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 32358 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4cbd1732", "parentcaller": "0x7fff577af7dc", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "3" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\User\\Index\\UserSid\\S-1-5-21-3968686040-3210279463-847977608-1001\\3" } ], "repeated": 0, "id": 32359 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577aec6d", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" } ], "repeated": 0, "id": 32360 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577ae9b0", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000022a0" }, { "name": "SubKey", "value": "PackageExternalLocation\\Index\\UserAndPackage\\3^22" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\PackageExternalLocation\\Index\\UserAndPackage\\3^22" } ], "repeated": 0, "id": 32361 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577ae9b0", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000022a0" }, { "name": "SubKey", "value": "PackageExternalLocation\\Index\\UserAndPackage\\0^22" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\PackageExternalLocation\\Index\\UserAndPackage\\0^22" } ], "repeated": 0, "id": 32362 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577af308", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000022a0" }, { "name": "SubKey", "value": "Package\\Data\\22" }, { "name": "Handle", "value": "0x00002344" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\22" } ], "repeated": 0, "id": 32363 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4cbd15ac", "parentcaller": "0x7fff4cbd14ff", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "ValueName", "value": "InstalledLocation" }, { "name": "Data", "value": "C:\\Windows\\SystemApps\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\22\\InstalledLocation" } ], "repeated": 0, "id": 32364 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4cbd15ac", "parentcaller": "0x7fff4cbd14ff", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" }, { "name": "ValueName", "value": "MutableLink" }, { "name": "Data", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\22\\MutableLink" } ], "repeated": 0, "id": 32365 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577aed38", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002344" } ], "repeated": 0, "id": 32366 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4cbd17f2", "parentcaller": "0x7fff577ae12f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000026b0" } ], "repeated": 0, "id": 32367 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4cbd180b", "parentcaller": "0x7fff577ae12f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022a0" } ], "repeated": 0, "id": 32368 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4cbd17f2", "parentcaller": "0x7fff4661b532", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000231c" } ], "repeated": 0, "id": 32369 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff4cbd180b", "parentcaller": "0x7fff4661b532", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" } ], "repeated": 0, "id": 32370 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff5855dd9d", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000022e4" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000430" }, { "name": "ObjectAttributesName", "value": "Windows.Foundation.Collections.PropertySet" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet" } ], "repeated": 0, "id": 32371 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff5855ddf7", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000022e4" }, { "name": "KeyInformation", "value": "\\xff97\\xfffc\\xffe7\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00T\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00F\\x00o\\x00u\\x00n\\x00d\\x00a\\x00t\\x00i\\x00o\\x00n\\x00.\\x00C\\x00o\\x00l\\x00l\\x00e\\x00c\\x00t\\x00i\\x00o\\x00n\\x00s\\x00.\\x00P\\x00r\\x00o\\x00p\\x00e\\x00r\\x00t\\x00y\\x00S\\x00e\\x00t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xffa4\\xff89\\x0b\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x15\\x01\\x00\\x00\\x00\\x00Y\\xffe5 \\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff8a%\\x01\\x00\\x00\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\xffc4\\x02%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff0\\x0c%\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0EzX\\xffff\\x7f\\x00\\x00X\\xff85\\xffd7\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xffe6 \\x03\\x00\\x00\\x00\\x00\\xff87\\xff9dNX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff0u\\xffd7\\x08\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xff85\\xffd7\\x08\\x00\\x00\\x00\\x00\\xfff0u\\xffd7\\x08\\x00\\x00\\x00\\x00p\\xff92\\xffb3\\x0c\\x00\\x00\\x00\\x00\\xffc7\\xffb3\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00%\\x01\\x00\\x00\\x00\\x00\\xfff6sNX\\xffff\\x7f\\x00\\x00\\xfff0v\\xffd7\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffffp\\xff92\\xffb3\\x0c\\x00\\x00\\x00\\x000W\\xffb3\\x0c\\x00\\x00\\x00\\x000W\\xffb3\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff0u\\xffd7\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x006\\xff8cYX\\xffff\\x7f\\x00\\x00 \\xffd7y\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\xffe7 \\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\xffe7 \\x03\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 32372 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivationType" } ], "repeated": 0, "id": 32373 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "ValueName", "value": "Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\Server" } ], "repeated": 0, "id": 32374 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff585700bb", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "ValueName", "value": "DllPath" }, { "name": "Data", "value": "C:\\Windows\\System32\\WinTypes.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\DllPath" } ], "repeated": 0, "id": 32375 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "ValueName", "value": "Threading" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\Threading" } ], "repeated": 0, "id": 32376 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\TrustLevel" } ], "repeated": 0, "id": 32377 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff584bc0fc", "parentcaller": "0x7fff58554170", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000022e4" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\CustomAttributes" } ], "repeated": 0, "id": 32378 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\RemoteServer" } ], "repeated": 0, "id": 32379 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivateAsUser" } ], "repeated": 0, "id": 32380 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivateInSharedBroker" } ], "repeated": 0, "id": 32381 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 32382 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58562222", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\Permissions" } ], "repeated": 0, "id": 32383 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivateOnHostFlags" } ], "repeated": 0, "id": 32384 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4620", "caller": "0x7fff58557226", "parentcaller": "0x7fff5855ca23", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" } ], "repeated": 0, "id": 32385 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4504", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff584fb0ca", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 32386 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4956", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff584c6d2f", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000023a0" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 32387 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4956", "caller": "0x7fff58519794", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "F1C46D71-B791-4110-8D5C-7108F22C1010" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 32388 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4956", "caller": "0x7fff585192b9", "parentcaller": "0x7fff584e8db3", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 32389 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4956", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4956" } ], "repeated": 0, "id": 32390 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "2192", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x08\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2192" } ], "repeated": 0, "id": 32391 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4956", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4956" } ], "repeated": 0, "id": 32392 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "2336", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00 \t\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2336" } ], "repeated": 0, "id": 32393 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "2336", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00 \t\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2336" } ], "repeated": 0, "id": 32394 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "2192", "caller": "0x7fff584d7b74", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000034a" }, { "name": "SubKey", "value": "CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "Handle", "value": "0x0000254a" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" } ], "repeated": 0, "id": 32395 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "2192", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000254a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 32396 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "2192", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000254a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 32397 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "2192", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "p\\xc4y\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00J%\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xc5y\r\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 32398 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "2192", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\TreatAs" } ], "repeated": 0, "id": 32399 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "2192", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000254a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 32400 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "2192", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000254a" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\TreatAs" } ], "repeated": 0, "id": 32401 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "2192", "caller": "0x7fff585622e1", "parentcaller": "0x7fff584d7c1d", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000254a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 32402 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4956", "caller": "0x7fff584d7b74", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000034a" }, { "name": "SubKey", "value": "CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "Handle", "value": "0x000022e6" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" } ], "repeated": 0, "id": 32403 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "2192", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d81f5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000254a" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 32404 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4956", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000022e6" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 32405 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4956", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000022e6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 32406 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4956", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "p\\xa6\t\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\xe6\"\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xa7\t\\x08\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 32407 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "2192", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000254a" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)" } ], "repeated": 0, "id": 32408 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4956", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\TreatAs" } ], "repeated": 0, "id": 32409 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4956", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000022e6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 32410 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4956", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000022e6" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\TreatAs" } ], "repeated": 0, "id": 32411 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4956", "caller": "0x7fff585622e1", "parentcaller": "0x7fff584d7c1d", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000022e6" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 32412 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "2192", "caller": "0x7fff584d8485", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000254a" }, { "name": "SubKey", "value": "InprocServer32" }, { "name": "Handle", "value": "0x00001ab6" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocServer32" } ], "repeated": 0, "id": 32413 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4956", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d81f5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000022e6" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 32414 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "2192", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d09b4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab6" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 32415 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "2192", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xc2y\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\xb6\\x1a\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xc3y\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 32416 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "2192", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d09f7", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32" } ], "repeated": 0, "id": 32417 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4956", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e6" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)" } ], "repeated": 0, "id": 32418 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "2192", "caller": "0x7fff577d3e41", "parentcaller": "0x7fff578543b9", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab6" }, { "name": "ValueName", "value": "InprocServer32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\InprocServer32" } ], "repeated": 0, "id": 32419 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4956", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d09b4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000022e6" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 32420 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4956", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d09f7", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000022e6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 32421 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4956", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x10\\xa5\t\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\xe6\"\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xa6\t\\x08\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 32422 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "2192", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab6" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 32423 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4956", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d09f7", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" } ], "repeated": 0, "id": 32424 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "2192", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab6" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "C:\\Windows\\System32\\OneCoreUAPCommonProxyStub.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 32425 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "2192", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d09b4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab6" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 32426 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "4956", "caller": "0x7fff584d8485", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000022e6" }, { "name": "SubKey", "value": "InprocServer32" }, { "name": "Handle", "value": "0x0000231e" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocServer32" } ], "repeated": 0, "id": 32427 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "2192", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d09f7", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00001ab6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 32428 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "2192", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "0\\xc2y\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\xb6\\x1a\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xc3y\r\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 32429 }, { "timestamp": "2026-05-29 01:06:12,587", "thread_id": "2192", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d09f7", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32" } ], "repeated": 0, "id": 32430 }, { "timestamp": "2026-05-29 01:06:12,602", "thread_id": "4956", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000231e" }, { "name": "ValueName", "value": "InprocServer32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\InprocServer32" } ], "repeated": 0, "id": 32431 }, { "timestamp": "2026-05-29 01:06:12,602", "thread_id": "4956", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000231e" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 32432 }, { "timestamp": "2026-05-29 01:06:12,602", "thread_id": "2192", "caller": "0x7fff584d855f", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00001ab6" } ], "repeated": 0, "id": 32433 }, { "timestamp": "2026-05-29 01:06:12,602", "thread_id": "2192", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000254a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 32434 }, { "timestamp": "2026-05-29 01:06:12,602", "thread_id": "4956", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000231e" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "C:\\Windows\\System32\\OneCoreUAPCommonProxyStub.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 32435 }, { "timestamp": "2026-05-29 01:06:12,602", "thread_id": "2192", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000254a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 32436 }, { "timestamp": "2026-05-29 01:06:12,602", "thread_id": "4956", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d8d32", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000231e" }, { "name": "ValueName", "value": "ThreadingModel" }, { "name": "Data", "value": "Both" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\ThreadingModel" } ], "repeated": 0, "id": 32437 }, { "timestamp": "2026-05-29 01:06:12,602", "thread_id": "4956", "caller": "0x7fff584d855f", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000231e" } ], "repeated": 0, "id": 32438 }, { "timestamp": "2026-05-29 01:06:12,602", "thread_id": "2192", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x00\\xc3y\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00J%\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc4y\r\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 32439 }, { "timestamp": "2026-05-29 01:06:12,602", "thread_id": "4956", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000022e6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 32440 }, { "timestamp": "2026-05-29 01:06:12,602", "thread_id": "2192", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler32" } ], "repeated": 0, "id": 32441 }, { "timestamp": "2026-05-29 01:06:12,602", "thread_id": "4956", "caller": "0x7fff584d8010", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e6" } ], "repeated": 0, "id": 32442 }, { "timestamp": "2026-05-29 01:06:12,602", "thread_id": "2192", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000254a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 32443 }, { "timestamp": "2026-05-29 01:06:12,602", "thread_id": "2192", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000254a" }, { "name": "ObjectAttributesName", "value": "InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler32" } ], "repeated": 0, "id": 32444 }, { "timestamp": "2026-05-29 01:06:12,602", "thread_id": "2192", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000254a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 32445 }, { "timestamp": "2026-05-29 01:06:12,602", "thread_id": "2192", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000254a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 32446 }, { "timestamp": "2026-05-29 01:06:12,602", "thread_id": "2192", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x00\\xc3y\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00J%\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc4y\r\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 32447 }, { "timestamp": "2026-05-29 01:06:12,602", "thread_id": "2192", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler" } ], "repeated": 0, "id": 32448 }, { "timestamp": "2026-05-29 01:06:12,602", "thread_id": "2192", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000254a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 32449 }, { "timestamp": "2026-05-29 01:06:12,602", "thread_id": "2192", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000254a" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler" } ], "repeated": 0, "id": 32450 }, { "timestamp": "2026-05-29 01:06:12,602", "thread_id": "2192", "caller": "0x7fff584d8010", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000254a" } ], "repeated": 0, "id": 32451 }, { "timestamp": "2026-05-29 01:06:12,602", "thread_id": "4696", "caller": "0x7ff79bc89973", "parentcaller": "0x7ff79bc897dc", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00001016" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 32452 }, { "timestamp": "2026-05-29 01:06:12,602", "thread_id": "4696", "caller": "0x7ff79bc89973", "parentcaller": "0x7ff79bc897dc", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00001018" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 32453 }, { "timestamp": "2026-05-29 01:06:12,602", "thread_id": "2192", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x08\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2192" } ], "repeated": 0, "id": 32454 }, { "timestamp": "2026-05-29 01:06:12,602", "thread_id": "4956", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff584fb0ca", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 32455 }, { "timestamp": "2026-05-29 01:06:12,712", "thread_id": "4696", "caller": "0x7ff79bc89973", "parentcaller": "0x7ff79bc897dc", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00001016" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 32456 }, { "timestamp": "2026-05-29 01:06:12,712", "thread_id": "4696", "caller": "0x7ff79bc89973", "parentcaller": "0x7ff79bc897dc", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00001018" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 32457 }, { "timestamp": "2026-05-29 01:06:12,743", "thread_id": "4696", "caller": "0x7ff79bc89973", "parentcaller": "0x7ff79bc897dc", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00001016" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 32458 }, { "timestamp": "2026-05-29 01:06:12,743", "thread_id": "4696", "caller": "0x7ff79bc89973", "parentcaller": "0x7ff79bc897dc", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00001018" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 32459 }, { "timestamp": "2026-05-29 01:06:12,743", "thread_id": "4696", "caller": "0x7ff79bc89973", "parentcaller": "0x7ff79bc897dc", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00001016" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 32460 }, { "timestamp": "2026-05-29 01:06:12,743", "thread_id": "4696", "caller": "0x7ff79bc89973", "parentcaller": "0x7ff79bc897dc", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00001018" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 32461 }, { "timestamp": "2026-05-29 01:06:12,743", "thread_id": "4696", "caller": "0x7ff79bc89973", "parentcaller": "0x7ff79bc897dc", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00001016" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 32462 }, { "timestamp": "2026-05-29 01:06:12,743", "thread_id": "4696", "caller": "0x7ff79bc89973", "parentcaller": "0x7ff79bc897dc", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00001018" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 32463 }, { "timestamp": "2026-05-29 01:06:12,805", "thread_id": "4696", "caller": "0x7ff79bc6b631", "parentcaller": "0x7ff79bc6b527", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "TaskbarMonitor" }, { "name": "Atom", "value": "0x0000c045" } ], "repeated": 0, "id": 32464 }, { "timestamp": "2026-05-29 01:06:12,805", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc69953", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 32465 }, { "timestamp": "2026-05-29 01:06:12,805", "thread_id": "4696", "caller": "0x7ff79be6dccc", "parentcaller": "0x7ff79be74662", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000066" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 32466 }, { "timestamp": "2026-05-29 01:06:12,805", "thread_id": "4696", "caller": "0x7ff79be61930", "parentcaller": "0x7ff79be6dd29", "category": "misc", "api": "GetCursorPos", "status": true, "return": "0x00000001", "arguments": [ { "name": "x", "value": "51" }, { "name": "y", "value": "1043" } ], "repeated": 0, "id": 32467 }, { "timestamp": "2026-05-29 01:06:12,805", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc69953", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 1, "id": 32468 }, { "timestamp": "2026-05-29 01:06:12,837", "thread_id": "4696", "caller": "0x7ff79bc6b631", "parentcaller": "0x7ff79bc6b527", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "TaskbarMonitor" }, { "name": "Atom", "value": "0x0000c045" } ], "repeated": 0, "id": 32469 }, { "timestamp": "2026-05-29 01:06:12,837", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc69953", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 3, "id": 32470 }, { "timestamp": "2026-05-29 01:06:12,852", "thread_id": "4696", "caller": "0x7ff79bc6b631", "parentcaller": "0x7ff79bc6b527", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "TaskbarMonitor" }, { "name": "Atom", "value": "0x0000c045" } ], "repeated": 0, "id": 32471 }, { "timestamp": "2026-05-29 01:06:12,852", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc69953", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 1, "id": 32472 }, { "timestamp": "2026-05-29 01:06:12,868", "thread_id": "4696", "caller": "0x7ff79bc6b631", "parentcaller": "0x7ff79bc6b527", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "TaskbarMonitor" }, { "name": "Atom", "value": "0x0000c045" } ], "repeated": 0, "id": 32473 }, { "timestamp": "2026-05-29 01:06:12,868", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc69953", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 1, "id": 32474 }, { "timestamp": "2026-05-29 01:06:12,883", "thread_id": "4696", "caller": "0x7ff79bc6b631", "parentcaller": "0x7ff79bc6b527", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "TaskbarMonitor" }, { "name": "Atom", "value": "0x0000c045" } ], "repeated": 0, "id": 32475 }, { "timestamp": "2026-05-29 01:06:12,883", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc69953", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 1, "id": 32476 }, { "timestamp": "2026-05-29 01:06:12,899", "thread_id": "4696", "caller": "0x7ff79bc6b631", "parentcaller": "0x7ff79bc6b527", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "TaskbarMonitor" }, { "name": "Atom", "value": "0x0000c045" } ], "repeated": 0, "id": 32477 }, { "timestamp": "2026-05-29 01:06:12,899", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc69953", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 1, "id": 32478 }, { "timestamp": "2026-05-29 01:06:12,915", "thread_id": "4696", "caller": "0x7ff79bc6b631", "parentcaller": "0x7ff79bc6b527", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "TaskbarMonitor" }, { "name": "Atom", "value": "0x0000c045" } ], "repeated": 0, "id": 32479 }, { "timestamp": "2026-05-29 01:06:12,915", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc69953", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 1, "id": 32480 }, { "timestamp": "2026-05-29 01:06:12,930", "thread_id": "4696", "caller": "0x7ff79bc6b631", "parentcaller": "0x7ff79bc6b527", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "TaskbarMonitor" }, { "name": "Atom", "value": "0x0000c045" } ], "repeated": 0, "id": 32481 }, { "timestamp": "2026-05-29 01:06:12,930", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc69953", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 1, "id": 32482 }, { "timestamp": "2026-05-29 01:06:12,946", "thread_id": "4696", "caller": "0x7ff79bc6b631", "parentcaller": "0x7ff79bc6b527", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "TaskbarMonitor" }, { "name": "Atom", "value": "0x0000c045" } ], "repeated": 0, "id": 32483 }, { "timestamp": "2026-05-29 01:06:12,946", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc69953", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 1, "id": 32484 }, { "timestamp": "2026-05-29 01:06:13,852", "thread_id": "4696", "caller": "0x7ff79be75e31", "parentcaller": "0x7ff79bda1c43", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00001016" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 32485 }, { "timestamp": "2026-05-29 01:06:13,852", "thread_id": "4696", "caller": "0x7ff79be75e31", "parentcaller": "0x7ff79bda1c43", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00001018" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 32486 }, { "timestamp": "2026-05-29 01:06:13,852", "thread_id": "5108", "caller": "0x7fff426da250", "parentcaller": "0x7fff57fc7344", "category": "system", "api": "GetSystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 32487 }, { "timestamp": "2026-05-29 01:06:13,852", "thread_id": "5000", "caller": "0x7fff54890772", "parentcaller": "0x7fff5486709a", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00010128" }, { "name": "Message", "value": "0x00000060" } ], "repeated": 0, "id": 32488 }, { "timestamp": "2026-05-29 01:06:13,852", "thread_id": "4696", "caller": "0x7ff79bc1fa2e", "parentcaller": "0x7ff79bc7fc27", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000072" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 32489 }, { "timestamp": "2026-05-29 01:06:13,852", "thread_id": "4696", "caller": "0x7ff79bca5b09", "parentcaller": "0x7ff79bc1fa68", "category": "synchronization", "api": "NtOpenEvent", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "Handle", "value": "0x7ff79bc7fc22" }, { "name": "EventName", "value": "{A1965210-3A9D-4bca-822B-433645B3F5A2}" } ], "repeated": 0, "id": 32490 }, { "timestamp": "2026-05-29 01:06:13,852", "thread_id": "4696", "caller": "0x7ff79bc1faf5", "parentcaller": "0x7ff79bc1fa75", "category": "synchronization", "api": "NtOpenMutant", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "Handle", "value": "0x7ff79bc7fc22" }, { "name": "MutexName", "value": "Local\\__DDrawCheckExclMode__" } ], "repeated": 0, "id": 32491 }, { "timestamp": "2026-05-29 01:06:13,852", "thread_id": "4696", "caller": "0x7ff79bc19217", "parentcaller": "0x7ff79bc1fa94", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 32492 }, { "timestamp": "2026-05-29 01:06:13,852", "thread_id": "4696", "caller": "0x7ff79bc19217", "parentcaller": "0x7ff79bc1fa94", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 32493 }, { "timestamp": "2026-05-29 01:06:13,852", "thread_id": "4696", "caller": "0x7ff79bc19217", "parentcaller": "0x7ff79bc1fa94", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002724" }, { "name": "DesiredAccess", "value": "0x00000101", "pretty_value": "KEY_QUERY_VALUE|KEY_WOW64_64KEY" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\RetailDemo\\OobeWrite" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\RetailDemo\\OobeWrite" } ], "repeated": 0, "id": 32494 }, { "timestamp": "2026-05-29 01:06:13,852", "thread_id": "4696", "caller": "0x7ff79bc19217", "parentcaller": "0x7ff79bc1fa94", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002724" }, { "name": "ValueName", "value": "Enabled" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RetailDemo\\OobeWrite\\Enabled" } ], "repeated": 0, "id": 32495 }, { "timestamp": "2026-05-29 01:06:13,852", "thread_id": "4696", "caller": "0x7ff79bc19217", "parentcaller": "0x7ff79bc1fa94", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002724" } ], "repeated": 0, "id": 32496 }, { "timestamp": "2026-05-29 01:06:13,852", "thread_id": "4696", "caller": "0x7ff79bc19232", "parentcaller": "0x7ff79bc1fa94", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 32497 }, { "timestamp": "2026-05-29 01:06:13,852", "thread_id": "5108", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff42570a3f", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000025d8" }, { "name": "DesiredAccess", "value": "0x00000410", "pretty_value": "PROCESS_VM_READ|PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "5624" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" } ], "repeated": 0, "id": 32498 }, { "timestamp": "2026-05-29 01:06:13,852", "thread_id": "5108", "caller": "0x7fff5781026b", "parentcaller": "0x7fff42570dc8", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000025d8" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002720" } ], "repeated": 0, "id": 32499 }, { "timestamp": "2026-05-29 01:06:13,852", "thread_id": "5108", "caller": "0x7fff42570e03", "parentcaller": "0x7fff42570a6b", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 32500 }, { "timestamp": "2026-05-29 01:06:13,852", "thread_id": "5108", "caller": "0x7fff42570e77", "parentcaller": "0x7fff42570a6b", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\xc0\\xbd\\x85\\x0c\\x00\\x00\\x00\\x00\\x1c\\x00\\x1c\\x00\\x00\\x00\\x00\\x00`\\xbe\\x85\\x0c\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xbe\\x85\\x0c\\x00\\x00\\x00\\x00\\x12\\x00\\x12\\x00\\x00\\x00\\x00\\x00\\xd2\\xbf\\x85\\x0c\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe8\\xbf\\x85\\x0c\\x00\\x00\\x00\\x00\\x1e\\x00\\x1e\\x00\\x00\\x00\\x00\\x00\\xf0\\xbf\\x85\\x0c\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xc0\\x85\\x0c\\x00\\x00\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00\\x18\\xc0\\x85\\x0c\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x008\\xc0\\x85\\x0c\\x00\\x00\\x00\\x00W\\x00I\\x00N\\x00:\\x00/\\x00/\\x00S\\x00Y\\x00S\\x00A\\x00P\\x00P\\x00I\\x00D\\x00\\x00\\x00\\x00\\x00\\xae\\x00\\xae\\x00\\x00\\x00\\x00\\x00\\xb0\\xbe\\x85\\x0c\\x00\\x00\\x00\\x00\\x06\\x00\\x06\\x00\\x00\\x00\\x00\\x00^\\xbf\\x85\\x0c\\x00\\x00\\x00\\x00n\\x00n\\x00\\x00\\x00\\x00\\x00d\\xbf\\x85\\x0c\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 32501 }, { "timestamp": "2026-05-29 01:06:13,852", "thread_id": "5108", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff426da18b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000ea0" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 32502 }, { "timestamp": "2026-05-29 01:06:13,852", "thread_id": "4696", "caller": "0x7ff79bc76bd8", "parentcaller": "0x7ff79bc8a0c8", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00010110" }, { "name": "Message", "value": "0x0000c028" } ], "repeated": 0, "id": 32503 }, { "timestamp": "2026-05-29 01:06:13,852", "thread_id": "5000", "caller": "0x7fff57fc2eeb", "parentcaller": "0x7fff581ba00f", "category": "synchronization", "api": "NtFindAtom", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "AtomName", "value": "Microsoft.Windows.ShellManagedWindowAsNormalWindow" }, { "name": "Atom", "value": "0x00000000" } ], "repeated": 0, "id": 32504 }, { "timestamp": "2026-05-29 01:06:13,852", "thread_id": "5000", "caller": "0x7fff57fc2eeb", "parentcaller": "0x7fff581ba00f", "category": "synchronization", "api": "NtFindAtom", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "AtomName", "value": "Windows.Internal.Shell.Holographic.Win32PortedView" }, { "name": "Atom", "value": "0x00000000" } ], "repeated": 1, "id": 32505 }, { "timestamp": "2026-05-29 01:06:13,852", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff455848a6", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002724" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "5624" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" } ], "repeated": 0, "id": 32506 }, { "timestamp": "2026-05-29 01:06:13,852", "thread_id": "5000", "caller": "0x7fff5781026b", "parentcaller": "0x7fff45584920", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002724" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000272c" } ], "repeated": 0, "id": 32507 }, { "timestamp": "2026-05-29 01:06:13,852", "thread_id": "5000", "caller": "0x7fff45584c45", "parentcaller": "0x7fff45584941", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 32508 }, { "timestamp": "2026-05-29 01:06:13,852", "thread_id": "5000", "caller": "0x7fff45584ce5", "parentcaller": "0x7fff45584941", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\xc0\\xbd\\x85\\x0c\\x00\\x00\\x00\\x00\\x1c\\x00\\x1c\\x00\\x00\\x00\\x00\\x00`\\xbe\\x85\\x0c\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xbe\\x85\\x0c\\x00\\x00\\x00\\x00\\x12\\x00\\x12\\x00\\x00\\x00\\x00\\x00\\xd2\\xbf\\x85\\x0c\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe8\\xbf\\x85\\x0c\\x00\\x00\\x00\\x00\\x1e\\x00\\x1e\\x00\\x00\\x00\\x00\\x00\\xf0\\xbf\\x85\\x0c\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xc0\\x85\\x0c\\x00\\x00\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00\\x18\\xc0\\x85\\x0c\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x008\\xc0\\x85\\x0c\\x00\\x00\\x00\\x00W\\x00I\\x00N\\x00:\\x00/\\x00/\\x00S\\x00Y\\x00S\\x00A\\x00P\\x00P\\x00I\\x00D\\x00\\x00\\x00\\x00\\x00\\xae\\x00\\xae\\x00\\x00\\x00\\x00\\x00\\xb0\\xbe\\x85\\x0c\\x00\\x00\\x00\\x00\\x06\\x00\\x06\\x00\\x00\\x00\\x00\\x00^\\xbf\\x85\\x0c\\x00\\x00\\x00\\x00n\\x00n\\x00\\x00\\x00\\x00\\x00d\\xbf\\x85\\x0c\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 32509 }, { "timestamp": "2026-05-29 01:06:13,852", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "misc", "api": "GetKeyboardLayout", "status": true, "return": "0x04090409", "arguments": [ { "name": "KeyboardLayout", "value": "0x00000409" }, { "name": "LanguageName", "value": "English (United States)" } ], "repeated": 0, "id": 32510 }, { "timestamp": "2026-05-29 01:06:13,852", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 32511 }, { "timestamp": "2026-05-29 01:06:13,852", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000022e4" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 32512 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "4696", "caller": "0x7ff79bc77b46", "parentcaller": "0x7ff79bc1ade7", "category": "synchronization", "api": "NtFindAtom", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "AtomName", "value": "Microsoft.Windows.ShellManagedWindowAsNormalWindow" }, { "name": "Atom", "value": "0x00000000" } ], "repeated": 0, "id": 32513 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "4696", "caller": "0x7ff79bc521d5", "parentcaller": "0x7ff79bc51a67", "category": "system", "api": "GetLastInputInfo", "status": true, "return": "0x00000001", "arguments": [], "repeated": 0, "id": 32514 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "4696", "caller": "0x7ff79bc521fe", "parentcaller": "0x7ff79bc51a67", "category": "device", "api": "NtPowerInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "InformationLevel", "value": "16" }, { "name": "InputBuffer", "value": "" }, { "name": "OutputBuffer", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 32515 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "4560", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff557c3a98", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\x11\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4560" } ], "repeated": 0, "id": 32516 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "4696", "caller": "0x7ff79bc76bd8", "parentcaller": "0x7ff79bc8a0c8", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00010110" }, { "name": "Message", "value": "0x0000c028" } ], "repeated": 1, "id": 32517 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff57fc2eeb", "parentcaller": "0x7fff581ba00f", "category": "synchronization", "api": "NtFindAtom", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "AtomName", "value": "Microsoft.Windows.ShellManagedWindowAsNormalWindow" }, { "name": "Atom", "value": "0x00000000" } ], "repeated": 0, "id": 32518 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff57fc2eeb", "parentcaller": "0x7fff581ba00f", "category": "synchronization", "api": "NtFindAtom", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "AtomName", "value": "Windows.Internal.Shell.Holographic.Win32PortedView" }, { "name": "Atom", "value": "0x00000000" } ], "repeated": 1, "id": 32519 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff455848a6", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000272c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "5624" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" } ], "repeated": 0, "id": 32520 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff5781026b", "parentcaller": "0x7fff45584920", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000272c" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002730" } ], "repeated": 0, "id": 32521 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff45584c45", "parentcaller": "0x7fff45584941", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 32522 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff45584ce5", "parentcaller": "0x7fff45584941", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\xc0\\xbd\\x85\\x0c\\x00\\x00\\x00\\x00\\x1c\\x00\\x1c\\x00\\x00\\x00\\x00\\x00`\\xbe\\x85\\x0c\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xbe\\x85\\x0c\\x00\\x00\\x00\\x00\\x12\\x00\\x12\\x00\\x00\\x00\\x00\\x00\\xd2\\xbf\\x85\\x0c\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe8\\xbf\\x85\\x0c\\x00\\x00\\x00\\x00\\x1e\\x00\\x1e\\x00\\x00\\x00\\x00\\x00\\xf0\\xbf\\x85\\x0c\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xc0\\x85\\x0c\\x00\\x00\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00\\x18\\xc0\\x85\\x0c\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x008\\xc0\\x85\\x0c\\x00\\x00\\x00\\x00W\\x00I\\x00N\\x00:\\x00/\\x00/\\x00S\\x00Y\\x00S\\x00A\\x00P\\x00P\\x00I\\x00D\\x00\\x00\\x00\\x00\\x00\\xae\\x00\\xae\\x00\\x00\\x00\\x00\\x00\\xb0\\xbe\\x85\\x0c\\x00\\x00\\x00\\x00\\x06\\x00\\x06\\x00\\x00\\x00\\x00\\x00^\\xbf\\x85\\x0c\\x00\\x00\\x00\\x00n\\x00n\\x00\\x00\\x00\\x00\\x00d\\xbf\\x85\\x0c\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 32523 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff425ce2da", "parentcaller": "0x7fff4257d46e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 32524 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff57fc2eeb", "parentcaller": "0x7fff581ba00f", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "MultimonitorActivationException" }, { "name": "Atom", "value": "0x0000c049" } ], "repeated": 0, "id": 32525 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 2, "id": 32526 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2336", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00 \t\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2336" } ], "repeated": 0, "id": 32527 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 32528 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "6160", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x18\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6160" } ], "repeated": 0, "id": 32529 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 32530 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "6160", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x18\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6160" } ], "repeated": 0, "id": 32531 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58085ee4", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002048" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 32532 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2192", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x08\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2192" } ], "repeated": 0, "id": 32533 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "4560", "caller": "0x7ff79bc79d10", "parentcaller": "0x7ff79bc79c74", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 32534 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "6148", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x18\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6148" } ], "repeated": 0, "id": 32535 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "4560", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "CLSID\\{56AD4C5D-B908-4F85-8FF1-7940C29B3BCF}\\Instance" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\CLSID\\{56AD4C5D-B908-4F85-8FF1-7940C29B3BCF}\\Instance" } ], "repeated": 0, "id": 32536 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "736", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe6\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\x02\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "736" } ], "repeated": 0, "id": 32537 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "4560", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 32538 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "4560", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff58be0000", "arguments": [ { "name": "lpLibFileName", "value": "shell32.dll" }, { "name": "dwFlags", "value": "0x00004000" } ], "repeated": 0, "id": 32539 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "736", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff584c6d2f", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002548" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 32540 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "4560", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "SHELL32.dll" }, { "name": "ModuleHandle", "value": "0x7fff58be0000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff58c378f0" } ], "repeated": 0, "id": 32541 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "4560", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "synchronization", "api": "NtFindAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "{9F4C2855-9F79-4B39-A8D0-E1D42DE1D5F3} 5" }, { "name": "Atom", "value": "0x0000c067" } ], "repeated": 0, "id": 32542 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "4560", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000022e4" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "5624" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" } ], "repeated": 0, "id": 32543 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "4560", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000022e4" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00001ab4" } ], "repeated": 0, "id": 32544 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "4560", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 32545 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "4560", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\xc0\\xbd\\x85\\x0c\\x00\\x00\\x00\\x00\\x1c\\x00\\x1c\\x00\\x00\\x00\\x00\\x00`\\xbe\\x85\\x0c\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xbe\\x85\\x0c\\x00\\x00\\x00\\x00\\x12\\x00\\x12\\x00\\x00\\x00\\x00\\x00\\xd2\\xbf\\x85\\x0c\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe8\\xbf\\x85\\x0c\\x00\\x00\\x00\\x00\\x1e\\x00\\x1e\\x00\\x00\\x00\\x00\\x00\\xf0\\xbf\\x85\\x0c\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xc0\\x85\\x0c\\x00\\x00\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00\\x18\\xc0\\x85\\x0c\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x008\\xc0\\x85\\x0c\\x00\\x00\\x00\\x00W\\x00I\\x00N\\x00:\\x00/\\x00/\\x00S\\x00Y\\x00S\\x00A\\x00P\\x00P\\x00I\\x00D\\x00\\x00\\x00\\x00\\x00\\xae\\x00\\xae\\x00\\x00\\x00\\x00\\x00\\xb0\\xbe\\x85\\x0c\\x00\\x00\\x00\\x00\\x06\\x00\\x06\\x00\\x00\\x00\\x00\\x00^\\xbf\\x85\\x0c\\x00\\x00\\x00\\x00n\\x00n\\x00\\x00\\x00\\x00\\x00d\\xbf\\x85\\x0c\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 32546 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "4560", "caller": "0x7ff79bc79e89", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "CreateTimerQueueTimer", "status": true, "return": "0x00000001", "arguments": [ { "name": "phNewTimer", "value": "0x0cad5090" }, { "name": "TimerQueue", "value": "0x00000000" }, { "name": "Callback", "value": "0x9bc79ab0" }, { "name": "Parameter", "value": "0x07622ee0" }, { "name": "DueTime", "value": "3000" }, { "name": "Period", "value": "0" }, { "name": "Flags", "value": "8" } ], "repeated": 0, "id": 32547 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 32548 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58085ee4", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002048" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 32549 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "6160", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x18\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6160" } ], "repeated": 0, "id": 32550 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "6160", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x18\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6160" } ], "repeated": 0, "id": 32551 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbd423", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000272c" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "5624" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" } ], "repeated": 0, "id": 32552 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2192", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x08\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2192" } ], "repeated": 0, "id": 32553 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff41dbd59f", "parentcaller": "0x7fff41dfc80c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002730" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "\\Device\\Bam" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 32554 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2336", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 32555 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff41dbd603", "parentcaller": "0x7fff41dfc80c", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002730" }, { "name": "HandleName", "value": "\\Device\\Bam" }, { "name": "IoControlCode", "value": "0x00220004" }, { "name": "InputBuffer", "value": "\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00,'\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 32556 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "6148", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000100c4" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 3, "id": 32557 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "6148", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x18\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6148" } ], "repeated": 0, "id": 32558 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "736", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe6\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\x02\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "736" } ], "repeated": 0, "id": 32559 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbddbb", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002734" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "6136" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" } ], "repeated": 0, "id": 32560 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbddbb", "category": "process", "api": "NtOpenProcess", "status": false, "return": "0xffffffffc0000022", "pretty_return": "ACCESS_DENIED", "arguments": [ { "name": "ProcessHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "1180" } ], "repeated": 0, "id": 32561 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbddbb", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002738" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "5624" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" } ], "repeated": 0, "id": 32562 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbddbb", "category": "process", "api": "NtOpenProcess", "status": false, "return": "0xffffffffc0000022", "pretty_return": "ACCESS_DENIED", "arguments": [ { "name": "ProcessHandle", "value": "0x00002738" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "1048" } ], "repeated": 0, "id": 32563 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbddbb", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000273c" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "4484" } ], "repeated": 0, "id": 32564 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbddbb", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002740" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "12844" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" } ], "repeated": 0, "id": 32565 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbddbb", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002744" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "5128" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" } ], "repeated": 0, "id": 32566 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff41dbddbb", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002748" }, { "name": "DesiredAccess", "value": "0x00002000", "pretty_value": "0x00002000" }, { "name": "ProcessIdentifier", "value": "6400" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" } ], "repeated": 0, "id": 32567 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 1, "id": 32568 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2192", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x08\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2192" } ], "repeated": 0, "id": 32569 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 1, "id": 32570 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2192", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x08\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2192" } ], "repeated": 0, "id": 32571 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 1, "id": 32572 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2192", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x08\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2192" } ], "repeated": 0, "id": 32573 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 32574 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2192", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x08\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2192" } ], "repeated": 0, "id": 32575 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 1, "id": 32576 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2192", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x08\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2192" } ], "repeated": 0, "id": 32577 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 1, "id": 32578 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2192", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x08\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2192" } ], "repeated": 0, "id": 32579 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 1, "id": 32580 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2192", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x08\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2192" } ], "repeated": 0, "id": 32581 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 1, "id": 32582 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2192", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x08\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2192" } ], "repeated": 0, "id": 32583 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 1, "id": 32584 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2192", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x08\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2192" } ], "repeated": 0, "id": 32585 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 32586 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2192", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x08\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2192" } ], "repeated": 0, "id": 32587 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff41dbe842", "parentcaller": "0x7fff41dbd62c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000274c" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "\\Device\\Bam" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 32588 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2192", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x08\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2192" } ], "repeated": 1, "id": 32589 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff41dbe8a3", "parentcaller": "0x7fff41dbd62c", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000274c" }, { "name": "HandleName", "value": "\\Device\\Bam" }, { "name": "IoControlCode", "value": "0x00220004" }, { "name": "InputBuffer", "value": "\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x004'\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9c\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x008'\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00<'\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00@'\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00D'\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00H'\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 32590 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2192", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x08\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2192" } ], "repeated": 3, "id": 32591 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2336", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 32592 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2192", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x08\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2192" } ], "repeated": 1, "id": 32593 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2336", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 32594 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2192", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x08\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2192" } ], "repeated": 2, "id": 32595 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff42595b7f", "parentcaller": "0x7fff42595b24", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CloudExperienceHost" }, { "name": "Handle", "value": "0x0000272c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CloudExperienceHost" } ], "repeated": 0, "id": 32596 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2192", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x08\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2192" } ], "repeated": 0, "id": 32597 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000272c" }, { "name": "ObjectAttributesName", "value": "Fullscreen" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CloudExperienceHost\\Fullscreen" } ], "repeated": 0, "id": 32598 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff426bfce2", "parentcaller": "0x7fff42595b24", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000272c" } ], "repeated": 0, "id": 32599 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2192", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x08\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2192" } ], "repeated": 1, "id": 32600 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CloudExperienceHost" }, { "name": "Handle", "value": "0x0000272c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CloudExperienceHost" } ], "repeated": 0, "id": 32601 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000272c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 32602 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2192", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x08\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2192" } ], "repeated": 0, "id": 32603 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000272c" }, { "name": "ObjectAttributesName", "value": "Fullscreen" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CloudExperienceHost\\Fullscreen" } ], "repeated": 0, "id": 32604 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2192", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x08\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2192" } ], "repeated": 0, "id": 32605 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff426bfce2", "parentcaller": "0x7fff42595b24", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000272c" } ], "repeated": 0, "id": 32606 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2192", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x08\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2192" } ], "repeated": 1, "id": 32607 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 32608 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2192", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x08\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2192" } ], "repeated": 0, "id": 32609 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 32610 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2192", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x08\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2192" } ], "repeated": 0, "id": 32611 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000272c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" } ], "repeated": 0, "id": 32612 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2192", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x08\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2192" } ], "repeated": 0, "id": 32613 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff425d8e48", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000272c" }, { "name": "ValueName", "value": "ColorPrevalence" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\\ColorPrevalence" } ], "repeated": 0, "id": 32614 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577d3018", "parentcaller": "0x7fff425d8e48", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000272c" } ], "repeated": 0, "id": 32615 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 32616 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2192", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x08\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2192" } ], "repeated": 0, "id": 32617 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 32618 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000272c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" } ], "repeated": 0, "id": 32619 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff425d8ef6", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000272c" }, { "name": "ValueName", "value": "AppsUseLightTheme" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\\AppsUseLightTheme" } ], "repeated": 0, "id": 32620 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577d3018", "parentcaller": "0x7fff425d8ef6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000272c" } ], "repeated": 0, "id": 32621 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 32622 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 32623 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000272c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced" } ], "repeated": 0, "id": 32624 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff425da184", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000272c" }, { "name": "ValueName", "value": "HideFileExt" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\HideFileExt" } ], "repeated": 0, "id": 32625 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577d3018", "parentcaller": "0x7fff425da184", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000272c" } ], "repeated": 0, "id": 32626 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 32627 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2192", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x08\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2192" } ], "repeated": 0, "id": 32628 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2336", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 1, "id": 32629 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2192", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff517e2bd6", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002724" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "6136" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" } ], "repeated": 0, "id": 32630 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2192", "caller": "0x7fff5781026b", "parentcaller": "0x7fff517e2c2a", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002724" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000025d8" } ], "repeated": 0, "id": 32631 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2192", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff517e2c87", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 32632 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2192", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff517e29b1", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002724" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "6136" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" } ], "repeated": 0, "id": 32633 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2336", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 32634 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2192", "caller": "0x7fff5781026b", "parentcaller": "0x7fff517e29fb", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002724" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000025d8" } ], "repeated": 0, "id": 32635 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2192", "caller": "0x7fff59f9413e", "parentcaller": "0x7fff517e2a39", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 32636 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2192", "caller": "0x7fff59f9416d", "parentcaller": "0x7fff517e2a39", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "31" }, { "name": "TokenInformation", "value": "8\\xefy\r\\x00\\x00\\x00\\x00\\x01\\x08\\x00\\x00\\x00\\x00\\x00\\x0f\\x02\\x00\\x00\\x00<\\xe6\\xf3\\x1f\\x8a.\\x82*u\\xa8\\x8a?\\x1b(\\xed\\xbf9\\x8fA\\x14\\x0c\\xfc9u]5\n`$'\\x00\\x00\\x00\\x00\\x00\\x00\\xc2Tc\\x1a\\xff\\x7f\\x00\\x00$'\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 32637 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2192", "caller": "0x7fff59f941a8", "parentcaller": "0x7fff517e2a39", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "42" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 32638 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2192", "caller": "0x7fff59f941df", "parentcaller": "0x7fff517e2a39", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "12" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 32639 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2192", "caller": "0x7fff59f94256", "parentcaller": "0x7fff517e2a39", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "44" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00(\\x01sw^t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00(\\xf5y\r\\x00\\x00\\x00\\x00\\xf8\\x17\\x00\\x00\\x00\\x00\\x00\\x00@b\\x88\\x10\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 32640 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2192", "caller": "0x7fff577cf588", "parentcaller": "0x7fff517ead8b", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002724" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "Global\\Session\\1\\AppContainerNamedObjects\\S-1-15-2-536077884-713174666-1066051701-3219990555-339840825-1966734348-1611281757\\17f8HWNDInterface:1019e" } ], "repeated": 0, "id": 32641 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2336", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 32642 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2192", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c232", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002724" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08b30000" }, { "name": "SectionOffset", "value": "0x0d79f4b0" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 32643 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2336", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 32644 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2192", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff517eae5e", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08b30000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 32645 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2336", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 32646 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2192", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache" }, { "name": "Handle", "value": "0x0000272c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache" } ], "repeated": 0, "id": 32647 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2336", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 32648 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2192", "caller": "0x7fff4cbd1a81", "parentcaller": "0x7fff4cbd138a", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000272c" }, { "name": "SubKey", "value": "Metadata" }, { "name": "Handle", "value": "0x00002450" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Metadata" } ], "repeated": 0, "id": 32649 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2192", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577af579", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000272c" }, { "name": "SubKey", "value": "Package\\Index\\PackageFullName\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy" }, { "name": "Handle", "value": "0x00000468" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Index\\PackageFullName\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy" } ], "repeated": 0, "id": 32650 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2192", "caller": "0x7fff4cbd1732", "parentcaller": "0x7fff577af7dc", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000468" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "1a" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Index\\PackageFullName\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\\1a" } ], "repeated": 0, "id": 32651 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2192", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577af5fd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000468" } ], "repeated": 0, "id": 32652 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2192", "caller": "0x7fff4cbd1166", "parentcaller": "0x7fff577af308", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000272c" }, { "name": "SubKey", "value": "Package\\Data\\1a" }, { "name": "Handle", "value": "0x00000468" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\1a" } ], "repeated": 0, "id": 32653 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2192", "caller": "0x7fff4cbd16ad", "parentcaller": "0x7fff5781d320", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000468" }, { "name": "ValueName", "value": "PackageOrigin" }, { "name": "Data", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateRepository\\Cache\\Package\\Data\\1a\\PackageOrigin" } ], "repeated": 0, "id": 32654 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2192", "caller": "0x7fff4cbd1651", "parentcaller": "0x7fff577aed38", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000468" } ], "repeated": 0, "id": 32655 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2192", "caller": "0x7fff4cbd17f2", "parentcaller": "0x7fff577adcce", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002450" } ], "repeated": 0, "id": 32656 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2192", "caller": "0x7fff4cbd180b", "parentcaller": "0x7fff577adcce", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000272c" } ], "repeated": 0, "id": 32657 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2192", "caller": "0x7fff59f93f7a", "parentcaller": "0x7fff59770ed7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 32658 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2192", "caller": "0x7fff59770cd1", "parentcaller": "0x7fff597a1530", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x0000272c" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 32659 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2192", "caller": "0x7fff5781026b", "parentcaller": "0x7fff59770daf", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002730" } ], "repeated": 0, "id": 32660 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2192", "caller": "0x7fff59f88cde", "parentcaller": "0x7fff59fc9c4e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": " \\xf1\\x02\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 32661 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2192", "caller": "0x7fff59fb6e46", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "Xl\\xbf\\x0b\\x00\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x04]\\x88\\x8a\\xeb\\x1c\\xc9\\x11\\x9f\\xe8\\x08\\x00+\\x10H`\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00r\\x00-\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00;\\x00\\x00\\x00" } ], "repeated": 0, "id": 32662 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2192", "caller": "0x7fff59fb6e9b", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\x80X\\xbf\\x0b\\x00\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00F\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\xeb\\x1c\\xc9\\x11\\x9f\\xe8\\x08\\x00+\\x10H`\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00o\\x00r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00;\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 32663 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2192", "caller": "0x7fff59fb6ec0", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 32664 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2192", "caller": "0x7fff59fb6f0e", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xc8\\xd8u\\x0c\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 32665 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2192", "caller": "0x7fff59fb6f37", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 32666 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2192", "caller": "0x7fff59fb6f8f", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xb8i\\xbf\\x0b\\x00\\x00\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 32667 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2192", "caller": "0x7fff59fb7048", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x81\\x1a\\xff\\x7f\\x00\\x00\\xebPY\\x1a\\xff\\x7f\\x00\\x00h\"sw^t\\x00\\x00(N}\\x1a\\xff\\x7f\\x00\\x000\\xd8y\r\\x00\\x00\\x00\\x00(\\xd8y\r\\x00\\x00\\x00\\x00\\xf8\\xd7y\r\\x00\\x00\\x00\\x00\\x18\\xd8y\r" } ], "repeated": 0, "id": 32668 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2192", "caller": "0x7fff59fb707b", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0i\\xbf\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8Z\\x1a\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x18\\xd6y\r\\x00\\x00\\x00\\x000'\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00$\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2}\\x1a" } ], "repeated": 0, "id": 32669 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2192", "caller": "0x7fff59f88cde", "parentcaller": "0x7fff59f8953a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": " \\xf1\\x02\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 32670 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2192", "caller": "0x7fff59fb6e46", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "8_\\xbf\\x0b\\x00\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x04]\\x88\\x8a\\xeb\\x1c\\xc9\\x11\\x9f\\xe8\\x08\\x00+\\x10H`\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00.\\x00C\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'\\x00\\x00\\x00" } ], "repeated": 0, "id": 32671 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2192", "caller": "0x7fff59fb6e9b", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xa0_\\xbf\\x0b\\x00\\x00\\x00\\x00`\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\xff\\x7f\\x00\\x00\\x9f\\xe8\\x08\\x00+\\x10H`\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 32672 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2192", "caller": "0x7fff59fb6ec0", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 32673 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2192", "caller": "0x7fff59fb6f0e", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xf8\\xd5u\\x0c\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 32674 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2192", "caller": "0x7fff59fb6f37", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 32675 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2192", "caller": "0x7fff59fb6f8f", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\x18j\\xbf\\x0b\\x00\\x00\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 32676 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2192", "caller": "0x7fff59fb7048", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x81\\x1a\\xff\\x7f\\x00\\x00\\xebPY\\x1a\\xff\\x7f\\x00\\x00\\xc8!sw^t\\x00\\x00(N}\\x1a\\xff\\x7f\\x00\\x00\\x90\\xd4y\r\\x00\\x00\\x00\\x00\\x88\\xd4y\r\\x00\\x00\\x00\\x00X\\xd4y\r\\x00\\x00\\x00\\x00x\\xd4y\r" } ], "repeated": 0, "id": 32677 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2192", "caller": "0x7fff59fb707b", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10j\\xbf\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8Z\\x1a\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00x\\xd2y\r\\x00\\x00\\x00\\x000'\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00$\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2}\\x1a" } ], "repeated": 0, "id": 32678 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2192", "caller": "0x7fff597a1630", "parentcaller": "0x7fff597a12cd", "category": "system", "api": "NtQuerySystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 32679 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "4956", "caller": "0x7fff58520e98", "parentcaller": "0x7fff5859b785", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 32680 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff58519794", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "F6C29334-47DC-4397-9150-F549CF1D4861" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 32681 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 32682 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2336", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00 \t\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2336" } ], "repeated": 0, "id": 32683 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2336", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 2, "id": 32684 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2336", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00 \t\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2336" } ], "repeated": 0, "id": 32685 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff57fc2755", "parentcaller": "0x7fff57fc2699", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "{\\x00C\\x005\\x006\\x00C\\x005\\x007\\x009\\x009\\x00-\\x004\\x00B\\x00B\\x003\\x00-\\x007\\x00F\\x00A\\x00E\\x00-\\x007\\x00F\\x00A\\x00D\\x00-\\x004\\x00D\\x00B\\x002\\x00F\\x006\\x00A\\x005\\x003\\x00E\\x00F\\x00F\\x00}\\x00" }, { "name": "Size", "value": "76" }, { "name": "Atom", "value": "0x0000c05f" } ], "repeated": 1, "id": 32686 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "4956", "caller": "0x7fff58520e98", "parentcaller": "0x7fff5859b785", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 32687 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff517e2bd6", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002450" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "6136" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" } ], "repeated": 0, "id": 32688 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff5781026b", "parentcaller": "0x7fff517e2c2a", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002450" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000468" } ], "repeated": 0, "id": 32689 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff517e2c87", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 32690 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff517e29b1", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002450" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "6136" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" } ], "repeated": 0, "id": 32691 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff5781026b", "parentcaller": "0x7fff517e29fb", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00002450" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000468" } ], "repeated": 0, "id": 32692 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff59f9413e", "parentcaller": "0x7fff517e2a39", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 32693 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff59f9416d", "parentcaller": "0x7fff517e2a39", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "31" }, { "name": "TokenInformation", "value": "\\x98\\xdf\\x19\\x08\\x00\\x00\\x00\\x00\\x01\\x08\\x00\\x00\\x00\\x00\\x00\\x0f\\x02\\x00\\x00\\x00<\\xe6\\xf3\\x1f\\x8a.\\x82*u\\xa8\\x8a?\\x1b(\\xed\\xbf9\\x8fA\\x14\\x0c\\xfc9u]5\n`P$\\x00\\x00\\x00\\x00\\x00\\x00\\xc2Tc\\x1a\\xff\\x7f\\x00\\x00P$\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 32694 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff59f941a8", "parentcaller": "0x7fff517e2a39", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "42" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 32695 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff59f941df", "parentcaller": "0x7fff517e2a39", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "12" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 32696 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff59f94256", "parentcaller": "0x7fff517e2a39", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "44" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb1&\\xfaY\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x880\\x13r^t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\xe5\\x19\\x08\\x00\\x00\\x00\\x00\\xf8\\x17\\x00\\x00\\x00\\x00\\x00\\x00@b\\x88\\x10\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 32697 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577cf588", "parentcaller": "0x7fff517ead8b", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002450" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "Global\\Session\\1\\AppContainerNamedObjects\\S-1-15-2-536077884-713174666-1066051701-3219990555-339840825-1966734348-1611281757\\17f8HWNDInterface:1019e" } ], "repeated": 0, "id": 32698 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c232", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002450" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08b30000" }, { "name": "SectionOffset", "value": "0x0819e510" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 32699 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff517eae5e", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08b30000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 32700 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff58519794", "parentcaller": "0x7fff517eb1dd", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "F6C29334-47DC-4397-9150-F549CF1D4861" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 32701 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 32702 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2336", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00 \t\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2336" } ], "repeated": 0, "id": 32703 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2336", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 2, "id": 32704 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 32705 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff4274356a", "parentcaller": "0x7fff42799839", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x00000002", "pretty_value": "KEY_SET_VALUE" }, { "name": "Handle", "value": "0x00002450" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 32706 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff427435a9", "parentcaller": "0x7fff42799839", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002450" }, { "name": "ValueName", "value": "TraySearchBoxVisible" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Buffer", "value": "0" }, { "name": "BufferLength", "value": "4" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\TraySearchBoxVisible" } ], "repeated": 0, "id": 32707 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff427435c1", "parentcaller": "0x7fff42799839", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002450" } ], "repeated": 0, "id": 32708 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 32709 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 32710 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002450" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced" } ], "repeated": 0, "id": 32711 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff425e8fa6", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002450" }, { "name": "ValueName", "value": "TaskbarSmallIcons" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\TaskbarSmallIcons" } ], "repeated": 0, "id": 32712 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577d3018", "parentcaller": "0x7fff425e8fa6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002450" } ], "repeated": 0, "id": 32713 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 32714 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 32715 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" } ], "repeated": 0, "id": 32716 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "4956", "caller": "0x7fff58520e98", "parentcaller": "0x7fff5859b785", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 32717 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 32718 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 32719 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002450" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" } ], "repeated": 0, "id": 32720 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002450" }, { "name": "ValueName", "value": "Current" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Current" } ], "repeated": 0, "id": 32721 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577d3018", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002450" } ], "repeated": 0, "id": 32722 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff4bfd299f", "parentcaller": "0x7fff425e9098", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Accessibility" }, { "name": "Handle", "value": "0x00002450" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Accessibility" } ], "repeated": 0, "id": 32723 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff4bfd2a24", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002450" }, { "name": "ValueName", "value": "TextScaleFactor" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Accessibility\\TextScaleFactor" } ], "repeated": 0, "id": 32724 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff4bfd2a6a", "parentcaller": "0x7fff425e9098", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002450" } ], "repeated": 0, "id": 32725 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 32726 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 32727 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" } ], "repeated": 0, "id": 32728 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 32729 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 32730 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002450" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" } ], "repeated": 0, "id": 32731 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002450" }, { "name": "ValueName", "value": "Current" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Current" } ], "repeated": 0, "id": 32732 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577d3018", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002450" } ], "repeated": 0, "id": 32733 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 32734 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 32735 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" } ], "repeated": 0, "id": 32736 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 32737 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 32738 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002450" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" } ], "repeated": 0, "id": 32739 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002450" }, { "name": "ValueName", "value": "Current" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Current" } ], "repeated": 0, "id": 32740 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577d3018", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002450" } ], "repeated": 0, "id": 32741 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 32742 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 32743 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" } ], "repeated": 0, "id": 32744 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 32745 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 32746 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002450" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" } ], "repeated": 0, "id": 32747 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002450" }, { "name": "ValueName", "value": "Current" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Current" } ], "repeated": 0, "id": 32748 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577d3018", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002450" } ], "repeated": 0, "id": 32749 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff4bfd299f", "parentcaller": "0x7fff425e9098", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Accessibility" }, { "name": "Handle", "value": "0x00002450" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Accessibility" } ], "repeated": 0, "id": 32750 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff4bfd2a24", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002450" }, { "name": "ValueName", "value": "TextScaleFactor" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Accessibility\\TextScaleFactor" } ], "repeated": 0, "id": 32751 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff4bfd2a6a", "parentcaller": "0x7fff425e9098", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002450" } ], "repeated": 0, "id": 32752 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 32753 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 32754 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" } ], "repeated": 0, "id": 32755 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 32756 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 32757 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002450" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" } ], "repeated": 0, "id": 32758 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002450" }, { "name": "ValueName", "value": "Current" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Current" } ], "repeated": 0, "id": 32759 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577d3018", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002450" } ], "repeated": 0, "id": 32760 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 32761 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 32762 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" } ], "repeated": 0, "id": 32763 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 32764 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 32765 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002450" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" } ], "repeated": 0, "id": 32766 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002450" }, { "name": "ValueName", "value": "Current" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Current" } ], "repeated": 0, "id": 32767 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577d3018", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002450" } ], "repeated": 0, "id": 32768 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 32769 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 32770 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Override" } ], "repeated": 0, "id": 32771 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 32772 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 32773 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002450" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting" } ], "repeated": 0, "id": 32774 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002450" }, { "name": "ValueName", "value": "Current" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search\\Flighting\\Current" } ], "repeated": 0, "id": 32775 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577d3018", "parentcaller": "0x7fff4259d20e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002450" } ], "repeated": 0, "id": 32776 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 32777 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "6160", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x18\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6160" } ], "repeated": 0, "id": 32778 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 32779 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58085ee4", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002048" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 32780 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "6148", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x18\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6148" } ], "repeated": 0, "id": 32781 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff58519794", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "F6C29334-47DC-4397-9150-F549CF1D4861" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 32782 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2336", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 32783 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 32784 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "6160", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xff\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x18\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6160" } ], "repeated": 0, "id": 32785 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2336", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00 \t\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2336" } ], "repeated": 1, "id": 32786 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2192", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x08\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2192" } ], "repeated": 0, "id": 32787 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2336", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 1, "id": 32788 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 32789 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2192", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x08\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2192" } ], "repeated": 0, "id": 32790 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2192", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x08\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2192" } ], "repeated": 0, "id": 32791 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "5000", "caller": "0x7fff577cf84f", "parentcaller": "0x7fff425db035", "category": "synchronization", "api": "NtOpenEvent", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "Handle", "value": "0x00000000" }, { "name": "EventName", "value": "ShellSearchReadyEvent" } ], "repeated": 0, "id": 32792 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2336", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 32793 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2336", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00 \t\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2336" } ], "repeated": 1, "id": 32794 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2336", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 2, "id": 32795 }, { "timestamp": "2026-05-29 01:06:13,868", "thread_id": "2336", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00 \t\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2336" } ], "repeated": 0, "id": 32796 }, { "timestamp": "2026-05-29 01:06:13,883", "thread_id": "4956", "caller": "0x7fff58520e98", "parentcaller": "0x7fff5859b785", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 32797 }, { "timestamp": "2026-05-29 01:06:13,883", "thread_id": "5000", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfa\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x13\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5000" } ], "repeated": 0, "id": 32798 }, { "timestamp": "2026-05-29 01:06:13,883", "thread_id": "2192", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x08\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2192" } ], "repeated": 0, "id": 32799 }, { "timestamp": "2026-05-29 01:06:13,883", "thread_id": "2192", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0001010a" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 2, "id": 32800 }, { "timestamp": "2026-05-29 01:06:13,883", "thread_id": "2192", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xe5\\x00\\x00\\x00\\x00\\x00\\x84\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x08\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2192" } ], "repeated": 0, "id": 32801 }, { "timestamp": "2026-05-29 01:06:13,977", "thread_id": "4696", "caller": "0x7ff79bc76bd8", "parentcaller": "0x7ff79bc8a0c8", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00010110" }, { "name": "Message", "value": "0x0000c028" } ], "repeated": 0, "id": 32802 }, { "timestamp": "2026-05-29 01:06:13,977", "thread_id": "5000", "caller": "0x7fff57fc2eeb", "parentcaller": "0x7fff581ba00f", "category": "synchronization", "api": "NtFindAtom", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "AtomName", "value": "Microsoft.Windows.ShellManagedWindowAsNormalWindow" }, { "name": "Atom", "value": "0x00000000" } ], "repeated": 0, "id": 32803 }, { "timestamp": "2026-05-29 01:06:13,977", "thread_id": "4696", "caller": "0x7ff79bc76bd8", "parentcaller": "0x7ff79bc8a0c8", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00010110" }, { "name": "Message", "value": "0x0000c028" } ], "repeated": 0, "id": 32804 }, { "timestamp": "2026-05-29 01:06:13,977", "thread_id": "5000", "caller": "0x7fff57fc2eeb", "parentcaller": "0x7fff581ba00f", "category": "synchronization", "api": "NtFindAtom", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "AtomName", "value": "Windows.Internal.Shell.Holographic.Win32PortedView" }, { "name": "Atom", "value": "0x00000000" } ], "repeated": 1, "id": 32805 }, { "timestamp": "2026-05-29 01:06:13,977", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff455848a6", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000274c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "5624" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" } ], "repeated": 0, "id": 32806 }, { "timestamp": "2026-05-29 01:06:13,977", "thread_id": "5000", "caller": "0x7fff5781026b", "parentcaller": "0x7fff45584920", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000274c" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002748" } ], "repeated": 0, "id": 32807 }, { "timestamp": "2026-05-29 01:06:13,977", "thread_id": "5000", "caller": "0x7fff45584c45", "parentcaller": "0x7fff45584941", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 32808 }, { "timestamp": "2026-05-29 01:06:13,977", "thread_id": "5000", "caller": "0x7fff45584ce5", "parentcaller": "0x7fff45584941", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\xc0\\xbd\\x85\\x0c\\x00\\x00\\x00\\x00\\x1c\\x00\\x1c\\x00\\x00\\x00\\x00\\x00`\\xbe\\x85\\x0c\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xbe\\x85\\x0c\\x00\\x00\\x00\\x00\\x12\\x00\\x12\\x00\\x00\\x00\\x00\\x00\\xd2\\xbf\\x85\\x0c\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe8\\xbf\\x85\\x0c\\x00\\x00\\x00\\x00\\x1e\\x00\\x1e\\x00\\x00\\x00\\x00\\x00\\xf0\\xbf\\x85\\x0c\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xc0\\x85\\x0c\\x00\\x00\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00\\x18\\xc0\\x85\\x0c\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x008\\xc0\\x85\\x0c\\x00\\x00\\x00\\x00W\\x00I\\x00N\\x00:\\x00/\\x00/\\x00S\\x00Y\\x00S\\x00A\\x00P\\x00P\\x00I\\x00D\\x00\\x00\\x00\\x00\\x00\\xae\\x00\\xae\\x00\\x00\\x00\\x00\\x00\\xb0\\xbe\\x85\\x0c\\x00\\x00\\x00\\x00\\x06\\x00\\x06\\x00\\x00\\x00\\x00\\x00^\\xbf\\x85\\x0c\\x00\\x00\\x00\\x00n\\x00n\\x00\\x00\\x00\\x00\\x00d\\xbf\\x85\\x0c\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 32809 }, { "timestamp": "2026-05-29 01:06:13,977", "thread_id": "5000", "caller": "0x7fff57fc2eeb", "parentcaller": "0x7fff581ba00f", "category": "synchronization", "api": "NtFindAtom", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "AtomName", "value": "Microsoft.Windows.ShellManagedWindowAsNormalWindow" }, { "name": "Atom", "value": "0x00000000" } ], "repeated": 0, "id": 32810 }, { "timestamp": "2026-05-29 01:06:13,977", "thread_id": "5000", "caller": "0x7fff57fc2eeb", "parentcaller": "0x7fff581ba00f", "category": "synchronization", "api": "NtFindAtom", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "AtomName", "value": "Windows.Internal.Shell.Holographic.Win32PortedView" }, { "name": "Atom", "value": "0x00000000" } ], "repeated": 1, "id": 32811 }, { "timestamp": "2026-05-29 01:06:13,977", "thread_id": "5000", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff455848a6", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000274c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "5624" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" } ], "repeated": 0, "id": 32812 }, { "timestamp": "2026-05-29 01:06:13,977", "thread_id": "5000", "caller": "0x7fff5781026b", "parentcaller": "0x7fff45584920", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000274c" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00002748" } ], "repeated": 0, "id": 32813 }, { "timestamp": "2026-05-29 01:06:13,977", "thread_id": "5000", "caller": "0x7fff45584c45", "parentcaller": "0x7fff45584941", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 32814 }, { "timestamp": "2026-05-29 01:06:13,977", "thread_id": "5000", "caller": "0x7fff45584ce5", "parentcaller": "0x7fff45584941", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\xc0\\xbd\\x85\\x0c\\x00\\x00\\x00\\x00\\x1c\\x00\\x1c\\x00\\x00\\x00\\x00\\x00`\\xbe\\x85\\x0c\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xbe\\x85\\x0c\\x00\\x00\\x00\\x00\\x12\\x00\\x12\\x00\\x00\\x00\\x00\\x00\\xd2\\xbf\\x85\\x0c\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe8\\xbf\\x85\\x0c\\x00\\x00\\x00\\x00\\x1e\\x00\\x1e\\x00\\x00\\x00\\x00\\x00\\xf0\\xbf\\x85\\x0c\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xc0\\x85\\x0c\\x00\\x00\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00\\x18\\xc0\\x85\\x0c\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x008\\xc0\\x85\\x0c\\x00\\x00\\x00\\x00W\\x00I\\x00N\\x00:\\x00/\\x00/\\x00S\\x00Y\\x00S\\x00A\\x00P\\x00P\\x00I\\x00D\\x00\\x00\\x00\\x00\\x00\\xae\\x00\\xae\\x00\\x00\\x00\\x00\\x00\\xb0\\xbe\\x85\\x0c\\x00\\x00\\x00\\x00\\x06\\x00\\x06\\x00\\x00\\x00\\x00\\x00^\\xbf\\x85\\x0c\\x00\\x00\\x00\\x00n\\x00n\\x00\\x00\\x00\\x00\\x00d\\xbf\\x85\\x0c\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 32815 }, { "timestamp": "2026-05-29 01:06:15,368", "thread_id": "6172", "caller": "0x7fff581bbde9", "parentcaller": "0x7fff3b9720cf", "category": "system", "api": "GetUserDefaultLCID", "status": true, "return": "0x00000c09", "arguments": [ { "name": "SystemDefaultLangID", "value": "0x00000c09" }, { "name": "LanguageName", "value": "English (Australia)" } ], "repeated": 2, "id": 32816 }, { "timestamp": "2026-05-29 01:06:15,368", "thread_id": "4696", "caller": "0x7ff79bc69ac0", "parentcaller": "0x7ff79bc69f41", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 32817 }, { "timestamp": "2026-05-29 01:06:15,368", "thread_id": "4696", "caller": "0x7ff79bc69b1e", "parentcaller": "0x7ff79bc69f41", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 32818 }, { "timestamp": "2026-05-29 01:06:15,368", "thread_id": "4696", "caller": "0x7ff79bc69b1e", "parentcaller": "0x7ff79bc69f41", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 32819 }, { "timestamp": "2026-05-29 01:06:15,368", "thread_id": "4696", "caller": "0x7ff79bc69b1e", "parentcaller": "0x7ff79bc69f41", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000274c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" } ], "repeated": 0, "id": 32820 }, { "timestamp": "2026-05-29 01:06:15,368", "thread_id": "4696", "caller": "0x7ff79bc69b1e", "parentcaller": "0x7ff79bc69f41", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000274c" }, { "name": "ValueName", "value": "ColorPrevalence" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\\ColorPrevalence" } ], "repeated": 0, "id": 32821 }, { "timestamp": "2026-05-29 01:06:15,368", "thread_id": "4696", "caller": "0x7ff79bc69b1e", "parentcaller": "0x7ff79bc69f41", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000274c" } ], "repeated": 0, "id": 32822 }, { "timestamp": "2026-05-29 01:06:15,368", "thread_id": "4696", "caller": "0x7ff79bc69b4c", "parentcaller": "0x7ff79bc69f41", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xf0\\xf1\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xf7\\x7f\\x00\\x00\\x88\\x84\\xfc\\x9b\\xf7\\x7f\\x00\\x00\\x88\\x84\\xfc\\x9b\\xf7\\x7f\\x00\\x00L'\\x00\\x00\\x00\\x00\\x00\\x00\\xb9E[\\x1a\\xff\\x7f\\x00\\x00@\\xf2\\\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 32823 }, { "timestamp": "2026-05-29 01:06:15,368", "thread_id": "4696", "caller": "0x7ff79bc69b4c", "parentcaller": "0x7ff79bc69f41", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000274c" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 32824 }, { "timestamp": "2026-05-29 01:06:15,368", "thread_id": "4696", "caller": "0x7ff79bc69b4c", "parentcaller": "0x7ff79bc69f41", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000274c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 32825 }, { "timestamp": "2026-05-29 01:06:15,368", "thread_id": "4696", "caller": "0x7ff79bc69b4c", "parentcaller": "0x7ff79bc69f41", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002748" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000274c" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" } ], "repeated": 0, "id": 32826 }, { "timestamp": "2026-05-29 01:06:15,368", "thread_id": "4696", "caller": "0x7ff79bc69b4c", "parentcaller": "0x7ff79bc69f41", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002748" }, { "name": "ValueName", "value": "SystemUsesLightTheme" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\\SystemUsesLightTheme" } ], "repeated": 0, "id": 32827 }, { "timestamp": "2026-05-29 01:06:15,368", "thread_id": "4696", "caller": "0x7ff79bc69b4c", "parentcaller": "0x7ff79bc69f41", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002748" } ], "repeated": 0, "id": 32828 }, { "timestamp": "2026-05-29 01:06:15,368", "thread_id": "4696", "caller": "0x7ff79bc69b4c", "parentcaller": "0x7ff79bc69f41", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000274c" } ], "repeated": 0, "id": 32829 }, { "timestamp": "2026-05-29 01:06:15,368", "thread_id": "4696", "caller": "0x7ff79bc69bb6", "parentcaller": "0x7ff79bc69f41", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 32830 }, { "timestamp": "2026-05-29 01:06:15,368", "thread_id": "4696", "caller": "0x7ff79bc69bb6", "parentcaller": "0x7ff79bc69f41", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 32831 }, { "timestamp": "2026-05-29 01:06:15,368", "thread_id": "4696", "caller": "0x7ff79bc69bb6", "parentcaller": "0x7ff79bc69f41", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000274c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" } ], "repeated": 0, "id": 32832 }, { "timestamp": "2026-05-29 01:06:15,368", "thread_id": "4696", "caller": "0x7ff79bc69bb6", "parentcaller": "0x7ff79bc69f41", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000274c" }, { "name": "ValueName", "value": "EnableTransparency" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\\EnableTransparency" } ], "repeated": 0, "id": 32833 }, { "timestamp": "2026-05-29 01:06:15,368", "thread_id": "4696", "caller": "0x7ff79bc69bb6", "parentcaller": "0x7ff79bc69f41", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000274c" } ], "repeated": 0, "id": 32834 }, { "timestamp": "2026-05-29 01:06:15,368", "thread_id": "4696", "caller": "0x7ff79bc69ac0", "parentcaller": "0x7ff79bc69c05", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 32835 }, { "timestamp": "2026-05-29 01:06:15,368", "thread_id": "4696", "caller": "0x7ff79bc69b1e", "parentcaller": "0x7ff79bc69c05", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 32836 }, { "timestamp": "2026-05-29 01:06:15,368", "thread_id": "4696", "caller": "0x7ff79bc69b1e", "parentcaller": "0x7ff79bc69c05", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 32837 }, { "timestamp": "2026-05-29 01:06:15,368", "thread_id": "4696", "caller": "0x7ff79bc69b1e", "parentcaller": "0x7ff79bc69c05", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000274c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" } ], "repeated": 0, "id": 32838 }, { "timestamp": "2026-05-29 01:06:15,368", "thread_id": "4696", "caller": "0x7ff79bc69b1e", "parentcaller": "0x7ff79bc69c05", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000274c" }, { "name": "ValueName", "value": "ColorPrevalence" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\\ColorPrevalence" } ], "repeated": 0, "id": 32839 }, { "timestamp": "2026-05-29 01:06:15,368", "thread_id": "4696", "caller": "0x7ff79bc69b1e", "parentcaller": "0x7ff79bc69c05", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000274c" } ], "repeated": 0, "id": 32840 }, { "timestamp": "2026-05-29 01:06:15,368", "thread_id": "4696", "caller": "0x7ff79bc69b4c", "parentcaller": "0x7ff79bc69c05", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xf1\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xf7\\x7f\\x00\\x00\\x88\\x84\\xfc\\x9b\\xf7\\x7f\\x00\\x00\\x88\\x84\\xfc\\x9b\\xf7\\x7f\\x00\\x00L'\\x00\\x00\\x00\\x00\\x00\\x00\\xb9E[\\x1a\\xff\\x7f\\x00\\x00\\x00\\xf2\\\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 32841 }, { "timestamp": "2026-05-29 01:06:15,368", "thread_id": "4696", "caller": "0x7ff79bc69b4c", "parentcaller": "0x7ff79bc69c05", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000274c" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 32842 }, { "timestamp": "2026-05-29 01:06:15,368", "thread_id": "4696", "caller": "0x7ff79bc69b4c", "parentcaller": "0x7ff79bc69c05", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000274c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 32843 }, { "timestamp": "2026-05-29 01:06:15,368", "thread_id": "4696", "caller": "0x7ff79bc69b4c", "parentcaller": "0x7ff79bc69c05", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002748" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000274c" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" } ], "repeated": 0, "id": 32844 }, { "timestamp": "2026-05-29 01:06:15,368", "thread_id": "4696", "caller": "0x7ff79bc69b4c", "parentcaller": "0x7ff79bc69c05", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002748" }, { "name": "ValueName", "value": "SystemUsesLightTheme" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\\SystemUsesLightTheme" } ], "repeated": 0, "id": 32845 }, { "timestamp": "2026-05-29 01:06:15,368", "thread_id": "4696", "caller": "0x7ff79bc69b4c", "parentcaller": "0x7ff79bc69c05", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002748" } ], "repeated": 0, "id": 32846 }, { "timestamp": "2026-05-29 01:06:15,368", "thread_id": "4696", "caller": "0x7ff79bc69b4c", "parentcaller": "0x7ff79bc69c05", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000274c" } ], "repeated": 0, "id": 32847 }, { "timestamp": "2026-05-29 01:06:15,368", "thread_id": "4696", "caller": "0x7ff79bc69bb6", "parentcaller": "0x7ff79bc69c05", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 32848 }, { "timestamp": "2026-05-29 01:06:15,368", "thread_id": "4696", "caller": "0x7ff79bc69bb6", "parentcaller": "0x7ff79bc69c05", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 32849 }, { "timestamp": "2026-05-29 01:06:15,368", "thread_id": "4696", "caller": "0x7ff79bc69bb6", "parentcaller": "0x7ff79bc69c05", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002450" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" } ], "repeated": 0, "id": 32850 }, { "timestamp": "2026-05-29 01:06:15,368", "thread_id": "4696", "caller": "0x7ff79bc69bb6", "parentcaller": "0x7ff79bc69c05", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002450" }, { "name": "ValueName", "value": "EnableTransparency" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\\EnableTransparency" } ], "repeated": 0, "id": 32851 }, { "timestamp": "2026-05-29 01:06:15,368", "thread_id": "4696", "caller": "0x7ff79bc69bb6", "parentcaller": "0x7ff79bc69c05", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002450" } ], "repeated": 0, "id": 32852 }, { "timestamp": "2026-05-29 01:06:15,368", "thread_id": "4696", "caller": "0x7ff79bc8a9d0", "parentcaller": "0x7ff79bc69c32", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 32853 }, { "timestamp": "2026-05-29 01:06:15,368", "thread_id": "4696", "caller": "0x7ff79bc8a9d0", "parentcaller": "0x7ff79bc69c32", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000246c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 32854 }, { "timestamp": "2026-05-29 01:06:15,368", "thread_id": "4696", "caller": "0x7ff79bc8a9d0", "parentcaller": "0x7ff79bc69c32", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002450" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000246c" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced" } ], "repeated": 0, "id": 32855 }, { "timestamp": "2026-05-29 01:06:15,368", "thread_id": "4696", "caller": "0x7ff79bc8a9d0", "parentcaller": "0x7ff79bc69c32", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00002450" }, { "name": "ValueName", "value": "UseOLEDTaskbarTransparency" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\UseOLEDTaskbarTransparency" } ], "repeated": 0, "id": 32856 }, { "timestamp": "2026-05-29 01:06:15,368", "thread_id": "4696", "caller": "0x7ff79bc8a9d0", "parentcaller": "0x7ff79bc69c32", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002450" } ], "repeated": 0, "id": 32857 }, { "timestamp": "2026-05-29 01:06:15,368", "thread_id": "4696", "caller": "0x7ff79bc69ac0", "parentcaller": "0x7ff79bc6986f", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 32858 }, { "timestamp": "2026-05-29 01:06:15,368", "thread_id": "4696", "caller": "0x7ff79bc69b1e", "parentcaller": "0x7ff79bc6986f", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 32859 }, { "timestamp": "2026-05-29 01:06:15,368", "thread_id": "4696", "caller": "0x7ff79bc69b1e", "parentcaller": "0x7ff79bc6986f", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 32860 }, { "timestamp": "2026-05-29 01:06:15,368", "thread_id": "4696", "caller": "0x7ff79bc69b1e", "parentcaller": "0x7ff79bc6986f", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002450" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" } ], "repeated": 0, "id": 32861 }, { "timestamp": "2026-05-29 01:06:15,368", "thread_id": "4696", "caller": "0x7ff79bc69b1e", "parentcaller": "0x7ff79bc6986f", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002450" }, { "name": "ValueName", "value": "ColorPrevalence" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\\ColorPrevalence" } ], "repeated": 0, "id": 32862 }, { "timestamp": "2026-05-29 01:06:15,368", "thread_id": "4696", "caller": "0x7ff79bc69b1e", "parentcaller": "0x7ff79bc6986f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002450" } ], "repeated": 0, "id": 32863 }, { "timestamp": "2026-05-29 01:06:15,368", "thread_id": "4696", "caller": "0x7ff79bc69b4c", "parentcaller": "0x7ff79bc6986f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xc0\\xf1\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xf7\\x7f\\x00\\x00\\x88\\x84\\xfc\\x9b\\xf7\\x7f\\x00\\x00\\x88\\x84\\xfc\\x9b\\xf7\\x7f\\x00\\x00P$\\x00\\x00\\x00\\x00\\x00\\x00\\xb9E[\\x1a\\xff\\x7f\\x00\\x00\\x10\\xf2\\\\x03\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 32864 }, { "timestamp": "2026-05-29 01:06:15,368", "thread_id": "4696", "caller": "0x7ff79bc69b4c", "parentcaller": "0x7ff79bc6986f", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002450" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 32865 }, { "timestamp": "2026-05-29 01:06:15,368", "thread_id": "4696", "caller": "0x7ff79bc69b4c", "parentcaller": "0x7ff79bc6986f", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002450" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 32866 }, { "timestamp": "2026-05-29 01:06:15,368", "thread_id": "4696", "caller": "0x7ff79bc69b4c", "parentcaller": "0x7ff79bc6986f", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000468" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00002450" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" } ], "repeated": 0, "id": 32867 }, { "timestamp": "2026-05-29 01:06:15,368", "thread_id": "4696", "caller": "0x7ff79bc69b4c", "parentcaller": "0x7ff79bc6986f", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000468" }, { "name": "ValueName", "value": "SystemUsesLightTheme" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\\SystemUsesLightTheme" } ], "repeated": 0, "id": 32868 }, { "timestamp": "2026-05-29 01:06:15,368", "thread_id": "4696", "caller": "0x7ff79bc69b4c", "parentcaller": "0x7ff79bc6986f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000468" } ], "repeated": 0, "id": 32869 }, { "timestamp": "2026-05-29 01:06:15,368", "thread_id": "4696", "caller": "0x7ff79bc69b4c", "parentcaller": "0x7ff79bc6986f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002450" } ], "repeated": 0, "id": 32870 }, { "timestamp": "2026-05-29 01:06:15,368", "thread_id": "4696", "caller": "0x7ff79bc69bb6", "parentcaller": "0x7ff79bc6986f", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 32871 }, { "timestamp": "2026-05-29 01:06:15,368", "thread_id": "4696", "caller": "0x7ff79bc69bb6", "parentcaller": "0x7ff79bc6986f", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 32872 }, { "timestamp": "2026-05-29 01:06:15,368", "thread_id": "4696", "caller": "0x7ff79bc69bb6", "parentcaller": "0x7ff79bc6986f", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00002450" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d4" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" } ], "repeated": 0, "id": 32873 }, { "timestamp": "2026-05-29 01:06:15,368", "thread_id": "4696", "caller": "0x7ff79bc69bb6", "parentcaller": "0x7ff79bc6986f", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002450" }, { "name": "ValueName", "value": "EnableTransparency" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\\EnableTransparency" } ], "repeated": 0, "id": 32874 }, { "timestamp": "2026-05-29 01:06:15,368", "thread_id": "4696", "caller": "0x7ff79bc69bb6", "parentcaller": "0x7ff79bc6986f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00002450" } ], "repeated": 0, "id": 32875 }, { "timestamp": "2026-05-29 01:06:15,368", "thread_id": "4696", "caller": "0x7ff79bc8a270", "parentcaller": "0x7ff79bc69953", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x00000010" } ], "repeated": 0, "id": 32876 }, { "timestamp": "2026-05-29 01:06:15,430", "thread_id": "4956", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff584fb0ca", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 2, "id": 32877 }, { "timestamp": "2026-05-29 01:06:15,430", "thread_id": "4956", "caller": "0x745e72036428", "parentcaller": "0x00000000", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "31" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x008\\x8e\t\\x08\\x00\\x00\\x00\\x008\\x8e\t\\x08\\x00\\x00\\x00\\x00\\xd0\\x1fp\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\xb1&\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00UB\\xff\\x7f\\x00\\x00\\xc8\\xc6\\xa9\\x0c\\x00\\x00\\x00\\x00`\\x94\t\\x08" } ], "repeated": 0, "id": 32878 } ], "threads": [ "4696", "6164", "6252", "4620", "4720", "4668", "4488", "4840", "5096", "4140", "5100", "4636", "4664", "4580", "4344", "4340", "5220", "5000", "2440", "4576", "8412", "8324", "4744", "8388", "8420", "8424", "4812", "3820", "8552", "6152", "3424", "6160", "5108", "4500", "10916", "11660", "6156", "6148", "8568", "5368", "9572", "4560", "4504", "6204", "5596", "6096", "12852", "4956", "4572", "6224", "6176", "6168", "2192", "2336", "8572", "2584", "2632", "736", "6172" ], "environ": { "UserName": "admin", "ComputerName": "DESKTOP-74SUV8W", "WindowsPath": "C:\\Windows", "TempPath": "C:\\Users\\admin\\AppData\\Local\\Temp\\", "CommandLine": "C:\\Windows\\Explorer.EXE", "RegisteredOwner": "", "RegisteredOrganization": "", "ProductName": "", "SystemVolumeSerialNumber": "b34c-3674", "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000", "MachineGUID": "", "MainExeBase": "0x7ff79bc10000", "MainExeSize": "0x00546000", "Bitness": "64-bit" }, "file_activities": { "read_files": [], "write_files": [], "delete_files": [] } }, { "process_id": 832, "process_name": "svchost.exe", "parent_id": 676, "module_path": "C:\\Windows\\System32\\svchost.exe", "first_seen": "2026-05-29 01:05:03,361", "calls": [ { "timestamp": "2026-05-29 01:05:03,924", "thread_id": "1640", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff577ce6a1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\rsaenh.dll" }, { "name": "BaseAddress", "value": "0x7fff56630000" } ], "repeated": 0, "id": 0 }, { "timestamp": "2026-05-29 01:05:04,424", "thread_id": "1064", "caller": "0x7fff577fc5f2", "parentcaller": "0x7fff577f89f3", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000015e8" }, { "name": "ThreadHandle", "value": "0x0000103c" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Windows\\system32\\DllHost.exe" }, { "name": "CommandLine", "value": "C:\\Windows\\system32\\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "140733193396668" } ], "repeated": 0, "id": 1 }, { "timestamp": "2026-05-29 01:05:04,455", "thread_id": "1064", "caller": "0x7fff577f89f3", "parentcaller": "0x7fff57fcde30", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "C:\\Windows\\system32\\DllHost.exe" }, { "name": "CommandLine", "value": "C:\\Windows\\system32\\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" }, { "name": "CreationFlags", "value": "0x00000410", "pretty_value": "CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT" }, { "name": "ProcessId", "value": "8636" }, { "name": "ThreadId", "value": "8632" }, { "name": "ProcessHandle", "value": "0x000015e8" }, { "name": "ThreadHandle", "value": "0x0000103c" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2 }, { "timestamp": "2026-05-29 01:05:06,564", "thread_id": "1652", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000015e8" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\PhysicalDrive0" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3 }, { "timestamp": "2026-05-29 01:05:09,189", "thread_id": "1064", "caller": "0x7fff555422bd", "parentcaller": "0x7fff5544ce49", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000160c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000134c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 4 }, { "timestamp": "2026-05-29 01:05:10,299", "thread_id": "1652", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff555d1c70", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000eb4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000015d4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 5 }, { "timestamp": "2026-05-29 01:05:10,299", "thread_id": "1640", "caller": "0x7fff555422bd", "parentcaller": "0x7fff5544ce49", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000161c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001620" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 6 }, { "timestamp": "2026-05-29 01:05:10,299", "thread_id": "1640", "caller": "0x7fff555422bd", "parentcaller": "0x7fff5544ce49", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000161c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001624" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 7 }, { "timestamp": "2026-05-29 01:05:10,299", "thread_id": "1640", "caller": "0x7fff55447024", "parentcaller": "0x7fff55447125", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001624" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001628" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 8 }, { "timestamp": "2026-05-29 01:05:10,299", "thread_id": "1640", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff555d1c70", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000eb4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001564" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 9 }, { "timestamp": "2026-05-29 01:05:10,299", "thread_id": "1640", "caller": "0x7fff577fc5f2", "parentcaller": "0x7fff577f89f3", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000162c" }, { "name": "ThreadHandle", "value": "0x00001624" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Windows\\SystemApps\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\\TextInputHost.exe" }, { "name": "CommandLine", "value": "\"C:\\Windows\\SystemApps\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\\TextInputHost.exe\" -ServerName:InputApp.AppXjd5de1g66v206tj52m9d0dtpppx4cgpn.mca" }, { "name": "DllPath", "value": "C:\\Windows\\SystemApps\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy;" }, { "name": "ProcessId", "value": "140733193393388" } ], "repeated": 0, "id": 10 }, { "timestamp": "2026-05-29 01:05:10,314", "thread_id": "780", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff555d1c70", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000eb4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000015cc" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 11 }, { "timestamp": "2026-05-29 01:05:10,314", "thread_id": "780", "caller": "0x7fff577fc5f2", "parentcaller": "0x7fff577f89f3", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000015c0" }, { "name": "ThreadHandle", "value": "0x000015c4" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Windows\\system32\\DllHost.exe" }, { "name": "CommandLine", "value": "C:\\Windows\\system32\\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251}" }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "140733193390832" } ], "repeated": 0, "id": 12 }, { "timestamp": "2026-05-29 01:05:10,346", "thread_id": "780", "caller": "0x7fff577f89f3", "parentcaller": "0x7fff57fcde30", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "C:\\Windows\\system32\\DllHost.exe" }, { "name": "CommandLine", "value": "C:\\Windows\\system32\\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251}" }, { "name": "CreationFlags", "value": "0x00080410", "pretty_value": "CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "2800" }, { "name": "ThreadId", "value": "5324" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x000015c0" }, { "name": "ThreadHandle", "value": "0x000015c4" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 13 }, { "timestamp": "2026-05-29 01:05:10,346", "thread_id": "780", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff555d1c70", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000eb4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000015d0" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 14 }, { "timestamp": "2026-05-29 01:05:10,346", "thread_id": "780", "caller": "0x7fff577fc5f2", "parentcaller": "0x7fff577f89f3", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000015b8" }, { "name": "ThreadHandle", "value": "0x000015c4" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Windows\\system32\\DllHost.exe" }, { "name": "CommandLine", "value": "C:\\Windows\\system32\\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251}" }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "140733193390528" } ], "repeated": 0, "id": 15 }, { "timestamp": "2026-05-29 01:05:10,392", "thread_id": "780", "caller": "0x7fff577f89f3", "parentcaller": "0x7fff57fcde30", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "C:\\Windows\\system32\\DllHost.exe" }, { "name": "CommandLine", "value": "C:\\Windows\\system32\\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251}" }, { "name": "CreationFlags", "value": "0x00080410", "pretty_value": "CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "2496" }, { "name": "ThreadId", "value": "3712" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x000015b8" }, { "name": "ThreadHandle", "value": "0x000015c4" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 16 }, { "timestamp": "2026-05-29 01:05:10,408", "thread_id": "780", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff555d1c70", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000eb4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000015ac" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 17 }, { "timestamp": "2026-05-29 01:05:10,408", "thread_id": "780", "caller": "0x7fff577fc5f2", "parentcaller": "0x7fff577f89f3", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000015a0" }, { "name": "ThreadHandle", "value": "0x000015a4" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Windows\\system32\\DllHost.exe" }, { "name": "CommandLine", "value": "C:\\Windows\\system32\\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251}" }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "140733193388844" } ], "repeated": 0, "id": 18 }, { "timestamp": "2026-05-29 01:05:10,471", "thread_id": "780", "caller": "0x7fff577f89f3", "parentcaller": "0x7fff57fcde30", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "C:\\Windows\\system32\\DllHost.exe" }, { "name": "CommandLine", "value": "C:\\Windows\\system32\\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251}" }, { "name": "CreationFlags", "value": "0x00080410", "pretty_value": "CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "812" }, { "name": "ThreadId", "value": "444" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x000015a0" }, { "name": "ThreadHandle", "value": "0x000015a4" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 19 }, { "timestamp": "2026-05-29 01:05:10,471", "thread_id": "780", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff555d1c70", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000eb4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000015c0" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 20 }, { "timestamp": "2026-05-29 01:05:10,471", "thread_id": "780", "caller": "0x7fff577fc5f2", "parentcaller": "0x7fff577f89f3", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000163c" }, { "name": "ThreadHandle", "value": "0x00001638" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Windows\\system32\\DllHost.exe" }, { "name": "CommandLine", "value": "C:\\Windows\\system32\\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251}" }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "140733193392420" } ], "repeated": 0, "id": 21 }, { "timestamp": "2026-05-29 01:05:10,502", "thread_id": "780", "caller": "0x7fff577f89f3", "parentcaller": "0x7fff57fcde30", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "C:\\Windows\\system32\\DllHost.exe" }, { "name": "CommandLine", "value": "C:\\Windows\\system32\\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251}" }, { "name": "CreationFlags", "value": "0x00080410", "pretty_value": "CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "4388" }, { "name": "ThreadId", "value": "5584" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x0000163c" }, { "name": "ThreadHandle", "value": "0x00001638" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 22 }, { "timestamp": "2026-05-29 01:05:10,502", "thread_id": "780", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff555d1c70", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000eb4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001590" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 23 }, { "timestamp": "2026-05-29 01:05:10,502", "thread_id": "780", "caller": "0x7fff577fc5f2", "parentcaller": "0x7fff577f89f3", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001584" }, { "name": "ThreadHandle", "value": "0x00001588" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Windows\\system32\\DllHost.exe" }, { "name": "CommandLine", "value": "C:\\Windows\\system32\\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251}" }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "140733193396308" } ], "repeated": 0, "id": 24 }, { "timestamp": "2026-05-29 01:05:10,533", "thread_id": "780", "caller": "0x7fff577f89f3", "parentcaller": "0x7fff57fcde30", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "C:\\Windows\\system32\\DllHost.exe" }, { "name": "CommandLine", "value": "C:\\Windows\\system32\\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251}" }, { "name": "CreationFlags", "value": "0x00080410", "pretty_value": "CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "8276" }, { "name": "ThreadId", "value": "8280" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x00001584" }, { "name": "ThreadHandle", "value": "0x00001588" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 25 }, { "timestamp": "2026-05-29 01:05:10,533", "thread_id": "780", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff555d1c70", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000eb4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000fc0" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 26 }, { "timestamp": "2026-05-29 01:05:10,533", "thread_id": "780", "caller": "0x7fff577fc5f2", "parentcaller": "0x7fff577f89f3", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001044" }, { "name": "ThreadHandle", "value": "0x000014a8" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Windows\\system32\\DllHost.exe" }, { "name": "CommandLine", "value": "C:\\Windows\\system32\\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251}" }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "140733193391316" } ], "repeated": 0, "id": 27 }, { "timestamp": "2026-05-29 01:05:10,564", "thread_id": "780", "caller": "0x7fff577f89f3", "parentcaller": "0x7fff57fcde30", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "C:\\Windows\\system32\\DllHost.exe" }, { "name": "CommandLine", "value": "C:\\Windows\\system32\\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251}" }, { "name": "CreationFlags", "value": "0x00080410", "pretty_value": "CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "3284" }, { "name": "ThreadId", "value": "3368" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x00001044" }, { "name": "ThreadHandle", "value": "0x000014a8" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 28 }, { "timestamp": "2026-05-29 01:05:11,049", "thread_id": "1640", "caller": "0x7fff577f89f3", "parentcaller": "0x7fff57fcde30", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "C:\\Windows\\SystemApps\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\\TextInputHost.exe" }, { "name": "CommandLine", "value": "\"C:\\Windows\\SystemApps\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\\TextInputHost.exe\" -ServerName:InputApp.AppXjd5de1g66v206tj52m9d0dtpppx4cgpn.mca" }, { "name": "CreationFlags", "value": "0x00080414", "pretty_value": "CREATE_SUSPENDED|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "5356" }, { "name": "ThreadId", "value": "5376" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x0000162c" }, { "name": "ThreadHandle", "value": "0x00001624" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 29 }, { "timestamp": "2026-05-29 01:05:11,142", "thread_id": "1640", "caller": "0x7fff555f3391", "parentcaller": "0x7fff555b1704", "category": "threading", "api": "NtResumeThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00001624" }, { "name": "SuspendCount", "value": "1" }, { "name": "ThreadId", "value": "5376" }, { "name": "ProcessId", "value": "5356" } ], "repeated": 0, "id": 30 }, { "timestamp": "2026-05-29 01:05:11,752", "thread_id": "1640", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 31 }, { "timestamp": "2026-05-29 01:05:11,767", "thread_id": "1064", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff584c6d2f", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000014a8" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 32 }, { "timestamp": "2026-05-29 01:05:11,767", "thread_id": "1064", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000015d8" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 33 }, { "timestamp": "2026-05-29 01:05:11,767", "thread_id": "1064", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000162c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 34 }, { "timestamp": "2026-05-29 01:05:11,767", "thread_id": "1064", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 35 }, { "timestamp": "2026-05-29 01:05:11,767", "thread_id": "1064", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x256f2750000" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\\S-1-5-18.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 36 }, { "timestamp": "2026-05-29 01:05:11,767", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001040" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 37 }, { "timestamp": "2026-05-29 01:05:11,767", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000015b0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 38 }, { "timestamp": "2026-05-29 01:05:11,767", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 39 }, { "timestamp": "2026-05-29 01:05:11,767", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000015d8" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 40 }, { "timestamp": "2026-05-29 01:05:11,767", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000162c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 41 }, { "timestamp": "2026-05-29 01:05:11,767", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 42 }, { "timestamp": "2026-05-29 01:05:11,767", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000015d8" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 43 }, { "timestamp": "2026-05-29 01:05:11,767", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000162c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 44 }, { "timestamp": "2026-05-29 01:05:11,767", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 45 }, { "timestamp": "2026-05-29 01:05:11,767", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000162c" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 46 }, { "timestamp": "2026-05-29 01:05:11,767", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000164c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 47 }, { "timestamp": "2026-05-29 01:05:11,767", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 48 }, { "timestamp": "2026-05-29 01:05:11,767", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000164c" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 49 }, { "timestamp": "2026-05-29 01:05:11,767", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000162c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 50 }, { "timestamp": "2026-05-29 01:05:11,767", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 51 }, { "timestamp": "2026-05-29 01:05:11,767", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000162c" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 52 }, { "timestamp": "2026-05-29 01:05:11,767", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000164c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 53 }, { "timestamp": "2026-05-29 01:05:11,767", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 54 }, { "timestamp": "2026-05-29 01:05:11,767", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001614" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 55 }, { "timestamp": "2026-05-29 01:05:11,767", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001564" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 56 }, { "timestamp": "2026-05-29 01:05:11,767", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 57 }, { "timestamp": "2026-05-29 01:05:11,767", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001620" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 58 }, { "timestamp": "2026-05-29 01:05:11,767", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000015d8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 59 }, { "timestamp": "2026-05-29 01:05:11,767", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 60 }, { "timestamp": "2026-05-29 01:05:11,767", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001564" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 61 }, { "timestamp": "2026-05-29 01:05:11,767", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000015d8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 62 }, { "timestamp": "2026-05-29 01:05:11,767", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 63 }, { "timestamp": "2026-05-29 01:05:11,767", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000015d8" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 64 }, { "timestamp": "2026-05-29 01:05:11,783", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000fb0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 65 }, { "timestamp": "2026-05-29 01:05:11,783", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 66 }, { "timestamp": "2026-05-29 01:05:11,783", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000fb0" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 67 }, { "timestamp": "2026-05-29 01:05:11,783", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000fb4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 68 }, { "timestamp": "2026-05-29 01:05:11,783", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 69 }, { "timestamp": "2026-05-29 01:05:11,783", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000fb4" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 70 }, { "timestamp": "2026-05-29 01:05:11,783", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000fb0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 71 }, { "timestamp": "2026-05-29 01:05:11,783", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 72 }, { "timestamp": "2026-05-29 01:05:11,783", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000fb0" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 73 }, { "timestamp": "2026-05-29 01:05:11,783", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000fb4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 74 }, { "timestamp": "2026-05-29 01:05:11,783", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 75 }, { "timestamp": "2026-05-29 01:05:11,783", "thread_id": "6188", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001620" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 76 }, { "timestamp": "2026-05-29 01:05:11,783", "thread_id": "6188", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000015a0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 77 }, { "timestamp": "2026-05-29 01:05:11,783", "thread_id": "6188", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 78 }, { "timestamp": "2026-05-29 01:05:11,783", "thread_id": "6188", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000015a0" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 79 }, { "timestamp": "2026-05-29 01:05:11,783", "thread_id": "6188", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001620" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 80 }, { "timestamp": "2026-05-29 01:05:11,783", "thread_id": "6188", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 81 }, { "timestamp": "2026-05-29 01:05:11,799", "thread_id": "936", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001564" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 82 }, { "timestamp": "2026-05-29 01:05:11,799", "thread_id": "936", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000015b0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00003000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 83 }, { "timestamp": "2026-05-29 01:05:11,799", "thread_id": "936", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 84 }, { "timestamp": "2026-05-29 01:05:11,799", "thread_id": "936", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000015b0" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 85 }, { "timestamp": "2026-05-29 01:05:11,799", "thread_id": "936", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001564" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00003000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 86 }, { "timestamp": "2026-05-29 01:05:11,799", "thread_id": "936", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 87 }, { "timestamp": "2026-05-29 01:05:11,799", "thread_id": "936", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000015b0" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 88 }, { "timestamp": "2026-05-29 01:05:11,799", "thread_id": "936", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001040" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00003000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 89 }, { "timestamp": "2026-05-29 01:05:11,799", "thread_id": "936", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 90 }, { "timestamp": "2026-05-29 01:05:11,799", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001614" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 91 }, { "timestamp": "2026-05-29 01:05:11,799", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001038" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00003000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 92 }, { "timestamp": "2026-05-29 01:05:11,799", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 93 }, { "timestamp": "2026-05-29 01:05:11,799", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000015b0" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 94 }, { "timestamp": "2026-05-29 01:05:11,799", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001040" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00003000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 95 }, { "timestamp": "2026-05-29 01:05:11,799", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 96 }, { "timestamp": "2026-05-29 01:05:11,799", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000fc4" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 97 }, { "timestamp": "2026-05-29 01:05:11,799", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000014f4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00003000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 98 }, { "timestamp": "2026-05-29 01:05:11,799", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 99 }, { "timestamp": "2026-05-29 01:05:11,799", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000014f4" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 100 }, { "timestamp": "2026-05-29 01:05:11,799", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000fc4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00003000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 101 }, { "timestamp": "2026-05-29 01:05:11,799", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 102 }, { "timestamp": "2026-05-29 01:05:11,799", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000fc4" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 103 }, { "timestamp": "2026-05-29 01:05:11,799", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000014f4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00003000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 104 }, { "timestamp": "2026-05-29 01:05:11,799", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 105 }, { "timestamp": "2026-05-29 01:05:11,799", "thread_id": "936", "caller": "0x7fff555422bd", "parentcaller": "0x7fff5544ce49", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000015a0" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001618" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 106 }, { "timestamp": "2026-05-29 01:05:11,799", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001564" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 107 }, { "timestamp": "2026-05-29 01:05:11,799", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000015ac" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00003000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 108 }, { "timestamp": "2026-05-29 01:05:11,799", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 109 }, { "timestamp": "2026-05-29 01:05:11,799", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000015b0" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 110 }, { "timestamp": "2026-05-29 01:05:11,799", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000015fc" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00003000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 111 }, { "timestamp": "2026-05-29 01:05:11,799", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 112 }, { "timestamp": "2026-05-29 01:05:11,799", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001038" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 113 }, { "timestamp": "2026-05-29 01:05:11,799", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000015fc" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00003000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 114 }, { "timestamp": "2026-05-29 01:05:11,799", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 115 }, { "timestamp": "2026-05-29 01:05:11,799", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000015fc" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 116 }, { "timestamp": "2026-05-29 01:05:11,799", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001038" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00003000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 117 }, { "timestamp": "2026-05-29 01:05:11,799", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 118 }, { "timestamp": "2026-05-29 01:05:11,799", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001038" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 119 }, { "timestamp": "2026-05-29 01:05:11,799", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000015fc" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00003000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 120 }, { "timestamp": "2026-05-29 01:05:11,799", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 121 }, { "timestamp": "2026-05-29 01:05:11,799", "thread_id": "928", "caller": "0x7fff555422bd", "parentcaller": "0x7fff5544ce49", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001614" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001628" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 122 }, { "timestamp": "2026-05-29 01:05:11,799", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000015ac" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 123 }, { "timestamp": "2026-05-29 01:05:11,799", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000015d8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00003000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 124 }, { "timestamp": "2026-05-29 01:05:11,799", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 125 }, { "timestamp": "2026-05-29 01:05:11,799", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000015f8" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 126 }, { "timestamp": "2026-05-29 01:05:11,799", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001034" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00003000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 127 }, { "timestamp": "2026-05-29 01:05:11,799", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 128 }, { "timestamp": "2026-05-29 01:05:11,799", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000015f4" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 129 }, { "timestamp": "2026-05-29 01:05:11,799", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001034" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00003000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 130 }, { "timestamp": "2026-05-29 01:05:11,799", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 131 }, { "timestamp": "2026-05-29 01:05:11,799", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001034" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 132 }, { "timestamp": "2026-05-29 01:05:11,799", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000015f4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00003000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 133 }, { "timestamp": "2026-05-29 01:05:11,799", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 134 }, { "timestamp": "2026-05-29 01:05:11,814", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001650" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 135 }, { "timestamp": "2026-05-29 01:05:11,814", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000164c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00003000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 136 }, { "timestamp": "2026-05-29 01:05:11,814", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 137 }, { "timestamp": "2026-05-29 01:05:11,814", "thread_id": "936", "caller": "0x7fff555422bd", "parentcaller": "0x7fff5544ce49", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001654" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001658" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 138 }, { "timestamp": "2026-05-29 01:05:11,814", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001034" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 139 }, { "timestamp": "2026-05-29 01:05:11,814", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000015f4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00003000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 140 }, { "timestamp": "2026-05-29 01:05:11,814", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 141 }, { "timestamp": "2026-05-29 01:05:11,814", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000161c" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 142 }, { "timestamp": "2026-05-29 01:05:11,814", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001564" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00003000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 143 }, { "timestamp": "2026-05-29 01:05:11,814", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 144 }, { "timestamp": "2026-05-29 01:05:11,814", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000015d4" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 145 }, { "timestamp": "2026-05-29 01:05:11,814", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000161c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00003000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 146 }, { "timestamp": "2026-05-29 01:05:11,814", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 147 }, { "timestamp": "2026-05-29 01:05:11,814", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000161c" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 148 }, { "timestamp": "2026-05-29 01:05:11,814", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000015d4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00003000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 149 }, { "timestamp": "2026-05-29 01:05:11,814", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 150 }, { "timestamp": "2026-05-29 01:05:11,814", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000015d4" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 151 }, { "timestamp": "2026-05-29 01:05:11,814", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000161c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00003000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 152 }, { "timestamp": "2026-05-29 01:05:11,814", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 153 }, { "timestamp": "2026-05-29 01:05:11,814", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000161c" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 154 }, { "timestamp": "2026-05-29 01:05:11,814", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000015d4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00003000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 155 }, { "timestamp": "2026-05-29 01:05:11,814", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 156 }, { "timestamp": "2026-05-29 01:05:11,814", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001598" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 157 }, { "timestamp": "2026-05-29 01:05:11,814", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000015a8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00003000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 158 }, { "timestamp": "2026-05-29 01:05:11,814", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 159 }, { "timestamp": "2026-05-29 01:05:11,814", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000159c" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 160 }, { "timestamp": "2026-05-29 01:05:11,814", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000015a4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00003000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 161 }, { "timestamp": "2026-05-29 01:05:11,814", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 162 }, { "timestamp": "2026-05-29 01:05:11,814", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001668" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 163 }, { "timestamp": "2026-05-29 01:05:11,814", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000159c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00003000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 164 }, { "timestamp": "2026-05-29 01:05:11,814", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 165 }, { "timestamp": "2026-05-29 01:05:11,814", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000159c" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 166 }, { "timestamp": "2026-05-29 01:05:11,814", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001668" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00003000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 167 }, { "timestamp": "2026-05-29 01:05:11,814", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 168 }, { "timestamp": "2026-05-29 01:05:11,814", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001668" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 169 }, { "timestamp": "2026-05-29 01:05:11,814", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000159c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00003000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 170 }, { "timestamp": "2026-05-29 01:05:11,814", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 171 }, { "timestamp": "2026-05-29 01:05:11,814", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000159c" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 172 }, { "timestamp": "2026-05-29 01:05:11,814", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001668" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00003000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 173 }, { "timestamp": "2026-05-29 01:05:11,814", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 174 }, { "timestamp": "2026-05-29 01:05:11,814", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000015a4" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 175 }, { "timestamp": "2026-05-29 01:05:11,814", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000159c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00003000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 176 }, { "timestamp": "2026-05-29 01:05:11,814", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 177 }, { "timestamp": "2026-05-29 01:05:11,814", "thread_id": "936", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff555d1c70", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000eb4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000159c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 178 }, { "timestamp": "2026-05-29 01:05:11,814", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001574" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 179 }, { "timestamp": "2026-05-29 01:05:11,814", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000fac" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00003000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 180 }, { "timestamp": "2026-05-29 01:05:11,814", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 181 }, { "timestamp": "2026-05-29 01:05:11,814", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001568" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 182 }, { "timestamp": "2026-05-29 01:05:11,814", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001574" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00003000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 183 }, { "timestamp": "2026-05-29 01:05:11,814", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 184 }, { "timestamp": "2026-05-29 01:05:11,814", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001574" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 185 }, { "timestamp": "2026-05-29 01:05:11,814", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001568" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f37a0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00003000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 186 }, { "timestamp": "2026-05-29 01:05:11,814", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f37a0000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 187 }, { "timestamp": "2026-05-29 01:05:11,814", "thread_id": "928", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff555d1c70", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000eb4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000157c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 188 }, { "timestamp": "2026-05-29 01:05:11,814", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001630" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 189 }, { "timestamp": "2026-05-29 01:05:11,814", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001584" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f37a0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00003000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 190 }, { "timestamp": "2026-05-29 01:05:11,814", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f37a0000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 191 }, { "timestamp": "2026-05-29 01:05:11,814", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001584" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 192 }, { "timestamp": "2026-05-29 01:05:11,814", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001630" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f37a0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00003000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 193 }, { "timestamp": "2026-05-29 01:05:11,814", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f37a0000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 194 }, { "timestamp": "2026-05-29 01:05:11,814", "thread_id": "936", "caller": "0x7fff577fc5f2", "parentcaller": "0x7fff577f89f3", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001574" }, { "name": "ThreadHandle", "value": "0x00001568" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Windows\\system32\\backgroundTaskHost.exe" }, { "name": "CommandLine", "value": "\"C:\\Windows\\system32\\backgroundTaskHost.exe\" -ServerName:Global.Accounts.AppXqe94epy97qwa6w3j6w132e8zvcs117nd.mca" }, { "name": "DllPath", "value": "C:\\Windows\\SystemApps\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy;" }, { "name": "ProcessId", "value": "140733193395380" } ], "repeated": 0, "id": 195 }, { "timestamp": "2026-05-29 01:05:11,814", "thread_id": "3420", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5978ef53", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000015b8" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 196 }, { "timestamp": "2026-05-29 01:05:11,814", "thread_id": "3420", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff584c6d2f", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000015c0" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 197 }, { "timestamp": "2026-05-29 01:05:11,814", "thread_id": "928", "caller": "0x7fff577fc5f2", "parentcaller": "0x7fff577f89f3", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001664" }, { "name": "ThreadHandle", "value": "0x00001660" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Windows\\system32\\backgroundTaskHost.exe" }, { "name": "CommandLine", "value": "\"C:\\Windows\\system32\\backgroundTaskHost.exe\" -ServerName:Global.IrisService.AppXwt29n3t7x7q6fgyrrbbqxwzkqjfjaw4y.mca" }, { "name": "DllPath", "value": "C:\\Windows\\SystemApps\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy;" }, { "name": "ProcessId", "value": "140733193389236" } ], "repeated": 0, "id": 198 }, { "timestamp": "2026-05-29 01:05:11,814", "thread_id": "464", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff555d1c70", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000eb4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000015d8" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 199 }, { "timestamp": "2026-05-29 01:05:11,830", "thread_id": "464", "caller": "0x7fff577fc5f2", "parentcaller": "0x7fff577f89f3", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001634" }, { "name": "ThreadHandle", "value": "0x00001610" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Windows\\system32\\backgroundTaskHost.exe" }, { "name": "CommandLine", "value": "\"C:\\Windows\\system32\\backgroundTaskHost.exe\" -ServerName:Global.RulesEngine.AppXgphnekvm0vv49drvfehh4b6kyf6ckafp.mca" }, { "name": "DllPath", "value": "C:\\Windows\\SystemApps\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy;" }, { "name": "ProcessId", "value": "140733193391312" } ], "repeated": 0, "id": 200 }, { "timestamp": "2026-05-29 01:05:11,846", "thread_id": "928", "caller": "0x7fff577f89f3", "parentcaller": "0x7fff57fcde30", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "C:\\Windows\\system32\\backgroundTaskHost.exe" }, { "name": "CommandLine", "value": "\"C:\\Windows\\system32\\backgroundTaskHost.exe\" -ServerName:Global.IrisService.AppXwt29n3t7x7q6fgyrrbbqxwzkqjfjaw4y.mca" }, { "name": "CreationFlags", "value": "0x00080414", "pretty_value": "CREATE_SUSPENDED|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "1204" }, { "name": "ThreadId", "value": "1132" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x00001664" }, { "name": "ThreadHandle", "value": "0x00001660" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 201 }, { "timestamp": "2026-05-29 01:05:11,846", "thread_id": "936", "caller": "0x7fff577f89f3", "parentcaller": "0x7fff57fcde30", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "C:\\Windows\\system32\\backgroundTaskHost.exe" }, { "name": "CommandLine", "value": "\"C:\\Windows\\system32\\backgroundTaskHost.exe\" -ServerName:Global.Accounts.AppXqe94epy97qwa6w3j6w132e8zvcs117nd.mca" }, { "name": "CreationFlags", "value": "0x00080414", "pretty_value": "CREATE_SUSPENDED|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "7348" }, { "name": "ThreadId", "value": "8596" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x00001574" }, { "name": "ThreadHandle", "value": "0x00001568" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 202 }, { "timestamp": "2026-05-29 01:05:11,846", "thread_id": "464", "caller": "0x7fff577f89f3", "parentcaller": "0x7fff57fcde30", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "C:\\Windows\\system32\\backgroundTaskHost.exe" }, { "name": "CommandLine", "value": "\"C:\\Windows\\system32\\backgroundTaskHost.exe\" -ServerName:Global.RulesEngine.AppXgphnekvm0vv49drvfehh4b6kyf6ckafp.mca" }, { "name": "CreationFlags", "value": "0x00080414", "pretty_value": "CREATE_SUSPENDED|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "3280" }, { "name": "ThreadId", "value": "8652" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x00001634" }, { "name": "ThreadHandle", "value": "0x00001610" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 203 }, { "timestamp": "2026-05-29 01:05:11,861", "thread_id": "928", "caller": "0x7fff555f3391", "parentcaller": "0x7fff555b1704", "category": "threading", "api": "NtResumeThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00001660" }, { "name": "SuspendCount", "value": "1" }, { "name": "ThreadId", "value": "1132" }, { "name": "ProcessId", "value": "1204" } ], "repeated": 0, "id": 204 }, { "timestamp": "2026-05-29 01:05:11,861", "thread_id": "464", "caller": "0x7fff555f3391", "parentcaller": "0x7fff555b1704", "category": "threading", "api": "NtResumeThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00001610" }, { "name": "SuspendCount", "value": "1" }, { "name": "ThreadId", "value": "8652" }, { "name": "ProcessId", "value": "3280" } ], "repeated": 0, "id": 205 }, { "timestamp": "2026-05-29 01:05:11,861", "thread_id": "936", "caller": "0x7fff555f3391", "parentcaller": "0x7fff555b1704", "category": "threading", "api": "NtResumeThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00001568" }, { "name": "SuspendCount", "value": "1" }, { "name": "ThreadId", "value": "8596" }, { "name": "ProcessId", "value": "7348" } ], "repeated": 0, "id": 206 }, { "timestamp": "2026-05-29 01:05:11,861", "thread_id": "6184", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 207 }, { "timestamp": "2026-05-29 01:05:11,861", "thread_id": "6184", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001588" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 208 }, { "timestamp": "2026-05-29 01:05:11,861", "thread_id": "6184", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001634" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00003000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 209 }, { "timestamp": "2026-05-29 01:05:11,861", "thread_id": "6184", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 210 }, { "timestamp": "2026-05-29 01:05:11,861", "thread_id": "3420", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 211 }, { "timestamp": "2026-05-29 01:05:11,861", "thread_id": "3420", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001688" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 212 }, { "timestamp": "2026-05-29 01:05:11,861", "thread_id": "3420", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000015fc" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00003000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 213 }, { "timestamp": "2026-05-29 01:05:11,861", "thread_id": "3420", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 214 }, { "timestamp": "2026-05-29 01:05:11,861", "thread_id": "6188", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 215 }, { "timestamp": "2026-05-29 01:05:11,861", "thread_id": "6188", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001650" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 216 }, { "timestamp": "2026-05-29 01:05:11,861", "thread_id": "6188", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001658" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00003000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 217 }, { "timestamp": "2026-05-29 01:05:11,861", "thread_id": "6188", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 218 }, { "timestamp": "2026-05-29 01:05:12,158", "thread_id": "1652", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff584c6d2f", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001584" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 219 }, { "timestamp": "2026-05-29 01:05:12,158", "thread_id": "1652", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001624" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 220 }, { "timestamp": "2026-05-29 01:05:12,158", "thread_id": "1652", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001654" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 221 }, { "timestamp": "2026-05-29 01:05:12,158", "thread_id": "1652", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 222 }, { "timestamp": "2026-05-29 01:05:13,783", "thread_id": "928", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff577ce6a1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\rsaenh.dll" }, { "name": "BaseAddress", "value": "0x7fff56630000" } ], "repeated": 0, "id": 223 }, { "timestamp": "2026-05-29 01:05:14,799", "thread_id": "1652", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff555d1c70", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000eb4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000fb4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 224 }, { "timestamp": "2026-05-29 01:05:14,799", "thread_id": "1652", "caller": "0x7fff577fc5f2", "parentcaller": "0x7fff577f89f3", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000161c" }, { "name": "ThreadHandle", "value": "0x000014f4" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Windows\\system32\\DllHost.exe" }, { "name": "CommandLine", "value": "C:\\Windows\\system32\\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251}" }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "140733193398404" } ], "repeated": 0, "id": 225 }, { "timestamp": "2026-05-29 01:05:14,877", "thread_id": "1652", "caller": "0x7fff577f89f3", "parentcaller": "0x7fff57fcde30", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "C:\\Windows\\system32\\DllHost.exe" }, { "name": "CommandLine", "value": "C:\\Windows\\system32\\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251}" }, { "name": "CreationFlags", "value": "0x00080410", "pretty_value": "CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "10372" }, { "name": "ThreadId", "value": "10376" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x0000161c" }, { "name": "ThreadHandle", "value": "0x000014f4" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 226 }, { "timestamp": "2026-05-29 01:05:14,892", "thread_id": "1652", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff555d1c70", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000eb4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000d08" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 227 }, { "timestamp": "2026-05-29 01:05:14,892", "thread_id": "1652", "caller": "0x7fff577fc5f2", "parentcaller": "0x7fff577f89f3", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001654" }, { "name": "ThreadHandle", "value": "0x0000162c" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Windows\\system32\\DllHost.exe" }, { "name": "CommandLine", "value": "C:\\Windows\\system32\\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251}" }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "140733193398520" } ], "repeated": 0, "id": 228 }, { "timestamp": "2026-05-29 01:05:14,924", "thread_id": "1652", "caller": "0x7fff577f89f3", "parentcaller": "0x7fff57fcde30", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "C:\\Windows\\system32\\DllHost.exe" }, { "name": "CommandLine", "value": "C:\\Windows\\system32\\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251}" }, { "name": "CreationFlags", "value": "0x00080410", "pretty_value": "CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "10488" }, { "name": "ThreadId", "value": "10492" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x00001654" }, { "name": "ThreadHandle", "value": "0x0000162c" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 229 }, { "timestamp": "2026-05-29 01:05:14,924", "thread_id": "1652", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff555d1c70", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000eb4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000d08" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 230 }, { "timestamp": "2026-05-29 01:05:14,924", "thread_id": "1652", "caller": "0x7fff577fc5f2", "parentcaller": "0x7fff577f89f3", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001610" }, { "name": "ThreadHandle", "value": "0x00001688" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Windows\\system32\\DllHost.exe" }, { "name": "CommandLine", "value": "C:\\Windows\\system32\\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251}" }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "140733193398604" } ], "repeated": 0, "id": 231 }, { "timestamp": "2026-05-29 01:05:14,955", "thread_id": "1652", "caller": "0x7fff577f89f3", "parentcaller": "0x7fff57fcde30", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "C:\\Windows\\system32\\DllHost.exe" }, { "name": "CommandLine", "value": "C:\\Windows\\system32\\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251}" }, { "name": "CreationFlags", "value": "0x00080410", "pretty_value": "CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "10572" }, { "name": "ThreadId", "value": "10576" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x00001610" }, { "name": "ThreadHandle", "value": "0x00001688" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 232 }, { "timestamp": "2026-05-29 01:05:14,955", "thread_id": "1652", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff555d1c70", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000eb4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000015e4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 233 }, { "timestamp": "2026-05-29 01:05:14,955", "thread_id": "1652", "caller": "0x7fff577fc5f2", "parentcaller": "0x7fff577f89f3", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001698" }, { "name": "ThreadHandle", "value": "0x00001694" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Windows\\system32\\DllHost.exe" }, { "name": "CommandLine", "value": "C:\\Windows\\system32\\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251}" }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "140733193398688" } ], "repeated": 0, "id": 234 }, { "timestamp": "2026-05-29 01:05:15,064", "thread_id": "1652", "caller": "0x7fff577f89f3", "parentcaller": "0x7fff57fcde30", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "C:\\Windows\\system32\\DllHost.exe" }, { "name": "CommandLine", "value": "C:\\Windows\\system32\\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251}" }, { "name": "CreationFlags", "value": "0x00080410", "pretty_value": "CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "10656" }, { "name": "ThreadId", "value": "10660" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x00001698" }, { "name": "ThreadHandle", "value": "0x00001694" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 235 }, { "timestamp": "2026-05-29 01:05:15,658", "thread_id": "928", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff555d1c70", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000eb4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000167c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 236 }, { "timestamp": "2026-05-29 01:05:15,658", "thread_id": "928", "caller": "0x7fff577fc5f2", "parentcaller": "0x7fff577f89f3", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000016b0" }, { "name": "ThreadHandle", "value": "0x000016ac" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Windows\\system32\\DllHost.exe" }, { "name": "CommandLine", "value": "C:\\Windows\\system32\\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251}" }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "140733193398884" } ], "repeated": 0, "id": 237 }, { "timestamp": "2026-05-29 01:05:15,689", "thread_id": "928", "caller": "0x7fff577f89f3", "parentcaller": "0x7fff57fcde30", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "C:\\Windows\\system32\\DllHost.exe" }, { "name": "CommandLine", "value": "C:\\Windows\\system32\\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251}" }, { "name": "CreationFlags", "value": "0x00080410", "pretty_value": "CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "10852" }, { "name": "ThreadId", "value": "10856" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x000016b0" }, { "name": "ThreadHandle", "value": "0x000016ac" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 238 }, { "timestamp": "2026-05-29 01:05:15,705", "thread_id": "928", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff555d1c70", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000eb4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000016c0" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 239 }, { "timestamp": "2026-05-29 01:05:15,705", "thread_id": "928", "caller": "0x7fff577fc5f2", "parentcaller": "0x7fff577f89f3", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000016cc" }, { "name": "ThreadHandle", "value": "0x000016c8" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Windows\\system32\\DllHost.exe" }, { "name": "CommandLine", "value": "C:\\Windows\\system32\\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251}" }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "140733193398976" } ], "repeated": 0, "id": 240 }, { "timestamp": "2026-05-29 01:05:15,721", "thread_id": "928", "caller": "0x7fff577f89f3", "parentcaller": "0x7fff57fcde30", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "C:\\Windows\\system32\\DllHost.exe" }, { "name": "CommandLine", "value": "C:\\Windows\\system32\\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251}" }, { "name": "CreationFlags", "value": "0x00080410", "pretty_value": "CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "10944" }, { "name": "ThreadId", "value": "10948" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x000016cc" }, { "name": "ThreadHandle", "value": "0x000016c8" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 241 }, { "timestamp": "2026-05-29 01:05:16,549", "thread_id": "464", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001690" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\PhysicalDrive0" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 242 }, { "timestamp": "2026-05-29 01:05:16,596", "thread_id": "464", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff555d1c70", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000eb4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001628" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 243 }, { "timestamp": "2026-05-29 01:05:16,596", "thread_id": "464", "caller": "0x7fff577fc5f2", "parentcaller": "0x7fff577f89f3", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000016dc" }, { "name": "ThreadHandle", "value": "0x000016d8" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Windows\\system32\\DllHost.exe" }, { "name": "CommandLine", "value": "C:\\Windows\\system32\\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251}" }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "140733193399108" } ], "repeated": 0, "id": 244 }, { "timestamp": "2026-05-29 01:05:16,627", "thread_id": "464", "caller": "0x7fff577f89f3", "parentcaller": "0x7fff57fcde30", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "C:\\Windows\\system32\\DllHost.exe" }, { "name": "CommandLine", "value": "C:\\Windows\\system32\\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251}" }, { "name": "CreationFlags", "value": "0x00080410", "pretty_value": "CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "11076" }, { "name": "ThreadId", "value": "11080" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x000016dc" }, { "name": "ThreadHandle", "value": "0x000016d8" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 245 }, { "timestamp": "2026-05-29 01:05:16,627", "thread_id": "464", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff555d1c70", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000eb4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000015fc" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 246 }, { "timestamp": "2026-05-29 01:05:16,627", "thread_id": "464", "caller": "0x7fff577fc5f2", "parentcaller": "0x7fff577f89f3", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000016e4" }, { "name": "ThreadHandle", "value": "0x000016d8" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Windows\\system32\\DllHost.exe" }, { "name": "CommandLine", "value": "C:\\Windows\\system32\\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251}" }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "140733193399204" } ], "repeated": 0, "id": 247 }, { "timestamp": "2026-05-29 01:05:16,658", "thread_id": "464", "caller": "0x7fff577f89f3", "parentcaller": "0x7fff57fcde30", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "C:\\Windows\\system32\\DllHost.exe" }, { "name": "CommandLine", "value": "C:\\Windows\\system32\\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251}" }, { "name": "CreationFlags", "value": "0x00080410", "pretty_value": "CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "11172" }, { "name": "ThreadId", "value": "11176" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x000016e4" }, { "name": "ThreadHandle", "value": "0x000016d8" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 248 }, { "timestamp": "2026-05-29 01:05:17,299", "thread_id": "1652", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff577ce6a1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\rsaenh.dll" }, { "name": "BaseAddress", "value": "0x7fff56630000" } ], "repeated": 1, "id": 249 }, { "timestamp": "2026-05-29 01:05:17,689", "thread_id": "936", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff59939f03", "category": "services", "api": "StartServiceW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ServiceHandle", "value": "0x256f38bcb40" }, { "name": "ServiceName", "value": "MicrosoftEdgeElevationService" }, { "name": "Arguments", "value": [] } ], "repeated": 0, "id": 250 }, { "timestamp": "2026-05-29 01:05:18,752", "thread_id": "464", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff577ce6a1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\rsaenh.dll" }, { "name": "BaseAddress", "value": "0x7fff56630000" } ], "repeated": 0, "id": 251 }, { "timestamp": "2026-05-29 01:05:19,252", "thread_id": "1652", "caller": "0x7fff55537f97", "parentcaller": "0x7fff5553b4bb", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001618" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001628" }, { "name": "Options", "value": "0x00000000" } ], "repeated": 0, "id": 252 }, { "timestamp": "2026-05-29 01:05:19,252", "thread_id": "1652", "caller": "0x7fff55532c08", "parentcaller": "0x7fff5554266e", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000015f0" }, { "name": "TargetProcessHandle", "value": "0x00001210" }, { "name": "TargetHandle", "value": "0x00000904" }, { "name": "Options", "value": "0x00000000" } ], "repeated": 0, "id": 253 }, { "timestamp": "2026-05-29 01:05:19,252", "thread_id": "1652", "caller": "0x7fff55532c42", "parentcaller": "0x7fff5554266e", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000167c" }, { "name": "TargetProcessHandle", "value": "0x00001210" }, { "name": "TargetHandle", "value": "0x00000998" }, { "name": "Options", "value": "0x00000000" } ], "repeated": 0, "id": 254 }, { "timestamp": "2026-05-29 01:05:19,252", "thread_id": "1652", "caller": "0x7fff55532c77", "parentcaller": "0x7fff5554266e", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000016ac" }, { "name": "TargetProcessHandle", "value": "0x00001210" }, { "name": "TargetHandle", "value": "0x0000090c" }, { "name": "Options", "value": "0x00000000" } ], "repeated": 0, "id": 255 }, { "timestamp": "2026-05-29 01:05:21,752", "thread_id": "1652", "caller": "0x7fff555422bd", "parentcaller": "0x7fff5544ce49", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000016d8" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000016ec" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 256 }, { "timestamp": "2026-05-29 01:05:21,752", "thread_id": "1652", "caller": "0x7fff555422bd", "parentcaller": "0x7fff5544ce49", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000016d8" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000016f8" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 257 }, { "timestamp": "2026-05-29 01:05:21,752", "thread_id": "1652", "caller": "0x7fff55447024", "parentcaller": "0x7fff55447125", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000016f8" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000016fc" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 258 }, { "timestamp": "2026-05-29 01:05:21,783", "thread_id": "932", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff555d1c70", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000eb4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001710" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 259 }, { "timestamp": "2026-05-29 01:05:21,783", "thread_id": "932", "caller": "0x7fff577fc5f2", "parentcaller": "0x7fff577f89f3", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001668" }, { "name": "ThreadHandle", "value": "0x000016b4" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Windows\\SystemApps\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\\TextInputHost.exe" }, { "name": "CommandLine", "value": "\"C:\\Windows\\SystemApps\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\\TextInputHost.exe\" -ServerName:InputApp.AppXjd5de1g66v206tj52m9d0dtpppx4cgpn.mca" }, { "name": "DllPath", "value": "C:\\Windows\\SystemApps\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy;" }, { "name": "ProcessId", "value": "140733193397948" } ], "repeated": 0, "id": 260 }, { "timestamp": "2026-05-29 01:05:21,783", "thread_id": "1652", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff555d1c70", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000eb4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001684" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 261 }, { "timestamp": "2026-05-29 01:05:21,783", "thread_id": "1652", "caller": "0x7fff577fc5f2", "parentcaller": "0x7fff577f89f3", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001654" }, { "name": "ThreadHandle", "value": "0x000016f4" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Windows\\system32\\DllHost.exe" }, { "name": "CommandLine", "value": "C:\\Windows\\system32\\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251}" }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "140733193398012" } ], "repeated": 0, "id": 262 }, { "timestamp": "2026-05-29 01:05:21,814", "thread_id": "1652", "caller": "0x7fff577f89f3", "parentcaller": "0x7fff57fcde30", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "C:\\Windows\\system32\\DllHost.exe" }, { "name": "CommandLine", "value": "C:\\Windows\\system32\\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251}" }, { "name": "CreationFlags", "value": "0x00080410", "pretty_value": "CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "9980" }, { "name": "ThreadId", "value": "9924" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x00001654" }, { "name": "ThreadHandle", "value": "0x000016f4" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 263 }, { "timestamp": "2026-05-29 01:05:21,814", "thread_id": "1652", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff555d1c70", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000eb4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000172c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 264 }, { "timestamp": "2026-05-29 01:05:21,814", "thread_id": "1652", "caller": "0x7fff577fc5f2", "parentcaller": "0x7fff577f89f3", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001714" }, { "name": "ThreadHandle", "value": "0x00001724" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Windows\\system32\\DllHost.exe" }, { "name": "CommandLine", "value": "C:\\Windows\\system32\\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251}" }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "140733193397984" } ], "repeated": 0, "id": 265 }, { "timestamp": "2026-05-29 01:05:21,861", "thread_id": "1652", "caller": "0x7fff577f89f3", "parentcaller": "0x7fff57fcde30", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "C:\\Windows\\system32\\DllHost.exe" }, { "name": "CommandLine", "value": "C:\\Windows\\system32\\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251}" }, { "name": "CreationFlags", "value": "0x00080410", "pretty_value": "CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "9952" }, { "name": "ThreadId", "value": "9964" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x00001714" }, { "name": "ThreadHandle", "value": "0x00001724" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 266 }, { "timestamp": "2026-05-29 01:05:21,861", "thread_id": "1652", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff555d1c70", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000eb4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001744" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 267 }, { "timestamp": "2026-05-29 01:05:21,861", "thread_id": "1652", "caller": "0x7fff577fc5f2", "parentcaller": "0x7fff577f89f3", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001750" }, { "name": "ThreadHandle", "value": "0x0000174c" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Windows\\system32\\DllHost.exe" }, { "name": "CommandLine", "value": "C:\\Windows\\system32\\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251}" }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "140733193398200" } ], "repeated": 0, "id": 268 }, { "timestamp": "2026-05-29 01:05:21,892", "thread_id": "1652", "caller": "0x7fff577f89f3", "parentcaller": "0x7fff57fcde30", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "C:\\Windows\\system32\\DllHost.exe" }, { "name": "CommandLine", "value": "C:\\Windows\\system32\\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251}" }, { "name": "CreationFlags", "value": "0x00080410", "pretty_value": "CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "10168" }, { "name": "ThreadId", "value": "12264" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x00001750" }, { "name": "ThreadHandle", "value": "0x0000174c" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 269 }, { "timestamp": "2026-05-29 01:05:21,908", "thread_id": "1652", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff555d1c70", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000eb4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000173c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 270 }, { "timestamp": "2026-05-29 01:05:21,908", "thread_id": "1652", "caller": "0x7fff577fc5f2", "parentcaller": "0x7fff577f89f3", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001758" }, { "name": "ThreadHandle", "value": "0x0000174c" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Windows\\system32\\DllHost.exe" }, { "name": "CommandLine", "value": "C:\\Windows\\system32\\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251}" }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "140733193399692" } ], "repeated": 0, "id": 271 }, { "timestamp": "2026-05-29 01:05:21,908", "thread_id": "928", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff59939f03", "category": "services", "api": "StartServiceW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ServiceHandle", "value": "0x256f32d7fa0" }, { "name": "ServiceName", "value": "MicrosoftEdgeElevationService" }, { "name": "Arguments", "value": [] } ], "repeated": 0, "id": 272 }, { "timestamp": "2026-05-29 01:05:21,939", "thread_id": "1652", "caller": "0x7fff577f89f3", "parentcaller": "0x7fff57fcde30", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "C:\\Windows\\system32\\DllHost.exe" }, { "name": "CommandLine", "value": "C:\\Windows\\system32\\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251}" }, { "name": "CreationFlags", "value": "0x00080410", "pretty_value": "CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "11660" }, { "name": "ThreadId", "value": "9652" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x00001758" }, { "name": "ThreadHandle", "value": "0x0000174c" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 273 }, { "timestamp": "2026-05-29 01:05:22,377", "thread_id": "928", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff555d1c70", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000eb4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000175c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 274 }, { "timestamp": "2026-05-29 01:05:22,377", "thread_id": "928", "caller": "0x7fff577fc5f2", "parentcaller": "0x7fff577f89f3", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000174c" }, { "name": "ThreadHandle", "value": "0x0000173c" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Windows\\system32\\DllHost.exe" }, { "name": "CommandLine", "value": "C:\\Windows\\system32\\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251}" }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "140733193398416" } ], "repeated": 0, "id": 275 }, { "timestamp": "2026-05-29 01:05:22,424", "thread_id": "928", "caller": "0x7fff577f89f3", "parentcaller": "0x7fff57fcde30", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "C:\\Windows\\system32\\DllHost.exe" }, { "name": "CommandLine", "value": "C:\\Windows\\system32\\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251}" }, { "name": "CreationFlags", "value": "0x00080410", "pretty_value": "CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "10384" }, { "name": "ThreadId", "value": "9812" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x0000174c" }, { "name": "ThreadHandle", "value": "0x0000173c" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 276 }, { "timestamp": "2026-05-29 01:05:22,439", "thread_id": "928", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff555d1c70", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000eb4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001758" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 277 }, { "timestamp": "2026-05-29 01:05:22,439", "thread_id": "928", "caller": "0x7fff577fc5f2", "parentcaller": "0x7fff577f89f3", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001684" }, { "name": "ThreadHandle", "value": "0x000015fc" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Windows\\system32\\DllHost.exe" }, { "name": "CommandLine", "value": "C:\\Windows\\system32\\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251}" }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "140733193399048" } ], "repeated": 0, "id": 278 }, { "timestamp": "2026-05-29 01:05:22,471", "thread_id": "928", "caller": "0x7fff577f89f3", "parentcaller": "0x7fff57fcde30", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "C:\\Windows\\system32\\DllHost.exe" }, { "name": "CommandLine", "value": "C:\\Windows\\system32\\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251}" }, { "name": "CreationFlags", "value": "0x00080410", "pretty_value": "CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "11016" }, { "name": "ThreadId", "value": "11004" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x00001684" }, { "name": "ThreadHandle", "value": "0x000015fc" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 279 }, { "timestamp": "2026-05-29 01:05:22,471", "thread_id": "928", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff555d1c70", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000eb4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000016f4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 280 }, { "timestamp": "2026-05-29 01:05:22,486", "thread_id": "928", "caller": "0x7fff577fc5f2", "parentcaller": "0x7fff577f89f3", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000173c" }, { "name": "ThreadHandle", "value": "0x0000175c" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Windows\\system32\\DllHost.exe" }, { "name": "CommandLine", "value": "C:\\Windows\\system32\\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251}" }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "140733193388996" } ], "repeated": 0, "id": 281 }, { "timestamp": "2026-05-29 01:05:22,517", "thread_id": "928", "caller": "0x7fff577f89f3", "parentcaller": "0x7fff57fcde30", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "C:\\Windows\\system32\\DllHost.exe" }, { "name": "CommandLine", "value": "C:\\Windows\\system32\\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251}" }, { "name": "CreationFlags", "value": "0x00080410", "pretty_value": "CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "964" }, { "name": "ThreadId", "value": "9840" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x0000173c" }, { "name": "ThreadHandle", "value": "0x0000175c" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 282 }, { "timestamp": "2026-05-29 01:05:22,517", "thread_id": "928", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff555d1c70", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000eb4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001654" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 283 }, { "timestamp": "2026-05-29 01:05:22,517", "thread_id": "928", "caller": "0x7fff577fc5f2", "parentcaller": "0x7fff577f89f3", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001750" }, { "name": "ThreadHandle", "value": "0x0000175c" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Windows\\system32\\DllHost.exe" }, { "name": "CommandLine", "value": "C:\\Windows\\system32\\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251}" }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "140733193397408" } ], "repeated": 0, "id": 284 }, { "timestamp": "2026-05-29 01:05:22,564", "thread_id": "928", "caller": "0x7fff577f89f3", "parentcaller": "0x7fff57fcde30", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "C:\\Windows\\system32\\DllHost.exe" }, { "name": "CommandLine", "value": "C:\\Windows\\system32\\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251}" }, { "name": "CreationFlags", "value": "0x00080410", "pretty_value": "CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "9376" }, { "name": "ThreadId", "value": "5672" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x00001750" }, { "name": "ThreadHandle", "value": "0x0000175c" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 285 }, { "timestamp": "2026-05-29 01:05:22,674", "thread_id": "928", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff555d1c70", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000eb4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000173c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 286 }, { "timestamp": "2026-05-29 01:05:22,674", "thread_id": "928", "caller": "0x7fff577fc5f2", "parentcaller": "0x7fff577f89f3", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001690" }, { "name": "ThreadHandle", "value": "0x0000175c" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Windows\\system32\\DllHost.exe" }, { "name": "CommandLine", "value": "C:\\Windows\\system32\\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251}" }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "140733193393144" } ], "repeated": 0, "id": 287 }, { "timestamp": "2026-05-29 01:05:22,705", "thread_id": "928", "caller": "0x7fff577f89f3", "parentcaller": "0x7fff57fcde30", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "C:\\Windows\\system32\\DllHost.exe" }, { "name": "CommandLine", "value": "C:\\Windows\\system32\\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251}" }, { "name": "CreationFlags", "value": "0x00080410", "pretty_value": "CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "5112" }, { "name": "ThreadId", "value": "10920" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x00001690" }, { "name": "ThreadHandle", "value": "0x0000175c" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 288 }, { "timestamp": "2026-05-29 01:05:22,705", "thread_id": "928", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff555d1c70", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000eb4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001714" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 289 }, { "timestamp": "2026-05-29 01:05:22,705", "thread_id": "928", "caller": "0x7fff577fc5f2", "parentcaller": "0x7fff577f89f3", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000fc4" }, { "name": "ThreadHandle", "value": "0x000015e4" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Windows\\system32\\DllHost.exe" }, { "name": "CommandLine", "value": "C:\\Windows\\system32\\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251}" }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "140733193400336" } ], "repeated": 0, "id": 290 }, { "timestamp": "2026-05-29 01:05:22,752", "thread_id": "928", "caller": "0x7fff577f89f3", "parentcaller": "0x7fff57fcde30", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "C:\\Windows\\system32\\DllHost.exe" }, { "name": "CommandLine", "value": "C:\\Windows\\system32\\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251}" }, { "name": "CreationFlags", "value": "0x00080410", "pretty_value": "CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "12304" }, { "name": "ThreadId", "value": "12308" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x00000fc4" }, { "name": "ThreadHandle", "value": "0x000015e4" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 291 }, { "timestamp": "2026-05-29 01:05:22,799", "thread_id": "928", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff555d1c70", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000eb4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001518" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 292 }, { "timestamp": "2026-05-29 01:05:22,799", "thread_id": "928", "caller": "0x7fff577fc5f2", "parentcaller": "0x7fff577f89f3", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000016c4" }, { "name": "ThreadHandle", "value": "0x000015e4" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Windows\\system32\\DllHost.exe" }, { "name": "CommandLine", "value": "C:\\Windows\\system32\\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251}" }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "140733193400428" } ], "repeated": 0, "id": 293 }, { "timestamp": "2026-05-29 01:05:22,814", "thread_id": "928", "caller": "0x7fff577f89f3", "parentcaller": "0x7fff57fcde30", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "C:\\Windows\\system32\\DllHost.exe" }, { "name": "CommandLine", "value": "C:\\Windows\\system32\\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251}" }, { "name": "CreationFlags", "value": "0x00080410", "pretty_value": "CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "12396" }, { "name": "ThreadId", "value": "12400" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x000016c4" }, { "name": "ThreadHandle", "value": "0x000015e4" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 294 }, { "timestamp": "2026-05-29 01:05:22,814", "thread_id": "928", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff555d1c70", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000eb4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000d08" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 295 }, { "timestamp": "2026-05-29 01:05:22,814", "thread_id": "928", "caller": "0x7fff577fc5f2", "parentcaller": "0x7fff577f89f3", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000015d4" }, { "name": "ThreadHandle", "value": "0x000015a0" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Windows\\system32\\DllHost.exe" }, { "name": "CommandLine", "value": "C:\\Windows\\system32\\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251}" }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "140733193400520" } ], "repeated": 0, "id": 296 }, { "timestamp": "2026-05-29 01:05:22,846", "thread_id": "928", "caller": "0x7fff577f89f3", "parentcaller": "0x7fff57fcde30", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "C:\\Windows\\system32\\DllHost.exe" }, { "name": "CommandLine", "value": "C:\\Windows\\system32\\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251}" }, { "name": "CreationFlags", "value": "0x00080410", "pretty_value": "CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "12488" }, { "name": "ThreadId", "value": "12492" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x000015d4" }, { "name": "ThreadHandle", "value": "0x000015a0" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 297 }, { "timestamp": "2026-05-29 01:05:23,064", "thread_id": "932", "caller": "0x7fff577f89f3", "parentcaller": "0x7fff57fcde30", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "C:\\Windows\\SystemApps\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\\TextInputHost.exe" }, { "name": "CommandLine", "value": "\"C:\\Windows\\SystemApps\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\\TextInputHost.exe\" -ServerName:InputApp.AppXjd5de1g66v206tj52m9d0dtpppx4cgpn.mca" }, { "name": "CreationFlags", "value": "0x00080414", "pretty_value": "CREATE_SUSPENDED|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "9916" }, { "name": "ThreadId", "value": "9920" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x00001668" }, { "name": "ThreadHandle", "value": "0x000016b4" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 298 }, { "timestamp": "2026-05-29 01:05:23,736", "thread_id": "932", "caller": "0x7fff555f3391", "parentcaller": "0x7fff555b1704", "category": "threading", "api": "NtResumeThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x000016b4" }, { "name": "SuspendCount", "value": "1" }, { "name": "ThreadId", "value": "9920" }, { "name": "ProcessId", "value": "9916" } ], "repeated": 0, "id": 299 }, { "timestamp": "2026-05-29 01:05:24,127", "thread_id": "1640", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff555d1c70", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000eb4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001750" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 300 }, { "timestamp": "2026-05-29 01:05:24,142", "thread_id": "1640", "caller": "0x7fff577fc5f2", "parentcaller": "0x7fff577f89f3", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001718" }, { "name": "ThreadHandle", "value": "0x000016b4" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Windows\\system32\\DllHost.exe" }, { "name": "CommandLine", "value": "C:\\Windows\\system32\\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251}" }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "140733193400700" } ], "repeated": 0, "id": 301 }, { "timestamp": "2026-05-29 01:05:24,189", "thread_id": "1640", "caller": "0x7fff577f89f3", "parentcaller": "0x7fff57fcde30", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "C:\\Windows\\system32\\DllHost.exe" }, { "name": "CommandLine", "value": "C:\\Windows\\system32\\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251}" }, { "name": "CreationFlags", "value": "0x00080410", "pretty_value": "CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "12668" }, { "name": "ThreadId", "value": "12672" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x00001718" }, { "name": "ThreadHandle", "value": "0x000016b4" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 302 }, { "timestamp": "2026-05-29 01:05:24,205", "thread_id": "1640", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff555d1c70", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000eb4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000015d4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 303 }, { "timestamp": "2026-05-29 01:05:24,205", "thread_id": "1640", "caller": "0x7fff577fc5f2", "parentcaller": "0x7fff577f89f3", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000015a0" }, { "name": "ThreadHandle", "value": "0x00000d08" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Windows\\system32\\DllHost.exe" }, { "name": "CommandLine", "value": "C:\\Windows\\system32\\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251}" }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "140733193400788" } ], "repeated": 0, "id": 304 }, { "timestamp": "2026-05-29 01:05:24,267", "thread_id": "1640", "caller": "0x7fff577f89f3", "parentcaller": "0x7fff57fcde30", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "C:\\Windows\\system32\\DllHost.exe" }, { "name": "CommandLine", "value": "C:\\Windows\\system32\\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251}" }, { "name": "CreationFlags", "value": "0x00080410", "pretty_value": "CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "12756" }, { "name": "ThreadId", "value": "12760" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x000015a0" }, { "name": "ThreadHandle", "value": "0x00000d08" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 305 }, { "timestamp": "2026-05-29 01:05:24,299", "thread_id": "464", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 306 }, { "timestamp": "2026-05-29 01:05:24,330", "thread_id": "464", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001704" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 307 }, { "timestamp": "2026-05-29 01:05:24,330", "thread_id": "464", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001758" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 308 }, { "timestamp": "2026-05-29 01:05:24,330", "thread_id": "464", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 309 }, { "timestamp": "2026-05-29 01:05:24,330", "thread_id": "464", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x256f2750000" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\\S-1-5-18.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 310 }, { "timestamp": "2026-05-29 01:05:24,330", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001718" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 311 }, { "timestamp": "2026-05-29 01:05:24,330", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000015a0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 312 }, { "timestamp": "2026-05-29 01:05:24,330", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 313 }, { "timestamp": "2026-05-29 01:05:24,330", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000016a8" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 314 }, { "timestamp": "2026-05-29 01:05:24,330", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000016bc" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 315 }, { "timestamp": "2026-05-29 01:05:24,330", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 316 }, { "timestamp": "2026-05-29 01:05:24,330", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000016bc" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 317 }, { "timestamp": "2026-05-29 01:05:24,330", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001718" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 318 }, { "timestamp": "2026-05-29 01:05:24,330", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 319 }, { "timestamp": "2026-05-29 01:05:24,330", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001718" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 320 }, { "timestamp": "2026-05-29 01:05:24,346", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000016a8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 321 }, { "timestamp": "2026-05-29 01:05:24,346", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 322 }, { "timestamp": "2026-05-29 01:05:24,346", "thread_id": "464", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001690" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 323 }, { "timestamp": "2026-05-29 01:05:24,346", "thread_id": "464", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001684" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00003000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 324 }, { "timestamp": "2026-05-29 01:05:24,346", "thread_id": "464", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 325 }, { "timestamp": "2026-05-29 01:05:24,346", "thread_id": "464", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000014c8" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 326 }, { "timestamp": "2026-05-29 01:05:24,346", "thread_id": "464", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001758" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00003000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 327 }, { "timestamp": "2026-05-29 01:05:24,346", "thread_id": "464", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 328 }, { "timestamp": "2026-05-29 01:05:24,346", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000016bc" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 329 }, { "timestamp": "2026-05-29 01:05:24,346", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000016fc" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 330 }, { "timestamp": "2026-05-29 01:05:24,346", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 331 }, { "timestamp": "2026-05-29 01:05:24,346", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000016fc" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 332 }, { "timestamp": "2026-05-29 01:05:24,346", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000016bc" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 333 }, { "timestamp": "2026-05-29 01:05:24,346", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 334 }, { "timestamp": "2026-05-29 01:05:24,346", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000015e4" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 335 }, { "timestamp": "2026-05-29 01:05:24,346", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001684" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00003000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 336 }, { "timestamp": "2026-05-29 01:05:24,346", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 337 }, { "timestamp": "2026-05-29 01:05:24,346", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001750" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 338 }, { "timestamp": "2026-05-29 01:05:24,346", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001718" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00003000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 339 }, { "timestamp": "2026-05-29 01:05:24,346", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 340 }, { "timestamp": "2026-05-29 01:05:24,346", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001718" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 341 }, { "timestamp": "2026-05-29 01:05:24,346", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001750" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00003000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 342 }, { "timestamp": "2026-05-29 01:05:24,346", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 343 }, { "timestamp": "2026-05-29 01:05:24,346", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000015e4" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 344 }, { "timestamp": "2026-05-29 01:05:24,346", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000014c8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00003000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 345 }, { "timestamp": "2026-05-29 01:05:24,346", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 346 }, { "timestamp": "2026-05-29 01:05:24,346", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000014c8" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 347 }, { "timestamp": "2026-05-29 01:05:24,346", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000015e4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00003000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 348 }, { "timestamp": "2026-05-29 01:05:24,346", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 349 }, { "timestamp": "2026-05-29 01:05:24,361", "thread_id": "932", "caller": "0x7fff555422bd", "parentcaller": "0x7fff5544ce49", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001684" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001690" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 350 }, { "timestamp": "2026-05-29 01:05:24,361", "thread_id": "780", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000015a4" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 351 }, { "timestamp": "2026-05-29 01:05:24,361", "thread_id": "780", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001650" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00003000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 352 }, { "timestamp": "2026-05-29 01:05:24,361", "thread_id": "780", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 353 }, { "timestamp": "2026-05-29 01:05:24,361", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001650" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 354 }, { "timestamp": "2026-05-29 01:05:24,361", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000015a4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00003000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 355 }, { "timestamp": "2026-05-29 01:05:24,361", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 356 }, { "timestamp": "2026-05-29 01:05:24,361", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001714" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 357 }, { "timestamp": "2026-05-29 01:05:24,361", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000016d0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00003000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 358 }, { "timestamp": "2026-05-29 01:05:24,361", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 359 }, { "timestamp": "2026-05-29 01:05:24,361", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001698" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 360 }, { "timestamp": "2026-05-29 01:05:24,361", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000016d0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00003000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 361 }, { "timestamp": "2026-05-29 01:05:24,361", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 362 }, { "timestamp": "2026-05-29 01:05:24,361", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000175c" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 363 }, { "timestamp": "2026-05-29 01:05:24,361", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001704" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00003000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 364 }, { "timestamp": "2026-05-29 01:05:24,361", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 365 }, { "timestamp": "2026-05-29 01:05:24,361", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001704" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 366 }, { "timestamp": "2026-05-29 01:05:24,361", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000175c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00003000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 367 }, { "timestamp": "2026-05-29 01:05:24,361", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 368 }, { "timestamp": "2026-05-29 01:05:24,361", "thread_id": "780", "caller": "0x7fff555422bd", "parentcaller": "0x7fff5544ce49", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001694" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000162c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 369 }, { "timestamp": "2026-05-29 01:05:24,361", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000015a4" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 370 }, { "timestamp": "2026-05-29 01:05:24,361", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001650" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00003000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 371 }, { "timestamp": "2026-05-29 01:05:24,361", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 372 }, { "timestamp": "2026-05-29 01:05:24,377", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000016bc" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 373 }, { "timestamp": "2026-05-29 01:05:24,377", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001688" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00003000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 374 }, { "timestamp": "2026-05-29 01:05:24,377", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 375 }, { "timestamp": "2026-05-29 01:05:24,377", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000016a8" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 376 }, { "timestamp": "2026-05-29 01:05:24,377", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000016fc" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00003000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 377 }, { "timestamp": "2026-05-29 01:05:24,377", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 378 }, { "timestamp": "2026-05-29 01:05:24,392", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000016d0" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 379 }, { "timestamp": "2026-05-29 01:05:24,392", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001650" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00003000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 380 }, { "timestamp": "2026-05-29 01:05:24,392", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 381 }, { "timestamp": "2026-05-29 01:05:24,392", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001650" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 382 }, { "timestamp": "2026-05-29 01:05:24,392", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000016d0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00003000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 383 }, { "timestamp": "2026-05-29 01:05:24,392", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 384 }, { "timestamp": "2026-05-29 01:05:24,392", "thread_id": "928", "caller": "0x7fff555422bd", "parentcaller": "0x7fff5544ce49", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001744" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000173c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 385 }, { "timestamp": "2026-05-29 01:05:24,392", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001688" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 386 }, { "timestamp": "2026-05-29 01:05:24,392", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000016fc" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 387 }, { "timestamp": "2026-05-29 01:05:24,392", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 388 }, { "timestamp": "2026-05-29 01:05:24,392", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001688" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 389 }, { "timestamp": "2026-05-29 01:05:24,392", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000016fc" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 390 }, { "timestamp": "2026-05-29 01:05:24,392", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 391 }, { "timestamp": "2026-05-29 01:05:24,392", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000016fc" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 392 }, { "timestamp": "2026-05-29 01:05:24,392", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001688" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 393 }, { "timestamp": "2026-05-29 01:05:24,392", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 394 }, { "timestamp": "2026-05-29 01:05:24,392", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001688" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 395 }, { "timestamp": "2026-05-29 01:05:24,392", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000016fc" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 396 }, { "timestamp": "2026-05-29 01:05:24,392", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 397 }, { "timestamp": "2026-05-29 01:05:24,392", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000016fc" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 398 }, { "timestamp": "2026-05-29 01:05:24,392", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001688" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 399 }, { "timestamp": "2026-05-29 01:05:24,392", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 400 }, { "timestamp": "2026-05-29 01:05:24,392", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001688" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 401 }, { "timestamp": "2026-05-29 01:05:24,392", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000016fc" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 402 }, { "timestamp": "2026-05-29 01:05:24,392", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 403 }, { "timestamp": "2026-05-29 01:05:24,392", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000016fc" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 404 }, { "timestamp": "2026-05-29 01:05:24,392", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001688" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 405 }, { "timestamp": "2026-05-29 01:05:24,392", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 406 }, { "timestamp": "2026-05-29 01:05:24,392", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001714" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 407 }, { "timestamp": "2026-05-29 01:05:24,392", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001754" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00003000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 408 }, { "timestamp": "2026-05-29 01:05:24,392", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 409 }, { "timestamp": "2026-05-29 01:05:24,392", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000016a8" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 410 }, { "timestamp": "2026-05-29 01:05:24,392", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000016fc" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00003000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 411 }, { "timestamp": "2026-05-29 01:05:24,392", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 412 }, { "timestamp": "2026-05-29 01:05:24,392", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000d08" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 413 }, { "timestamp": "2026-05-29 01:05:24,392", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000016a8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00003000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 414 }, { "timestamp": "2026-05-29 01:05:24,392", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 415 }, { "timestamp": "2026-05-29 01:05:24,392", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001754" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 416 }, { "timestamp": "2026-05-29 01:05:24,392", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001768" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00003000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 417 }, { "timestamp": "2026-05-29 01:05:24,392", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 418 }, { "timestamp": "2026-05-29 01:05:24,392", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001754" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 419 }, { "timestamp": "2026-05-29 01:05:24,392", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001764" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00003000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 420 }, { "timestamp": "2026-05-29 01:05:24,392", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 421 }, { "timestamp": "2026-05-29 01:05:24,392", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001754" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 422 }, { "timestamp": "2026-05-29 01:05:24,392", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001764" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00003000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 423 }, { "timestamp": "2026-05-29 01:05:24,392", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 424 }, { "timestamp": "2026-05-29 01:05:24,408", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001748" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 425 }, { "timestamp": "2026-05-29 01:05:24,408", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001714" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00003000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 426 }, { "timestamp": "2026-05-29 01:05:24,408", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 427 }, { "timestamp": "2026-05-29 01:05:24,408", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001718" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 428 }, { "timestamp": "2026-05-29 01:05:24,408", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000015d4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00003000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 429 }, { "timestamp": "2026-05-29 01:05:24,408", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 430 }, { "timestamp": "2026-05-29 01:05:24,408", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000016bc" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 431 }, { "timestamp": "2026-05-29 01:05:24,408", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001718" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00003000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 432 }, { "timestamp": "2026-05-29 01:05:24,408", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 433 }, { "timestamp": "2026-05-29 01:05:24,408", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001768" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 434 }, { "timestamp": "2026-05-29 01:05:24,408", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000015e8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00003000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 435 }, { "timestamp": "2026-05-29 01:05:24,408", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 436 }, { "timestamp": "2026-05-29 01:05:24,408", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000015e8" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 437 }, { "timestamp": "2026-05-29 01:05:24,408", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001768" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00003000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 438 }, { "timestamp": "2026-05-29 01:05:24,408", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 439 }, { "timestamp": "2026-05-29 01:05:24,408", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001768" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 440 }, { "timestamp": "2026-05-29 01:05:24,408", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000015e8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00003000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 441 }, { "timestamp": "2026-05-29 01:05:24,408", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 442 }, { "timestamp": "2026-05-29 01:05:24,408", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000015d4" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 443 }, { "timestamp": "2026-05-29 01:05:24,408", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001714" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00003000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 444 }, { "timestamp": "2026-05-29 01:05:24,408", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 445 }, { "timestamp": "2026-05-29 01:05:24,408", "thread_id": "928", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff555d1c70", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000eb4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000177c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 446 }, { "timestamp": "2026-05-29 01:05:24,408", "thread_id": "928", "caller": "0x7fff577fc5f2", "parentcaller": "0x7fff577f89f3", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001784" }, { "name": "ThreadHandle", "value": "0x00001780" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Windows\\system32\\backgroundTaskHost.exe" }, { "name": "CommandLine", "value": "\"C:\\Windows\\system32\\backgroundTaskHost.exe\" -ServerName:Global.Accounts.AppXqe94epy97qwa6w3j6w132e8zvcs117nd.mca" }, { "name": "DllPath", "value": "C:\\Windows\\SystemApps\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy;" }, { "name": "ProcessId", "value": "140733193400960" } ], "repeated": 0, "id": 447 }, { "timestamp": "2026-05-29 01:05:24,408", "thread_id": "6188", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001620" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 448 }, { "timestamp": "2026-05-29 01:05:24,408", "thread_id": "6188", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001770" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f37a0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 449 }, { "timestamp": "2026-05-29 01:05:24,408", "thread_id": "6188", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f37a0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 450 }, { "timestamp": "2026-05-29 01:05:24,408", "thread_id": "6188", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001770" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 451 }, { "timestamp": "2026-05-29 01:05:24,408", "thread_id": "6188", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001620" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f37a0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 452 }, { "timestamp": "2026-05-29 01:05:24,408", "thread_id": "6188", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f37a0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 453 }, { "timestamp": "2026-05-29 01:05:24,408", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001658" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 454 }, { "timestamp": "2026-05-29 01:05:24,408", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000015f4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f37a0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00003000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 455 }, { "timestamp": "2026-05-29 01:05:24,408", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f37a0000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 456 }, { "timestamp": "2026-05-29 01:05:24,424", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001574" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 457 }, { "timestamp": "2026-05-29 01:05:24,424", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000015d4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f37a0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00003000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 458 }, { "timestamp": "2026-05-29 01:05:24,424", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f37a0000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 459 }, { "timestamp": "2026-05-29 01:05:24,424", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000015d4" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 460 }, { "timestamp": "2026-05-29 01:05:24,424", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001574" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f37a0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00003000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 461 }, { "timestamp": "2026-05-29 01:05:24,424", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f37a0000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 462 }, { "timestamp": "2026-05-29 01:05:24,424", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001574" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 463 }, { "timestamp": "2026-05-29 01:05:24,424", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000015d4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f37a0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00003000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 464 }, { "timestamp": "2026-05-29 01:05:24,424", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f37a0000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 465 }, { "timestamp": "2026-05-29 01:05:24,424", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000015d4" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 466 }, { "timestamp": "2026-05-29 01:05:24,424", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001574" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f37a0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00003000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 467 }, { "timestamp": "2026-05-29 01:05:24,424", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f37a0000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 468 }, { "timestamp": "2026-05-29 01:05:24,424", "thread_id": "780", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff555d1c70", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000eb4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001730" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 469 }, { "timestamp": "2026-05-29 01:05:24,424", "thread_id": "780", "caller": "0x7fff577fc5f2", "parentcaller": "0x7fff577f89f3", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001734" }, { "name": "ThreadHandle", "value": "0x00001790" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Windows\\system32\\backgroundTaskHost.exe" }, { "name": "CommandLine", "value": "\"C:\\Windows\\system32\\backgroundTaskHost.exe\" -ServerName:Global.IrisService.AppXwt29n3t7x7q6fgyrrbbqxwzkqjfjaw4y.mca" }, { "name": "DllPath", "value": "C:\\Windows\\SystemApps\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy;" }, { "name": "ProcessId", "value": "140733193400992" } ], "repeated": 0, "id": 470 }, { "timestamp": "2026-05-29 01:05:24,424", "thread_id": "932", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff555d1c70", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000eb4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001758" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 471 }, { "timestamp": "2026-05-29 01:05:24,424", "thread_id": "932", "caller": "0x7fff577fc5f2", "parentcaller": "0x7fff577f89f3", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000017b0" }, { "name": "ThreadHandle", "value": "0x000017bc" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Windows\\system32\\backgroundTaskHost.exe" }, { "name": "CommandLine", "value": "\"C:\\Windows\\system32\\backgroundTaskHost.exe\" -ServerName:Global.RulesEngine.AppXgphnekvm0vv49drvfehh4b6kyf6ckafp.mca" }, { "name": "DllPath", "value": "C:\\Windows\\SystemApps\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy;" }, { "name": "ProcessId", "value": "140733193401036" } ], "repeated": 0, "id": 472 }, { "timestamp": "2026-05-29 01:05:24,455", "thread_id": "464", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff577ce6a1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\rsaenh.dll" }, { "name": "BaseAddress", "value": "0x7fff56630000" } ], "repeated": 0, "id": 473 }, { "timestamp": "2026-05-29 01:05:24,533", "thread_id": "928", "caller": "0x7fff577f89f3", "parentcaller": "0x7fff57fcde30", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "C:\\Windows\\system32\\backgroundTaskHost.exe" }, { "name": "CommandLine", "value": "\"C:\\Windows\\system32\\backgroundTaskHost.exe\" -ServerName:Global.Accounts.AppXqe94epy97qwa6w3j6w132e8zvcs117nd.mca" }, { "name": "CreationFlags", "value": "0x00080414", "pretty_value": "CREATE_SUSPENDED|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "12928" }, { "name": "ThreadId", "value": "12932" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x00001784" }, { "name": "ThreadHandle", "value": "0x00001780" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 474 }, { "timestamp": "2026-05-29 01:05:24,533", "thread_id": "932", "caller": "0x7fff577f89f3", "parentcaller": "0x7fff57fcde30", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "C:\\Windows\\system32\\backgroundTaskHost.exe" }, { "name": "CommandLine", "value": "\"C:\\Windows\\system32\\backgroundTaskHost.exe\" -ServerName:Global.RulesEngine.AppXgphnekvm0vv49drvfehh4b6kyf6ckafp.mca" }, { "name": "CreationFlags", "value": "0x00080414", "pretty_value": "CREATE_SUSPENDED|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "13004" }, { "name": "ThreadId", "value": "13008" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x000017b0" }, { "name": "ThreadHandle", "value": "0x000017bc" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 475 }, { "timestamp": "2026-05-29 01:05:24,533", "thread_id": "780", "caller": "0x7fff577f89f3", "parentcaller": "0x7fff57fcde30", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "C:\\Windows\\system32\\backgroundTaskHost.exe" }, { "name": "CommandLine", "value": "\"C:\\Windows\\system32\\backgroundTaskHost.exe\" -ServerName:Global.IrisService.AppXwt29n3t7x7q6fgyrrbbqxwzkqjfjaw4y.mca" }, { "name": "CreationFlags", "value": "0x00080414", "pretty_value": "CREATE_SUSPENDED|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "12960" }, { "name": "ThreadId", "value": "12964" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x00001734" }, { "name": "ThreadHandle", "value": "0x00001790" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 476 }, { "timestamp": "2026-05-29 01:05:24,580", "thread_id": "780", "caller": "0x7fff555f3391", "parentcaller": "0x7fff555b1704", "category": "threading", "api": "NtResumeThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00001790" }, { "name": "SuspendCount", "value": "1" }, { "name": "ThreadId", "value": "12964" }, { "name": "ProcessId", "value": "12960" } ], "repeated": 0, "id": 477 }, { "timestamp": "2026-05-29 01:05:24,580", "thread_id": "932", "caller": "0x7fff555f3391", "parentcaller": "0x7fff555b1704", "category": "threading", "api": "NtResumeThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x000017bc" }, { "name": "SuspendCount", "value": "1" }, { "name": "ThreadId", "value": "13008" }, { "name": "ProcessId", "value": "13004" } ], "repeated": 0, "id": 478 }, { "timestamp": "2026-05-29 01:05:24,596", "thread_id": "928", "caller": "0x7fff555f3391", "parentcaller": "0x7fff555b1704", "category": "threading", "api": "NtResumeThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00001780" }, { "name": "SuspendCount", "value": "1" }, { "name": "ThreadId", "value": "12932" }, { "name": "ProcessId", "value": "12928" } ], "repeated": 0, "id": 479 }, { "timestamp": "2026-05-29 01:05:24,596", "thread_id": "6184", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 480 }, { "timestamp": "2026-05-29 01:05:24,596", "thread_id": "6184", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000016bc" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 481 }, { "timestamp": "2026-05-29 01:05:24,596", "thread_id": "6184", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000015d4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00003000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 482 }, { "timestamp": "2026-05-29 01:05:24,596", "thread_id": "6184", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 483 }, { "timestamp": "2026-05-29 01:05:24,611", "thread_id": "3420", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 484 }, { "timestamp": "2026-05-29 01:05:24,611", "thread_id": "3420", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000017b4" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 485 }, { "timestamp": "2026-05-29 01:05:24,611", "thread_id": "3420", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000169c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00003000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 486 }, { "timestamp": "2026-05-29 01:05:24,611", "thread_id": "3420", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 487 }, { "timestamp": "2026-05-29 01:05:24,611", "thread_id": "6188", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 488 }, { "timestamp": "2026-05-29 01:05:24,611", "thread_id": "6188", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001764" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 489 }, { "timestamp": "2026-05-29 01:05:24,611", "thread_id": "6188", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001684" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00003000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 490 }, { "timestamp": "2026-05-29 01:05:24,611", "thread_id": "6188", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 491 }, { "timestamp": "2026-05-29 01:05:25,064", "thread_id": "928", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001518" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 492 }, { "timestamp": "2026-05-29 01:05:25,064", "thread_id": "928", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000162c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 493 }, { "timestamp": "2026-05-29 01:05:25,064", "thread_id": "928", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 494 }, { "timestamp": "2026-05-29 01:05:26,549", "thread_id": "928", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001574" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\PhysicalDrive0" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 495 }, { "timestamp": "2026-05-29 01:05:36,549", "thread_id": "932", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001688" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\PhysicalDrive0" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 496 }, { "timestamp": "2026-05-29 01:05:39,892", "thread_id": "416", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5978ef53", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000128c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 497 }, { "timestamp": "2026-05-29 01:05:46,549", "thread_id": "932", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000eb8" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\PhysicalDrive0" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 498 }, { "timestamp": "2026-05-29 01:05:51,939", "thread_id": "1064", "caller": "0x7fff577fc5f2", "parentcaller": "0x7fff577f89f3", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000638" }, { "name": "ThreadHandle", "value": "0x000016dc" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Windows\\system32\\DllHost.exe" }, { "name": "CommandLine", "value": "C:\\Windows\\system32\\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "140733193397244" } ], "repeated": 0, "id": 499 }, { "timestamp": "2026-05-29 01:05:52,002", "thread_id": "1064", "caller": "0x7fff577f89f3", "parentcaller": "0x7fff57fcde30", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "C:\\Windows\\system32\\DllHost.exe" }, { "name": "CommandLine", "value": "C:\\Windows\\system32\\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" }, { "name": "CreationFlags", "value": "0x00000410", "pretty_value": "CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT" }, { "name": "ProcessId", "value": "9212" }, { "name": "ThreadId", "value": "8308" }, { "name": "ProcessHandle", "value": "0x00000638" }, { "name": "ThreadHandle", "value": "0x000016dc" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 500 }, { "timestamp": "2026-05-29 01:05:56,549", "thread_id": "932", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000015ec" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\PhysicalDrive0" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 501 }, { "timestamp": "2026-05-29 01:06:06,549", "thread_id": "932", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001028" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\PhysicalDrive0" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 502 }, { "timestamp": "2026-05-29 01:06:12,596", "thread_id": "780", "caller": "0x7fff555422bd", "parentcaller": "0x7fff5544ce49", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000015f0" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000016ac" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 503 }, { "timestamp": "2026-05-29 01:06:12,596", "thread_id": "780", "caller": "0x7fff555422bd", "parentcaller": "0x7fff5544ce49", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000015f0" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000167c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 504 }, { "timestamp": "2026-05-29 01:06:12,596", "thread_id": "780", "caller": "0x7fff55447024", "parentcaller": "0x7fff55447125", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000167c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001764" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 505 }, { "timestamp": "2026-05-29 01:06:12,596", "thread_id": "780", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff555d1c70", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000eb4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000167c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 506 }, { "timestamp": "2026-05-29 01:06:12,596", "thread_id": "780", "caller": "0x7fff577fc5f2", "parentcaller": "0x7fff577f89f3", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000016f0" }, { "name": "ThreadHandle", "value": "0x000017ac" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Windows\\system32\\DllHost.exe" }, { "name": "CommandLine", "value": "C:\\Windows\\system32\\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251}" }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "140733193392072" } ], "repeated": 0, "id": 507 }, { "timestamp": "2026-05-29 01:06:12,596", "thread_id": "1064", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff555d1c70", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000eb4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001574" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 508 }, { "timestamp": "2026-05-29 01:06:12,596", "thread_id": "1064", "caller": "0x7fff577fc5f2", "parentcaller": "0x7fff577f89f3", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001528" }, { "name": "ThreadHandle", "value": "0x00001740" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Windows\\SystemApps\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\\TextInputHost.exe" }, { "name": "CommandLine", "value": "\"C:\\Windows\\SystemApps\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\\TextInputHost.exe\" -ServerName:InputApp.AppXjd5de1g66v206tj52m9d0dtpppx4cgpn.mca" }, { "name": "DllPath", "value": "C:\\Windows\\SystemApps\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy;" }, { "name": "ProcessId", "value": "140733193389144" } ], "repeated": 0, "id": 509 }, { "timestamp": "2026-05-29 01:06:12,642", "thread_id": "780", "caller": "0x7fff577f89f3", "parentcaller": "0x7fff57fcde30", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "C:\\Windows\\system32\\DllHost.exe" }, { "name": "CommandLine", "value": "C:\\Windows\\system32\\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251}" }, { "name": "CreationFlags", "value": "0x00080410", "pretty_value": "CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "4040" }, { "name": "ThreadId", "value": "4048" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x000016f0" }, { "name": "ThreadHandle", "value": "0x000017ac" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 510 }, { "timestamp": "2026-05-29 01:06:12,642", "thread_id": "780", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff555d1c70", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000eb4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000664" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 511 }, { "timestamp": "2026-05-29 01:06:12,642", "thread_id": "780", "caller": "0x7fff577fc5f2", "parentcaller": "0x7fff577f89f3", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001748" }, { "name": "ThreadHandle", "value": "0x00001784" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Windows\\system32\\DllHost.exe" }, { "name": "CommandLine", "value": "C:\\Windows\\system32\\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251}" }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "140733193395036" } ], "repeated": 0, "id": 512 }, { "timestamp": "2026-05-29 01:06:12,674", "thread_id": "780", "caller": "0x7fff577f89f3", "parentcaller": "0x7fff57fcde30", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "C:\\Windows\\system32\\DllHost.exe" }, { "name": "CommandLine", "value": "C:\\Windows\\system32\\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251}" }, { "name": "CreationFlags", "value": "0x00080410", "pretty_value": "CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "7004" }, { "name": "ThreadId", "value": "7012" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x00001748" }, { "name": "ThreadHandle", "value": "0x00001784" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 513 }, { "timestamp": "2026-05-29 01:06:12,674", "thread_id": "780", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff555d1c70", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000eb4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000167c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 514 }, { "timestamp": "2026-05-29 01:06:12,674", "thread_id": "780", "caller": "0x7fff577fc5f2", "parentcaller": "0x7fff577f89f3", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001798" }, { "name": "ThreadHandle", "value": "0x000017a4" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Windows\\system32\\DllHost.exe" }, { "name": "CommandLine", "value": "C:\\Windows\\system32\\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251}" }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "140733193396492" } ], "repeated": 0, "id": 515 }, { "timestamp": "2026-05-29 01:06:12,721", "thread_id": "780", "caller": "0x7fff577f89f3", "parentcaller": "0x7fff57fcde30", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "C:\\Windows\\system32\\DllHost.exe" }, { "name": "CommandLine", "value": "C:\\Windows\\system32\\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251}" }, { "name": "CreationFlags", "value": "0x00080410", "pretty_value": "CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "8460" }, { "name": "ThreadId", "value": "1084" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x00001798" }, { "name": "ThreadHandle", "value": "0x000017a4" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 516 }, { "timestamp": "2026-05-29 01:06:12,721", "thread_id": "780", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff555d1c70", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000eb4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000017c8" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 517 }, { "timestamp": "2026-05-29 01:06:12,736", "thread_id": "780", "caller": "0x7fff577fc5f2", "parentcaller": "0x7fff577f89f3", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000179c" }, { "name": "ThreadHandle", "value": "0x000017ac" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Windows\\system32\\DllHost.exe" }, { "name": "CommandLine", "value": "C:\\Windows\\system32\\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251}" }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "140733193394436" } ], "repeated": 0, "id": 518 }, { "timestamp": "2026-05-29 01:06:12,767", "thread_id": "780", "caller": "0x7fff577f89f3", "parentcaller": "0x7fff57fcde30", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "C:\\Windows\\system32\\DllHost.exe" }, { "name": "CommandLine", "value": "C:\\Windows\\system32\\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251}" }, { "name": "CreationFlags", "value": "0x00080410", "pretty_value": "CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "6404" }, { "name": "ThreadId", "value": "6376" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x0000179c" }, { "name": "ThreadHandle", "value": "0x000017ac" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 519 }, { "timestamp": "2026-05-29 01:06:14,549", "thread_id": "1064", "caller": "0x7fff577f89f3", "parentcaller": "0x7fff57fcde30", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "C:\\Windows\\SystemApps\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\\TextInputHost.exe" }, { "name": "CommandLine", "value": "\"C:\\Windows\\SystemApps\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\\TextInputHost.exe\" -ServerName:InputApp.AppXjd5de1g66v206tj52m9d0dtpppx4cgpn.mca" }, { "name": "CreationFlags", "value": "0x00080414", "pretty_value": "CREATE_SUSPENDED|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "1112" }, { "name": "ThreadId", "value": "9768" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x00001528" }, { "name": "ThreadHandle", "value": "0x00001740" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 520 } ], "threads": [ "1640", "1064", "1652", "780", "3476", "6188", "936", "928", "3420", "464", "6184", "932", "416" ], "environ": { "UserName": "SYSTEM", "ComputerName": "DESKTOP-74SUV8W", "WindowsPath": "C:\\Windows", "TempPath": "C:\\Windows\\TEMP\\", "CommandLine": "C:\\Windows\\system32\\svchost.exe -k DcomLaunch -p", "RegisteredOwner": "", "RegisteredOrganization": "", "ProductName": "", "SystemVolumeSerialNumber": "b34c-3674", "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000", "MachineGUID": "", "MainExeBase": "0x7ff7bf220000", "MainExeSize": "0x00010000", "Bitness": "64-bit" }, "file_activities": { "read_files": [], "write_files": [], "delete_files": [] } }, { "process_id": 8636, "process_name": "dllhost.exe", "parent_id": 832, "module_path": "C:\\Windows\\System32\\dllhost.exe", "first_seen": "2026-05-29 01:05:04,456", "calls": [ { "timestamp": "2026-05-29 01:05:04,502", "thread_id": "8632", "caller": "0x7fff59fc507d", "parentcaller": "0x7fff59fc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 0 }, { "timestamp": "2026-05-29 01:05:04,502", "thread_id": "8632", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7ff6706b14e0" }, { "name": "Parameter", "value": "0xb4dbfb1000" } ], "repeated": 0, "id": 1 }, { "timestamp": "2026-05-29 01:05:04,502", "thread_id": "8868", "caller": "0x7fff59fc507d", "parentcaller": "0x7fff59fc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2 }, { "timestamp": "2026-05-29 01:05:04,502", "thread_id": "8868", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7fff1a5f2030" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 3 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b12f2", "parentcaller": "0x7ff6706b13bb", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2465900d000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b1349", "parentcaller": "0x7ff6706b13dc", "category": "hooking", "api": "SetUnhandledExceptionFilter", "status": true, "return": "0x00000001", "arguments": [ { "name": "ExceptionFilter", "value": "0x7ff6706b1b60" } ], "repeated": 0, "id": 5 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8872", "caller": "0x7fff59fc507d", "parentcaller": "0x7fff59fc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 6 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8872", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7fff1a5f1e10" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 7 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8908", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2465900f000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8908", "caller": "0x7fff59fc507d", "parentcaller": "0x7fff59fc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8908", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7fff1a5f1a00" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 10 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "LdrGetDllHandle", "status": false, "return": "0xffffffffc0000135", "pretty_return": "DLL_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\system32\\rpcss.dll" }, { "name": "ModuleHandle", "value": "0x00000206" } ], "repeated": 0, "id": 11 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "0", "pretty_value": "FILE_SUPERSEDE" } ], "repeated": 0, "id": 12 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8860", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7fff1a5f1ed0" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 13 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "93" }, { "name": "ProcessInformation", "value": "\\x7f7\\x9e}" } ], "repeated": 0, "id": 14 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "42" }, { "name": "ThreadInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "8632" } ], "repeated": 0, "id": 15 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "kernel.appcore.dll" } ], "repeated": 0, "id": 16 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\kernel.appcore.dll" } ], "repeated": 0, "id": 17 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000020c" }, { "name": "DesiredAccess", "value": "0x00100021", "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\kernel.appcore.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 18 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000208" }, { "name": "DesiredAccess", "value": "0x0000000d", "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x0000020c" }, { "name": "FileName", "value": "C:\\Windows\\System32\\kernel.appcore.dll" } ], "repeated": 0, "id": 19 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000208" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55510000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00012000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 20 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5551f000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 21 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55515000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 22 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55515000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 23 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55515000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 24 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55515000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 25 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55515000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 26 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000208" } ], "repeated": 0, "id": 27 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000020c" } ], "repeated": 0, "id": 28 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55515000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 29 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\kernel.appcore" }, { "name": "DllBase", "value": "0x7fff55510000" } ], "repeated": 0, "id": 30 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\kernel.appcore" }, { "name": "BaseAddress", "value": "0x7fff55510000" }, { "name": "InitRoutine", "value": "0x7fff55513f10" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 31 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff587d1000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 32 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff587d1000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 33 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "93" }, { "name": "ProcessInformation", "value": "\\x7f7\\x9e}" } ], "repeated": 0, "id": 34 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000200" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "bcryptPrimitives.dll" } ], "repeated": 0, "id": 35 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000200" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57ef0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00082000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 36 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57f57000" }, { "name": "ModuleName", "value": "bcryptPrimitives.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 37 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57f57000" }, { "name": "ModuleName", "value": "bcryptPrimitives.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 38 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57f57000" }, { "name": "ModuleName", "value": "bcryptPrimitives.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 39 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57f57000" }, { "name": "ModuleName", "value": "bcryptPrimitives.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 40 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57f57000" }, { "name": "ModuleName", "value": "bcryptPrimitives.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 41 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000200" } ], "repeated": 0, "id": 42 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57f57000" }, { "name": "ModuleName", "value": "bcryptPrimitives.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 43 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\bcryptPrimitives" }, { "name": "DllBase", "value": "0x7fff57ef0000" } ], "repeated": 0, "id": 44 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000204" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy" } ], "repeated": 0, "id": 45 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000204" }, { "name": "ValueName", "value": "STE" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\STE" } ], "repeated": 0, "id": 46 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000204" } ], "repeated": 0, "id": 47 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000204" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy" } ], "repeated": 0, "id": 48 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000204" }, { "name": "ValueName", "value": "Enabled" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled" } ], "repeated": 0, "id": 49 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000220" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Lsa" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa" } ], "repeated": 0, "id": 50 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000220" }, { "name": "ValueName", "value": "FipsAlgorithmPolicy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy" } ], "repeated": 0, "id": 51 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000204" }, { "name": "ValueName", "value": "MDMEnabled" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\MDMEnabled" } ], "repeated": 0, "id": 52 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000204" } ], "repeated": 0, "id": 53 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000220" } ], "repeated": 0, "id": 54 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "NtOpenKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Policies\\Microsoft\\Cryptography\\Configuration" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Policies\\Microsoft\\Cryptography\\Configuration" } ], "repeated": 0, "id": 55 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000220" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "\\Device\\CNG" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 56 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "device", "api": "DeviceIoControl", "status": true, "return": "0x00000001", "arguments": [ { "name": "DeviceHandle", "value": "0x00000220" }, { "name": "IoControlCode", "value": "0x00390008", "pretty_value": "IOCTL_KSEC_RANDOM_FILL_BUFFER" }, { "name": "InBuffer", "value": "" }, { "name": "OutBuffer", "value": "iIZU\\x18\\x9fjbF\\xaaA\\x9b\\xa8$\\x83\\x92\\xb1\\xb5\\xd2v\\x96\\xd4\\xc6>'t\\xd3\\xaa\\xb1),\\x9d\\x94N\\xcaW_\\xfcFY\\x00\\x89\\x99\\xe7\\xd0\\x05\\xe4\\xa1" } ], "repeated": 0, "id": 57 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\bcryptprimitives" }, { "name": "BaseAddress", "value": "0x7fff57ef0000" }, { "name": "InitRoutine", "value": "0x7fff57f28b60" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 58 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5987e000" }, { "name": "ModuleName", "value": "RPCRT4.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 59 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5987e000" }, { "name": "ModuleName", "value": "RPCRT4.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 60 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24659011000" }, { "name": "RegionSize", "value": "0x00006000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 61 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7fff584a0000" } ], "repeated": 0, "id": 62 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7fff584a0000" }, { "name": "FunctionName", "value": "CLSIDFromOle1Class" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff5854f760" } ], "repeated": 0, "id": 63 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000022c" } ], "repeated": 0, "id": 64 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "20" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 65 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "18" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 66 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xf1\\x0f\\xdc\\xb4\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'\\xc0}\\x1a\\xff\\x7f\\x00\\x00\\xa0\\xbd}\\x1a\\xff\\x7f\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff`\\xf2\\x0f\\xdc\\xb4\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\xc0}\\x1a" } ], "repeated": 0, "id": 67 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000230" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\User\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes" } ], "repeated": 0, "id": 68 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000022c" } ], "repeated": 0, "id": 69 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fb3410" } ], "repeated": 0, "id": 70 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x0000022c" }, { "name": "MutexName", "value": "Local\\SM0:8636:304:WilStaging_02" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 71 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000022c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 72 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 73 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000234" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 74 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 75 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000238" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 76 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000238" } ], "repeated": 0, "id": 77 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000234" } ], "repeated": 0, "id": 78 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000022c" } ], "repeated": 0, "id": 79 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000022c" } ], "repeated": 0, "id": 80 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000022c" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "Global\\__ComCatalogCache__" } ], "repeated": 0, "id": 81 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000022c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2465a9e0000" }, { "name": "SectionOffset", "value": "0xb4dc0ff280" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 82 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\COM3" }, { "name": "Handle", "value": "0x00000234" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\COM3" } ], "repeated": 0, "id": 83 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000234" }, { "name": "ValueName", "value": "Com+Enabled" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\COM3\\Com+Enabled" } ], "repeated": 0, "id": 84 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000234" } ], "repeated": 0, "id": 85 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "93" }, { "name": "ProcessInformation", "value": "\\x7f7\\x9e}" } ], "repeated": 0, "id": 86 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000234" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "clbcatq.dll" } ], "repeated": 0, "id": 87 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000234" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff58b30000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x000a9000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 88 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff58bd4000" }, { "name": "ModuleName", "value": "clbcatq.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 89 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff58ba9000" }, { "name": "ModuleName", "value": "clbcatq.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 90 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff58ba9000" }, { "name": "ModuleName", "value": "clbcatq.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 91 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff58ba9000" }, { "name": "ModuleName", "value": "clbcatq.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 92 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff58ba9000" }, { "name": "ModuleName", "value": "clbcatq.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 93 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff58ba8000" }, { "name": "ModuleName", "value": "clbcatq.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00002000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 94 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000234" } ], "repeated": 0, "id": 95 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff58ba8000" }, { "name": "ModuleName", "value": "clbcatq.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00002000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 96 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\clbcatq" }, { "name": "DllBase", "value": "0x7fff58b30000" } ], "repeated": 0, "id": 97 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "synchronization", "api": "NtOpenEvent", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000238" }, { "name": "EventName", "value": "\\KernelObjects\\MaximumCommitCondition" } ], "repeated": 0, "id": 98 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\clbcatq" }, { "name": "BaseAddress", "value": "0x7fff58b30000" }, { "name": "InitRoutine", "value": "0x7fff58b4d990" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 99 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff587d1000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 100 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff587d1000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 101 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000023c" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "Global\\__ComCatalogCache__" } ], "repeated": 0, "id": 102 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000023c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2465a9f0000" }, { "name": "SectionOffset", "value": "0xb4dc0fefd0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 103 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000232" }, { "name": "SubKey", "value": "AppID\\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" }, { "name": "Handle", "value": "0x00000242" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\AppID\\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" } ], "repeated": 0, "id": 104 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000242" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 105 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000242" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\(Default)" } ], "repeated": 0, "id": 106 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000242" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "Thumbnail Cache Out of Proc Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\(Default)" } ], "repeated": 0, "id": 107 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000242" }, { "name": "ValueName", "value": "LocalService" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\LocalService" } ], "repeated": 0, "id": 108 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000242" }, { "name": "ValueName", "value": "DllSurrogate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\DllSurrogate" } ], "repeated": 0, "id": 109 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000242" }, { "name": "ValueName", "value": "DllSurrogate" }, { "name": "Data", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\DllSurrogate" } ], "repeated": 0, "id": 110 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000242" }, { "name": "ValueName", "value": "RunAs" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\RunAs" } ], "repeated": 0, "id": 111 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000242" }, { "name": "ValueName", "value": "ActivateAtStorage" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ActivateAtStorage" } ], "repeated": 0, "id": 112 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000232" }, { "name": "SubKey", "value": "AppID\\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" }, { "name": "Handle", "value": "0x00000246" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\AppID\\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" } ], "repeated": 0, "id": 113 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000246" }, { "name": "ValueName", "value": "ROTFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ROTFlags" } ], "repeated": 0, "id": 114 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000246" }, { "name": "ValueName", "value": "AppIDFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\AppIDFlags" } ], "repeated": 0, "id": 115 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000246" }, { "name": "ValueName", "value": "MGOTFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\MGOTFlags" } ], "repeated": 0, "id": 116 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000246" }, { "name": "ValueName", "value": "ProcessMitigationPolicy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ProcessMitigationPolicy" } ], "repeated": 0, "id": 117 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000246" } ], "repeated": 0, "id": 118 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000242" }, { "name": "ValueName", "value": "LaunchPermission" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\LaunchPermission" } ], "repeated": 0, "id": 119 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\OLE" }, { "name": "Handle", "value": "0x00000244" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\OLE" } ], "repeated": 0, "id": 120 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000244" }, { "name": "ValueName", "value": "LegacyAuthenticationLevel" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\LegacyAuthenticationLevel" } ], "repeated": 0, "id": 121 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000244" }, { "name": "ValueName", "value": "LegacyImpersonationLevel" }, { "name": "Data", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\LegacyImpersonationLevel" } ], "repeated": 0, "id": 122 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000244" } ], "repeated": 0, "id": 123 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000242" }, { "name": "ValueName", "value": "AuthenticationLevel" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\AuthenticationLevel" } ], "repeated": 0, "id": 124 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000242" }, { "name": "ValueName", "value": "RemoteServerName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\RemoteServerName" } ], "repeated": 0, "id": 125 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000242" }, { "name": "ValueName", "value": "SRPTrustLevel" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\SRPTrustLevel" } ], "repeated": 0, "id": 126 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000242" }, { "name": "ValueName", "value": "PreferredServerBitness" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\PreferredServerBitness" } ], "repeated": 0, "id": 127 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000242" }, { "name": "ValueName", "value": "LoadUserSettings" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\LoadUserSettings" } ], "repeated": 0, "id": 128 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xeb\\x0f\\xdc\\xb4\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00B\\x02\\x00\\x00\\x00\\x00\\x00\\x00PQzX\\xff\\x7f\\x00\\x00" } ], "repeated": 0, "id": 129 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000244" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 130 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000244" }, { "name": "SubKey", "value": "Software\\Classes" }, { "name": "Handle", "value": "0x00000248" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes" } ], "repeated": 0, "id": 131 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000244" } ], "repeated": 0, "id": 132 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegNotifyChangeKeyValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\" }, { "name": "NotifyFilter", "value": "0x10000005" }, { "name": "WatchSubtree", "value": "1" }, { "name": "Asynchronous", "value": "1" } ], "repeated": 0, "id": 133 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000242" }, { "name": "ValueName", "value": "ProtectionLevel" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ProtectionLevel" } ], "repeated": 0, "id": 134 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000242" } ], "repeated": 0, "id": 135 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff587d1000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 136 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff587d1000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 137 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 138 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24659017000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 139 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlRegisterFeatureConfigurationChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59f593b0" } ], "repeated": 0, "id": 140 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "NtQueryWnfStateData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fefc40" } ], "repeated": 0, "id": 141 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlSubscribeWnfStateChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59f92460" } ], "repeated": 0, "id": 142 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlQueryFeatureConfiguration" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59facbd0" } ], "repeated": 0, "id": 143 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "164" } ], "repeated": 0, "id": 144 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000024c" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx" } ], "repeated": 0, "id": 145 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000024c" }, { "name": "ValueName", "value": "AllowDevelopmentWithoutDevLicense" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx\\AllowDevelopmentWithoutDevLicense" } ], "repeated": 0, "id": 146 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000024c" } ], "repeated": 0, "id": 147 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000024c" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock" } ], "repeated": 0, "id": 148 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000024c" }, { "name": "ValueName", "value": "AllowDevelopmentWithoutDevLicense" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock\\AllowDevelopmentWithoutDevLicense" } ], "repeated": 0, "id": 149 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000024c" } ], "repeated": 0, "id": 150 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 151 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlRegisterFeatureConfigurationChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59f593b0" } ], "repeated": 0, "id": 152 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "NtQueryWnfStateData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fefc40" } ], "repeated": 0, "id": 153 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlSubscribeWnfStateChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59f92460" } ], "repeated": 0, "id": 154 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDisownModuleHeapAllocation" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fcfa30" } ], "repeated": 0, "id": 155 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlQueryFeatureConfiguration" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59facbd0" } ], "repeated": 0, "id": 156 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24659019000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 157 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\OLE\\AppCompat" }, { "name": "Handle", "value": "0x0000024c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\OLE\\AppCompat" } ], "repeated": 0, "id": 158 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000024c" }, { "name": "ValueName", "value": "RaiseActivationAuthenticationLevel" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\AppCompat\\RaiseActivationAuthenticationLevel" } ], "repeated": 0, "id": 159 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000024c" } ], "repeated": 0, "id": 160 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000024c" } ], "repeated": 0, "id": 161 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "20" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 162 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "18" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 163 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xc0\\xe9\\x0f\\xdc\\xb4\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'\\xc0}\\x1a\\xff\\x7f\\x00\\x00\\xa0\\xbd}\\x1a\\xff\\x7f\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xffp\\xea\\x0f\\xdc\\xb4\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\xc0}\\x1a" } ], "repeated": 0, "id": 164 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000250" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\User\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes" } ], "repeated": 0, "id": 165 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000024c" } ], "repeated": 0, "id": 166 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000252" }, { "name": "SubKey", "value": "AppID\\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" }, { "name": "Handle", "value": "0x0000024e" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\AppID\\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" } ], "repeated": 0, "id": 167 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000024e" }, { "name": "ValueName", "value": "AuthenticationLevel" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\AuthenticationLevel" } ], "repeated": 0, "id": 168 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\OLE\\AppCompat" }, { "name": "Handle", "value": "0x00000254" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\OLE\\AppCompat" } ], "repeated": 0, "id": 169 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000254" }, { "name": "ValueName", "value": "RaiseDefaultAuthnLevel" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\AppCompat\\RaiseDefaultAuthnLevel" } ], "repeated": 0, "id": 170 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000254" } ], "repeated": 0, "id": 171 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000024e" }, { "name": "ValueName", "value": "AccessPermission" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\AccessPermission" } ], "repeated": 0, "id": 172 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000024e" } ], "repeated": 0, "id": 173 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\OLE" }, { "name": "Handle", "value": "0x0000024c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OLE" } ], "repeated": 0, "id": 174 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000024c" }, { "name": "ValueName", "value": "DefaultAccessPermission" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\DefaultAccessPermission" } ], "repeated": 0, "id": 175 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000254" } ], "repeated": 0, "id": 176 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 177 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\x00]\\x01YF\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00" } ], "repeated": 0, "id": 178 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000254" } ], "repeated": 0, "id": 179 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "LdrGetDllHandle", "status": false, "return": "0xffffffffc0000135", "pretty_return": "DLL_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\system32\\rpcss.dll" }, { "name": "ModuleHandle", "value": "0x00002100" } ], "repeated": 0, "id": 180 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000024c" } ], "repeated": 0, "id": 181 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xef\\x0f\\xdc\\xb4\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00\\xb3\\x06iKL\\x93\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 182 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff587d1000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 183 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff587d1000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 184 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 185 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000254" } ], "repeated": 0, "id": 186 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff587d1000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 187 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff587d1000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 188 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 189 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "synchronization", "api": "NtOpenEvent", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "Handle", "value": "0x000021bc" }, { "name": "EventName", "value": "MSFT.VSA.COM.DISABLE.8636" } ], "repeated": 0, "id": 190 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "synchronization", "api": "NtOpenEvent", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "Handle", "value": "0x00000000" }, { "name": "EventName", "value": "MSFT.VSA.IEC.STATUS.6c736db0" } ], "repeated": 0, "id": 191 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2465901b000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 192 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2465901c000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 193 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000252" }, { "name": "SubKey", "value": "Interface\\{00000134-0000-0000-C000-000000000046}" }, { "name": "Handle", "value": "0x00000262" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{00000134-0000-0000-C000-000000000046}" } ], "repeated": 0, "id": 194 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000262" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x00000266" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{00000134-0000-0000-C000-000000000046}\\ProxyStubClsid32" } ], "repeated": 0, "id": 195 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000266" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{00000320-0000-0000-C000-000000000046}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{00000134-0000-0000-C000-000000000046}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 196 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000266" } ], "repeated": 0, "id": 197 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000262" } ], "repeated": 0, "id": 198 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2465901e000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 199 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000260" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\MACHINE\\Software\\Microsoft\\Rpc\\Extensions" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Rpc\\Extensions" } ], "repeated": 0, "id": 200 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000260" }, { "name": "ValueName", "value": "NdrOleExtDLL" }, { "name": "Type", "value": "2", "pretty_value": "REG_EXPAND_SZ" }, { "name": "Information", "value": "combase.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Rpc\\Extensions\\NdrOleExtDLL" } ], "repeated": 0, "id": 201 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000260" } ], "repeated": 0, "id": 202 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7fff584a0000" } ], "repeated": 0, "id": 203 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7fff584a0000" }, { "name": "FunctionName", "value": "NdrOleInitializeExtension" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff58574240" } ], "repeated": 0, "id": 204 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7fff584a0000" }, { "name": "FunctionName", "value": "CoMarshalInterface" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff5851b0b0" } ], "repeated": 0, "id": 205 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7fff584a0000" }, { "name": "FunctionName", "value": "CoUnmarshalInterface" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff58518b50" } ], "repeated": 0, "id": 206 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7fff584a0000" }, { "name": "FunctionName", "value": "StringFromIID" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff58549780" } ], "repeated": 0, "id": 207 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7fff584a0000" }, { "name": "FunctionName", "value": "CoTaskMemAlloc" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff58552e80" } ], "repeated": 0, "id": 208 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7fff584a0000" }, { "name": "FunctionName", "value": "CoTaskMemFree" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff58551b70" } ], "repeated": 0, "id": 209 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7fff584a0000" }, { "name": "FunctionName", "value": "CoCreateInstance" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff584ca420" } ], "repeated": 0, "id": 210 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7fff584a0000" }, { "name": "FunctionName", "value": "CoReleaseMarshalData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff584ce790" } ], "repeated": 0, "id": 211 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 212 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000260" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 213 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000264" } ], "repeated": 0, "id": 214 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "A^\\x08\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 215 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\x08\\xb6\\x00YF\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\\\x00c\\x00m\\x00d\\x00.\\x00e\\x00x\\x00e\\x00\\x00\\x00D\\x00r\\x00i\\x00v\\x00e\\x00r\\x00D\\x00a\\x00t\\x00a\\x00=\\x00C\\x00:\\x00\\\\x00W\\x00i\\x00n\\x00" } ], "repeated": 0, "id": 216 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "0\\xb4\\x00YF\\x02\\x00\\x00`\\x00\\x00\\x00=\\x00C\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00s\\x00\\\\x00a\\x00d\\x00m\\x00i\\x00n\\x00\\\\x00A\\x00p\\x00p\\x00D\\x00a\\x00t\\x00a\\x00\\\\x00R\\x00o\\x00a\\x00m\\x00i\\x00n\\x00g\\x00\\x00\\x00C\\x00o\\x00m\\x00m\\x00" } ], "repeated": 0, "id": 217 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 218 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xd8a\\x01YF\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 219 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 220 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xe8\\xb7\\x00YF\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 221 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x81\\x1a\\xff\\x7f\\x00\\x00\\xebPY\\x1a\\xff\\x7f\\x00\\x00#0iKL\\x93\\x00\\x00(N}\\x1a\\xff\\x7f\\x00\\x000\\xe5\\x0f\\xdc\\xb4\\x00\\x00\\x00(\\xe5\\x0f\\xdc\\xb4\\x00\\x00\\x00\\xf8\\xe4\\x0f\\xdc\\xb4\\x00\\x00\\x00\\x18\\xe5\\x0f\\xdc" } ], "repeated": 0, "id": 222 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xb7\\x00YF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8Z\\x1a\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x18\\xe3\\x0f\\xdc\\xb4\\x00\\x00\\x00d\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2}\\x1a" } ], "repeated": 0, "id": 223 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "A^\\x08\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 224 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "h\\xb6\\x00YF\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00e\\x00r\\x00s\\x00o\\x00n\\x00a\\x00t\\x00i\\x00o\\x00n\\x00 \\x00D\\x00y\\x00n\\x00a\\x00m\\x00i\\x00c\\x00 \\x00F\\x00a\\x00l\\x00s\\x00e\\x00\\x00\\x00P\\x00" } ], "repeated": 0, "id": 225 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\x90\\xb7\\x00YF\\x02\\x00\\x00`\\x00\\x00\\x00\\xadU?\\xac\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\xeb\\x1c\\xc9\\x11\\x9f\\xe8\\x08\\x00+\\x10H`\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xba\\x00YF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 226 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 227 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xa8a\\x01YF\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 228 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 229 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "h\\xb9\\x00YF\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 230 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x81\\x1a\\xff\\x7f\\x00\\x00\\xebPY\\x1a\\xff\\x7f\\x00\\x00\\x835iKL\\x93\\x00\\x00(N}\\x1a\\xff\\x7f\\x00\\x00\\x90\\xe1\\x0f\\xdc\\xb4\\x00\\x00\\x00\\x88\\xe1\\x0f\\xdc\\xb4\\x00\\x00\\x00X\\xe1\\x0f\\xdc\\xb4\\x00\\x00\\x00x\\xe1\\x0f\\xdc" } ], "repeated": 0, "id": 231 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xb9\\x00YF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8Z\\x1a\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00x\\xdf\\x0f\\xdc\\xb4\\x00\\x00\\x00d\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2}\\x1a" } ], "repeated": 0, "id": 232 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000260" } ], "repeated": 0, "id": 233 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000264" } ], "repeated": 0, "id": 234 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "misc", "api": "GetSystemInfo", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 235 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7fff584a0000" } ], "repeated": 0, "id": 236 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "threading", "api": "NtCreateThreadEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00000268" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartAddress", "value": "0x7fff58542d30" }, { "name": "Parameter", "value": "0x24659008240" }, { "name": "CreateFlags", "value": "0x00000001" }, { "name": "ThreadId", "value": "9012" }, { "name": "ProcessId", "value": "8636" }, { "name": "Module", "value": "combase.dll" } ], "repeated": 0, "id": 237 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x00000268", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x7fff58542d30" }, { "name": "Parameter", "value": "0x24659008240" }, { "name": "CreationFlags", "value": "0x00000000" }, { "name": "ThreadId", "value": "9012" }, { "name": "ProcessId", "value": "8636" } ], "repeated": 0, "id": 238 }, { "timestamp": "2026-05-29 01:05:04,518", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000268" } ], "repeated": 0, "id": 239 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 240 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000268" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 241 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9012", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7fff58542d30" }, { "name": "Parameter", "value": "0x24659008240" } ], "repeated": 0, "id": 242 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000274" } ], "repeated": 0, "id": 243 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "A^\\x08\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 244 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\x98\\xa4\\x00YF\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00 \\x0e\\x00\\x00\\x01\\x00\\x00\\x000\\x0e\\x00\\x00\\x01\\x00\\x00\\x00(\\x0e\\x00\\x00\\x01\\x00\\x00\\x008\\x0e\\x00\\x00\\x02\\x00\\x00\\x00\\xa0\\x1d\\x00\\x00\\x02\\x00\\x00\\x00\\xa8\\x1d\\x00\\x00\\x02\\x00\\x00" } ], "repeated": 0, "id": 245 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "@\\xa1\\x00YF\\x02\\x00\\x00`\\x00\\x00\\x00\\x00@#\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00`#\\x00\\x00\\x02\\x00\\x00\\x00h#\\x00\\x00\\x03\\x00\\x00\\x00\\xa86\\x00\\x00\\x03\\x00\\x00\\x00\\x906\\x00\\x00\\x03\\x00\\x00\\x00\\x986\\x00\\x00\n\\x00\\x00\\x00\\x08>\\x00\\x00\n\\x00\\x00\\x00\\x10>\\x00\\x00\n\\x00\\x00" } ], "repeated": 0, "id": 246 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 247 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xa8^\\x01YF\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 248 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 249 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "8\\xa7\\x00YF\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 250 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x81\\x1a\\xff\\x7f\\x00\\x00\\xebPY\\x1a\\xff\\x7f\\x00\\x00\\x13\\x0ciKL\\x93\\x00\\x00(N}\\x1a\\xff\\x7f\\x00\\x00\\x00\\xe9\\x0f\\xdc\\xb4\\x00\\x00\\x00\\xf8\\xe8\\x0f\\xdc\\xb4\\x00\\x00\\x00\\xc8\\xe8\\x0f\\xdc\\xb4\\x00\\x00\\x00\\xe8\\xe8\\x0f\\xdc" } ], "repeated": 0, "id": 251 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xa7\\x00YF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8Z\\x1a\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xe6\\x0f\\xdc\\xb4\\x00\\x00\\x00t\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2}\\x1a" } ], "repeated": 0, "id": 252 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "A^\\x08\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 253 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\xf8\\xa4\\x00YF\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\xd0/\\x00\\x00\n\\x00\\x00\\x0009\\x00\\x00\n\\x00\\x00\\x0089\\x00\\x00\n\\x00\\x00\\x00@9\\x00\\x00\n\\x00\\x00\\x00H9\\x00\\x00\\x06\\x00\\x00\\x00/\\x16\\x00\\x00\\x01\\x00\\x00" } ], "repeated": 0, "id": 254 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "`\\xa5\\x00YF\\x02\\x00\\x00`\\x00\\x00\\x00\\x00h\\x0e\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x08\\x1e\\x00\\x00\\x02\\x00\\x00\\x00 \\x1e\\x00\\x00\\x02\\x00\\x00\\x00(\\x1e\\x00\\x00\\x02\\x00\\x00\\x00@\\x1e\\x00\\x00\\x02\\x00\\x00\\x00H\\x1e\\x00\\x00\\x02\\x00\\x00\\x00`\\x1e\\x00\\x00\\x02\\x00\\x00\\x00h\\x1e\\x00\\x00\\x03\\x00\\x00" } ], "repeated": 0, "id": 255 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 256 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xd8^\\x01YF\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 257 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 258 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\x98\\xa1\\x00YF\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 259 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x81\\x1a\\xff\\x7f\\x00\\x00\\xebPY\\x1a\\xff\\x7f\\x00\\x00s0iKL\\x93\\x00\\x00(N}\\x1a\\xff\\x7f\\x00\\x00`\\xe5\\x0f\\xdc\\xb4\\x00\\x00\\x00X\\xe5\\x0f\\xdc\\xb4\\x00\\x00\\x00(\\xe5\\x0f\\xdc\\xb4\\x00\\x00\\x00H\\xe5\\x0f\\xdc" } ], "repeated": 0, "id": 260 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xa1\\x00YF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8Z\\x1a\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00H\\xe3\\x0f\\xdc\\xb4\\x00\\x00\\x00t\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2}\\x1a" } ], "repeated": 0, "id": 261 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000268" } ], "repeated": 0, "id": 262 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000274" } ], "repeated": 0, "id": 263 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 264 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000274" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 265 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000268" } ], "repeated": 0, "id": 266 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "A^\\x08\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 267 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\x98\\xa4\\x00YF\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00 \\x0e\\x00\\x00\\x01\\x00\\x00\\x000\\x0e\\x00\\x00\\x01\\x00\\x00\\x00(\\x0e\\x00\\x00\\x01\\x00\\x00\\x008\\x0e\\x00\\x00\\x02\\x00\\x00\\x00\\xa0\\x1d\\x00\\x00\\x02\\x00\\x00\\x00\\xa8\\x1d\\x00\\x00\\x02\\x00\\x00" } ], "repeated": 0, "id": 268 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\x00\\xa2\\x00YF\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\xa8\\x10\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x88#\\x00\\x00\\x02\\x00\\x00\\x00\\xa0#\\x00\\x00\\x02\\x00\\x00\\x00\\xa8#\\x00\\x00\\x02\\x00\\x00\\x00\\xc0#\\x00\\x00\\x02\\x00\\x00\\x00\\xc8#\\x00\\x00\\x03\\x00\\x00\\x00\\x187\\x00\\x00\\x03\\x00\\x00\\x00\\x007\\x00\\x00\\x03\\x00\\x00" } ], "repeated": 0, "id": 269 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 270 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "Xc\\x01YF\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 271 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 272 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xb8\\xa5\\x00YF\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 273 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x81\\x1a\\xff\\x7f\\x00\\x00\\xebPY\\x1a\\xff\\x7f\\x00\\x00\\x13\\x0ciKL\\x93\\x00\\x00(N}\\x1a\\xff\\x7f\\x00\\x00\\x00\\xe9\\x0f\\xdc\\xb4\\x00\\x00\\x00\\xf8\\xe8\\x0f\\xdc\\xb4\\x00\\x00\\x00\\xc8\\xe8\\x0f\\xdc\\xb4\\x00\\x00\\x00\\xe8\\xe8\\x0f\\xdc" } ], "repeated": 0, "id": 274 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\xa5\\x00YF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8Z\\x1a\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xe6\\x0f\\xdc\\xb4\\x00\\x00\\x00h\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2}\\x1a" } ], "repeated": 0, "id": 275 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "A^\\x08\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 276 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\xd8\\xa3\\x00YF\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\n\\x00\\x00\\x00\\xf88\\x00\\x00\\x06\\x00\\x00\\x00\\xd5\\x15\\x00\\x00\\x01\\x00\\x00\\x00\\xe8\r\\x00\\x00\\x01\\x00\\x00\\x00\\xf0\r\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x0e\\x00\\x00\\x01\\x00\\x00\\x00\\xf8\r\\x00\\x00\\x01\\x00\\x00" } ], "repeated": 0, "id": 277 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xa0\\xa1\\x00YF\\x02\\x00\\x00`\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 278 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 279 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "hb\\x01YF\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 280 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 281 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "x\\xa6\\x00YF\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 282 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x81\\x1a\\xff\\x7f\\x00\\x00\\xebPY\\x1a\\xff\\x7f\\x00\\x00s0iKL\\x93\\x00\\x00(N}\\x1a\\xff\\x7f\\x00\\x00`\\xe5\\x0f\\xdc\\xb4\\x00\\x00\\x00X\\xe5\\x0f\\xdc\\xb4\\x00\\x00\\x00(\\xe5\\x0f\\xdc\\xb4\\x00\\x00\\x00H\\xe5\\x0f\\xdc" } ], "repeated": 0, "id": 283 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xa6\\x00YF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8Z\\x1a\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00H\\xe3\\x0f\\xdc\\xb4\\x00\\x00\\x00h\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2}\\x1a" } ], "repeated": 0, "id": 284 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000274" } ], "repeated": 0, "id": 285 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000268" } ], "repeated": 0, "id": 286 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 287 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000268" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 288 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000274" } ], "repeated": 0, "id": 289 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "A^\\x08\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 290 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\x18\\xa3\\x00YF\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\n\\x00\\x00\\x00\\xb88\\x00\\x00\n\\x00\\x00\\x00\\xc08\\x00\\x00\n\\x00\\x00\\x00\\xc88\\x00\\x00\n\\x00\\x00\\x00\\xd08\\x00\\x00\\x06\\x00\\x00\\x00\\x9b\\x15\\x00\\x00\\x06\\x00\\x00\\x00\\xa4\\x15\\x00\\x00\\x06\\x00\\x00" } ], "repeated": 0, "id": 291 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xa0\\xa4\\x00YF\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00 \\x0e\\x00\\x00\\x01\\x00\\x00\\x000\\x0e\\x00\\x00\\x01\\x00\\x00\\x00(\\x0e\\x00\\x00\\x01\\x00\\x00\\x008\\x0e\\x00\\x00\\x02\\x00\\x00\\x00\\xa0\\x1d\\x00\\x00\\x02\\x00\\x00\\x00\\xa8\\x1d\\x00\\x00\\x02\\x00\\x00\\x00\\xc0\\x1d\\x00\\x00\\x02\\x00\\x00" } ], "repeated": 0, "id": 292 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 293 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "Xc\\x01YF\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 294 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 295 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xd8\\xa3\\x00YF\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 296 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x81\\x1a\\xff\\x7f\\x00\\x00\\xebPY\\x1a\\xff\\x7f\\x00\\x00\\x13\\x0ciKL\\x93\\x00\\x00(N}\\x1a\\xff\\x7f\\x00\\x00\\x00\\xe9\\x0f\\xdc\\xb4\\x00\\x00\\x00\\xf8\\xe8\\x0f\\xdc\\xb4\\x00\\x00\\x00\\xc8\\xe8\\x0f\\xdc\\xb4\\x00\\x00\\x00\\xe8\\xe8\\x0f\\xdc" } ], "repeated": 0, "id": 297 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xa3\\x00YF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8Z\\x1a\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xe6\\x0f\\xdc\\xb4\\x00\\x00\\x00t\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2}\\x1a" } ], "repeated": 0, "id": 298 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "A^\\x08\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 299 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "8\\xa1\\x00YF\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x000\\x00\\x00\\x00`#\\x00\\x00\\x02\\x00\\x00\\x00h#\\x00\\x00\\x03\\x00\\x00\\x00\\xa86\\x00\\x00\\x03\\x00\\x00\\x00\\x906\\x00\\x00\\x03\\x00\\x00\\x00\\x986\\x00\\x00\n\\x00\\x00\\x00\\x08>\\x00\\x00\n\\x00\\x00" } ], "repeated": 0, "id": 300 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\x00\\xa5\\x00YF\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\xd0/\\x00\\x00\n\\x00\\x00\\x0009\\x00\\x00\n\\x00\\x00\\x0089\\x00\\x00\n\\x00\\x00\\x00@9\\x00\\x00\n\\x00\\x00\\x00H9\\x00\\x00\\x06\\x00\\x00\\x00/\\x16\\x00\\x00\\x01\\x00\\x00\\x00H\\x0e\\x00\\x00\\x01\\x00\\x00" } ], "repeated": 0, "id": 301 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 302 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xb8c\\x01YF\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 303 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 304 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\x98\\xa7\\x00YF\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 305 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x81\\x1a\\xff\\x7f\\x00\\x00\\xebPY\\x1a\\xff\\x7f\\x00\\x00s0iKL\\x93\\x00\\x00(N}\\x1a\\xff\\x7f\\x00\\x00`\\xe5\\x0f\\xdc\\xb4\\x00\\x00\\x00X\\xe5\\x0f\\xdc\\xb4\\x00\\x00\\x00(\\xe5\\x0f\\xdc\\xb4\\x00\\x00\\x00H\\xe5\\x0f\\xdc" } ], "repeated": 0, "id": 306 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xa7\\x00YF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8Z\\x1a\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00H\\xe3\\x0f\\xdc\\xb4\\x00\\x00\\x00t\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2}\\x1a" } ], "repeated": 0, "id": 307 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24659020000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 308 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000268" } ], "repeated": 0, "id": 309 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000274" } ], "repeated": 0, "id": 310 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 311 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000274" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 312 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000268" } ], "repeated": 0, "id": 313 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "A^\\x08\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 314 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "8\\xa1\\x00YF\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x000\\x00\\x00\\x00`#\\x00\\x00\\x02\\x00\\x00\\x00h#\\x00\\x00\\x03\\x00\\x00\\x00\\xa86\\x00\\x00\\x03\\x00\\x00\\x00\\x906\\x00\\x00\\x03\\x00\\x00\\x00\\x986\\x00\\x00\n\\x00\\x00\\x00\\x08>\\x00\\x00\n\\x00\\x00" } ], "repeated": 0, "id": 315 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xa0\\xa1\\x00YF\\x02\\x00\\x00`\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 316 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 317 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xa8^\\x01YF\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 318 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 319 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xd8\\xa3\\x00YF\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 320 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x81\\x1a\\xff\\x7f\\x00\\x00\\xebPY\\x1a\\xff\\x7f\\x00\\x00\\x13\\x0ciKL\\x93\\x00\\x00(N}\\x1a\\xff\\x7f\\x00\\x00\\x00\\xe9\\x0f\\xdc\\xb4\\x00\\x00\\x00\\xf8\\xe8\\x0f\\xdc\\xb4\\x00\\x00\\x00\\xc8\\xe8\\x0f\\xdc\\xb4\\x00\\x00\\x00\\xe8\\xe8\\x0f\\xdc" } ], "repeated": 0, "id": 321 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xa3\\x00YF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8Z\\x1a\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xe6\\x0f\\xdc\\xb4\\x00\\x00\\x00h\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2}\\x1a" } ], "repeated": 0, "id": 322 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "A^\\x08\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 323 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\xb8\\xa5\\x00YF\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05" } ], "repeated": 0, "id": 324 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\x80\\xa0\\x00YF\\x02\\x00\\x00`\\x00\\x00\\x00\\x00@\\x10\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00H\\x10\\x00\\x00\\x02\\x00\\x00\\x00\\xc0\"\\x00\\x00\\x02\\x00\\x00\\x00\\xc8\"\\x00\\x00\\x02\\x00\\x00\\x00\\xe0\"\\x00\\x00\\x02\\x00\\x00\\x00\\xe8\"\\x00\\x00\\x02\\x00\\x00\\x00\\x00#\\x00\\x00\\x02\\x00\\x00\\x00\\x08#\\x00\\x00\\x03\\x00\\x00" } ], "repeated": 0, "id": 325 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 326 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xa8a\\x01YF\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 327 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 328 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xd8\\xa0\\x00YF\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 329 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x81\\x1a\\xff\\x7f\\x00\\x00\\xebPY\\x1a\\xff\\x7f\\x00\\x00s0iKL\\x93\\x00\\x00(N}\\x1a\\xff\\x7f\\x00\\x00`\\xe5\\x0f\\xdc\\xb4\\x00\\x00\\x00X\\xe5\\x0f\\xdc\\xb4\\x00\\x00\\x00(\\xe5\\x0f\\xdc\\xb4\\x00\\x00\\x00H\\xe5\\x0f\\xdc" } ], "repeated": 0, "id": 330 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xa0\\x00YF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8Z\\x1a\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00H\\xe3\\x0f\\xdc\\xb4\\x00\\x00\\x00h\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2}\\x1a" } ], "repeated": 0, "id": 331 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000274" } ], "repeated": 0, "id": 332 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000268" } ], "repeated": 0, "id": 333 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 334 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9008", "caller": "0x7fff59fc507d", "parentcaller": "0x7fff59fc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 335 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9008", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7fff59fa2b30" }, { "name": "Parameter", "value": "0x24658fe0b50" } ], "repeated": 0, "id": 336 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9008", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5978ef53", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000284" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 337 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9008", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24659021000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 338 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9004", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24659023000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 339 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7fff584a0000" } ], "repeated": 0, "id": 340 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9004", "caller": "0x7fff59fc507d", "parentcaller": "0x7fff59fc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 341 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9004", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7fff59fa2b30" }, { "name": "Parameter", "value": "0x24658fe0b50" } ], "repeated": 0, "id": 342 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "threading", "api": "NtCreateThreadEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x0000028c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartAddress", "value": "0x7fff58542d30" }, { "name": "Parameter", "value": "0x24659007600" }, { "name": "CreateFlags", "value": "0x00000001" }, { "name": "ThreadId", "value": "9000" }, { "name": "ProcessId", "value": "8636" }, { "name": "Module", "value": "combase.dll" } ], "repeated": 0, "id": 343 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x0000028c", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x7fff58542d30" }, { "name": "Parameter", "value": "0x24659007600" }, { "name": "CreationFlags", "value": "0x00000000" }, { "name": "ThreadId", "value": "9000" }, { "name": "ProcessId", "value": "8636" } ], "repeated": 0, "id": 344 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000028c" } ], "repeated": 0, "id": 345 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000268" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 346 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9000", "caller": "0x7fff59fc507d", "parentcaller": "0x7fff59fc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 347 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9000", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7fff58542d30" }, { "name": "Parameter", "value": "0x24659007600" } ], "repeated": 0, "id": 348 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9000", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24659024000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 349 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9000", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff587d1000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 350 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9000", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff587d1000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 351 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9000", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff581d2b57", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\uxtheme" }, { "name": "DllBase", "value": "0x7fff54fc0000" } ], "repeated": 0, "id": 352 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9000", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff581d2b57", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\uxtheme.dll" }, { "name": "BaseAddress", "value": "0x7fff54fc0000" } ], "repeated": 0, "id": 353 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9000", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff581d2b57", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff54fc0000", "arguments": [ { "name": "lpLibFileName", "value": "C:\\Windows\\system32\\uxtheme.dll" }, { "name": "dwFlags", "value": "0x00000008" } ], "repeated": 0, "id": 354 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9000", "caller": "0x7fff577dac31", "parentcaller": "0x7fff581d2bbb", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "uxtheme.dll" }, { "name": "ModuleHandle", "value": "0x7fff54fc0000" }, { "name": "FunctionName", "value": "ThemeInitApiHook" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff54fccde0" } ], "repeated": 0, "id": 355 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9000", "caller": "0x7fff54fcce20", "parentcaller": "0x7fff581d2d8c", "category": "system", "api": "IsDebuggerPresent", "status": false, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 356 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9000", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff59f667b5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "p\\xe9\\xbf\\xdc\\xb4\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 357 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9000", "caller": "0x7fff59f667ec", "parentcaller": "0x7fff577b5140", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 358 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 359 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9000", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002a4" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" } ], "repeated": 0, "id": 360 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9000", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff54ffd921", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a8" }, { "name": "ValueName", "value": "AppsUseLightTheme" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\\AppsUseLightTheme" } ], "repeated": 0, "id": 361 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9000", "caller": "0x7fff577d3018", "parentcaller": "0x7fff54ffd921", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a8" } ], "repeated": 0, "id": 362 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9000", "caller": "0x7fff54fcd96c", "parentcaller": "0x7fff54fcd1d1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a4" } ], "repeated": 0, "id": 363 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9000", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5978ef53", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000002ac" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 364 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9000", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24659028000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 365 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9000", "caller": "0x7fff59f93f7a", "parentcaller": "0x7fff59770ed7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 366 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9000", "caller": "0x7fff59770cd1", "parentcaller": "0x7fff5976f28f", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x000002b0" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 367 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9000", "caller": "0x7fff5781026b", "parentcaller": "0x7fff59770daf", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000002b4" } ], "repeated": 0, "id": 368 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9000", "caller": "0x7fff59f88cde", "parentcaller": "0x7fff59fc9c4e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "A^\\x08\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 369 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9000", "caller": "0x7fff59fb6e46", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "X\\xa2\\x00YF\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x03\\x00\\x00\\x00P7\\x00\\x00\\x03\\x00\\x00\\x0087\\x00\\x00\\x03\\x00\\x00\\x00@7\\x00\\x00\n\\x00\\x00\\x00\\x80>\\x00\\x00\n\\x00\\x00\\x00\\x88>\\x00\\x00\n\\x00\\x00\\x00\\x90>\\x00\\x00\n\\x00\\x00" } ], "repeated": 0, "id": 370 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9000", "caller": "0x7fff59fb6e9b", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\x80\\xa6\\x00YF\\x02\\x00\\x00`\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 371 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9000", "caller": "0x7fff59fb6ec0", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 372 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9000", "caller": "0x7fff59fb6f0e", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\x08_\\x01YF\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 373 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9000", "caller": "0x7fff59fb6f37", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 374 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9000", "caller": "0x7fff59fb6f8f", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xf8\\xa1\\x00YF\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 375 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9000", "caller": "0x7fff59fb7048", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x81\\x1a\\xff\\x7f\\x00\\x00\\xebPY\\x1a\\xff\\x7f\\x00\\x00c\\x0e\\xd9KL\\x93\\x00\\x00(N}\\x1a\\xff\\x7f\\x00\\x00p\\xeb\\xbf\\xdc\\xb4\\x00\\x00\\x00h\\xeb\\xbf\\xdc\\xb4\\x00\\x00\\x008\\xeb\\xbf\\xdc\\xb4\\x00\\x00\\x00X\\xeb\\xbf\\xdc" } ], "repeated": 0, "id": 376 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9000", "caller": "0x7fff59fb707b", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xa1\\x00YF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8Z\\x1a\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00X\\xe9\\xbf\\xdc\\xb4\\x00\\x00\\x00\\xb4\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2}\\x1a" } ], "repeated": 0, "id": 377 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9000", "caller": "0x7fff59f88cde", "parentcaller": "0x7fff59f8953a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "A^\\x08\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 378 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9000", "caller": "0x7fff59fb6e46", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\x18\\xa3\\x00YF\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\n\\x00\\x00\\x00\\xb88\\x00\\x00\n\\x00\\x00\\x00\\xc08\\x00\\x00\n\\x00\\x00\\x00\\xc88\\x00\\x00\n\\x00\\x00\\x00\\xd08\\x00\\x00\\x06\\x00\\x00\\x00\\x9b\\x15\\x00\\x00\\x06\\x00\\x00\\x00\\xa4\\x15\\x00\\x00\\x06\\x00\\x00" } ], "repeated": 0, "id": 379 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9000", "caller": "0x7fff59fb6e9b", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xc0\\xa2\\x00YF\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\xa8>\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\xb8>\\x00\\x00\n\\x00\\x00\\x00\\xc0>\\x00\\x00\\x06\\x00\\x00\\x00X\\x19\\x00\\x00\\x06\\x00\\x00\\x00a\\x19\\x00\\x00\\x06\\x00\\x00\\x00j\\x19\\x00\\x00\n\\x00\\x00\\x00\\x908\\x00\\x00\n\\x00\\x00\\x00\\x988\\x00\\x00\n\\x00\\x00" } ], "repeated": 0, "id": 380 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9000", "caller": "0x7fff59fb6ec0", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 381 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9000", "caller": "0x7fff59fb6f0e", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xd8^\\x01YF\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 382 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9000", "caller": "0x7fff59fb6f37", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 383 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9000", "caller": "0x7fff59fb6f8f", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xd8\\xa6\\x00YF\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 384 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9000", "caller": "0x7fff59fb7048", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x81\\x1a\\xff\\x7f\\x00\\x00\\xebPY\\x1a\\xff\\x7f\\x00\\x00\\xc33\\xd9KL\\x93\\x00\\x00(N}\\x1a\\xff\\x7f\\x00\\x00\\xd0\\xe7\\xbf\\xdc\\xb4\\x00\\x00\\x00\\xc8\\xe7\\xbf\\xdc\\xb4\\x00\\x00\\x00\\x98\\xe7\\xbf\\xdc\\xb4\\x00\\x00\\x00\\xb8\\xe7\\xbf\\xdc" } ], "repeated": 0, "id": 385 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9000", "caller": "0x7fff59fb707b", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xa6\\x00YF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8Z\\x1a\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xb8\\xe5\\xbf\\xdc\\xb4\\x00\\x00\\x00\\xb4\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2}\\x1a" } ], "repeated": 0, "id": 386 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff59770e27", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b0" } ], "repeated": 0, "id": 387 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff59770e49", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b4" } ], "repeated": 0, "id": 388 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9000", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2465902a000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 389 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 390 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x000002b4" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 391 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000002b0" } ], "repeated": 0, "id": 392 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "A^\\x08\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 393 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "x\\xa0\\x00YF\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x000\\x00\\x00\\x00H\\x10\\x00\\x00\\x02\\x00\\x00\\x00\\xc0\"\\x00\\x00\\x02\\x00\\x00\\x00\\xc8\"\\x00\\x00\\x02\\x00\\x00\\x00\\xe0\"\\x00\\x00\\x02\\x00\\x00\\x00\\xe8\"\\x00\\x00\\x02\\x00\\x00\\x00\\x00#\\x00\\x00\\x02\\x00\\x00" } ], "repeated": 0, "id": 394 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\x00\\xa2\\x00YF\\x02\\x00\\x00`\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 395 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 396 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "hb\\x01YF\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 397 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 398 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "X\\xa2\\x00YF\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 399 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x81\\x1a\\xff\\x7f\\x00\\x00\\xebPY\\x1a\\xff\\x7f\\x00\\x00C1iKL\\x93\\x00\\x00(N}\\x1a\\xff\\x7f\\x00\\x00P\\xe6\\x0f\\xdc\\xb4\\x00\\x00\\x00H\\xe6\\x0f\\xdc\\xb4\\x00\\x00\\x00\\x18\\xe6\\x0f\\xdc\\xb4\\x00\\x00\\x008\\xe6\\x0f\\xdc" } ], "repeated": 0, "id": 400 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xa2\\x00YF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8Z\\x1a\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x008\\xe4\\x0f\\xdc\\xb4\\x00\\x00\\x00\\xb0\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2}\\x1a" } ], "repeated": 0, "id": 401 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "A^\\x08\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 402 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\xb8\\xa5\\x00YF\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 403 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xa0\\xa4\\x00YF\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00" } ], "repeated": 0, "id": 404 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 405 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xb8c\\x01YF\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 406 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 407 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\x18\\xa3\\x00YF\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 408 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x81\\x1a\\xff\\x7f\\x00\\x00\\xebPY\\x1a\\xff\\x7f\\x00\\x00\\xa36iKL\\x93\\x00\\x00(N}\\x1a\\xff\\x7f\\x00\\x00\\xb0\\xe2\\x0f\\xdc\\xb4\\x00\\x00\\x00\\xa8\\xe2\\x0f\\xdc\\xb4\\x00\\x00\\x00x\\xe2\\x0f\\xdc\\xb4\\x00\\x00\\x00\\x98\\xe2\\x0f\\xdc" } ], "repeated": 0, "id": 409 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xa3\\x00YF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8Z\\x1a\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x98\\xe0\\x0f\\xdc\\xb4\\x00\\x00\\x00\\xb0\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2}\\x1a" } ], "repeated": 0, "id": 410 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b4" } ], "repeated": 0, "id": 411 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b0" } ], "repeated": 0, "id": 412 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "threading", "api": "NtCreateThreadEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x000002b0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartAddress", "value": "0x7fff58587db0" }, { "name": "Parameter", "value": "0x24659015940" }, { "name": "CreateFlags", "value": "0x00000001" }, { "name": "ThreadId", "value": "9204" }, { "name": "ProcessId", "value": "8636" }, { "name": "Module", "value": "combase.dll" } ], "repeated": 0, "id": 413 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x000002b0", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x7fff58587db0" }, { "name": "Parameter", "value": "0x24659015940" }, { "name": "CreationFlags", "value": "0x00000000" }, { "name": "ThreadId", "value": "9204" }, { "name": "ProcessId", "value": "8636" } ], "repeated": 0, "id": 414 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 415 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b0" }, { "name": "Milliseconds", "value": "20000" } ], "repeated": 0, "id": 416 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9204", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2465902c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 417 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9204", "caller": "0x7fff59fc507d", "parentcaller": "0x7fff59fc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 418 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9204", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7fff58587db0" }, { "name": "Parameter", "value": "0x24659015940" } ], "repeated": 0, "id": 419 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9204", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58587dc9", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 420 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9204", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58587dc9", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001f8" }, { "name": "Milliseconds", "value": "30000" } ], "repeated": 0, "id": 421 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9204", "caller": "0x7fff59fa467e", "parentcaller": "0x7fff57fc734d", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "12" }, { "name": "ThreadInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "9204" } ], "repeated": 0, "id": 422 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9204", "caller": "0x7fff59fa469e", "parentcaller": "0x7fff57fc734d", "category": "threading", "api": "NtTerminateThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00000000" }, { "name": "ExitStatus", "value": "0x00000000" }, { "name": "ThreadId", "value": "0" }, { "name": "ProcessId", "value": "0" } ], "repeated": 0, "id": 423 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b0" } ], "repeated": 0, "id": 424 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001fc" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 425 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9004", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5978ef53", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000002bc" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 426 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9004", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2465902d000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 427 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9004", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff584c8ce0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "Ir\\x08\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x02\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x03\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 428 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9004", "caller": "0x7fff577d6785", "parentcaller": "0x7fff584c8c8a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002c0" } ], "repeated": 0, "id": 429 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9004", "caller": "0x7fff5854d427", "parentcaller": "0x7fff584c3d82", "category": "misc", "api": "GetCommandLineW", "status": true, "return": "0x24658fe2268", "arguments": [ { "name": "CommandLine", "value": "C:\\Windows\\system32\\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" } ], "repeated": 0, "id": 430 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9004", "caller": "0x7fff577dac31", "parentcaller": "0x7fff585742bf", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7fff584a0000" }, { "name": "FunctionName", "value": "CoMarshalInterface" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff5851b0b0" } ], "repeated": 0, "id": 431 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9004", "caller": "0x7fff577dac31", "parentcaller": "0x7fff585742e9", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7fff584a0000" }, { "name": "FunctionName", "value": "CoUnmarshalInterface" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff58518b50" } ], "repeated": 0, "id": 432 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9004", "caller": "0x7fff577dac31", "parentcaller": "0x7fff58574313", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7fff584a0000" }, { "name": "FunctionName", "value": "StringFromIID" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff58549780" } ], "repeated": 0, "id": 433 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9004", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5857433d", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7fff584a0000" }, { "name": "FunctionName", "value": "CoTaskMemAlloc" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff58552e80" } ], "repeated": 0, "id": 434 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9004", "caller": "0x7fff577dac31", "parentcaller": "0x7fff58574367", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7fff584a0000" }, { "name": "FunctionName", "value": "CoTaskMemFree" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff58551b70" } ], "repeated": 0, "id": 435 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9004", "caller": "0x7fff577dac31", "parentcaller": "0x7fff58574391", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7fff584a0000" }, { "name": "FunctionName", "value": "CoCreateInstance" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff584ca420" } ], "repeated": 0, "id": 436 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9004", "caller": "0x7fff577dac31", "parentcaller": "0x7fff585743bb", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7fff584a0000" }, { "name": "FunctionName", "value": "CoReleaseMarshalData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff584ce790" } ], "repeated": 0, "id": 437 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9004", "caller": "0x7fff585741cf", "parentcaller": "0x7fff59f938c0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0000032A-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000149-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 438 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9004", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff584fb0ca", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 439 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9004", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 440 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9004", "caller": "0x7fff584d7b74", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000232" }, { "name": "SubKey", "value": "CLSID\\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" }, { "name": "Handle", "value": "0x000002d2" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" } ], "repeated": 0, "id": 441 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9004", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d2" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 442 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9004", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d2" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 443 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9004", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x90\\xc8\\xaf\\xdc\\xb4\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\xd2\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xb4\\x00\\x00\\x00\\x90\\xc9\\xaf\\xdc\\xb4\\x00\\x00\\x00" } ], "repeated": 0, "id": 444 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9004", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\TreatAs" } ], "repeated": 0, "id": 445 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9004", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d2" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 446 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9004", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d2" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\TreatAs" } ], "repeated": 0, "id": 447 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9004", "caller": "0x7fff585622e1", "parentcaller": "0x7fff584d7c1d", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d2" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 448 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9004", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d81f5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002d2" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 449 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9004", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d2" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\(Default)" } ], "repeated": 0, "id": 450 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9004", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d2" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "Thumbnail Cache Class Factory for Out of Proc Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\(Default)" } ], "repeated": 0, "id": 451 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9004", "caller": "0x7fff584d8485", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000002d2" }, { "name": "SubKey", "value": "InprocServer32" }, { "name": "Handle", "value": "0x000002d6" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32" } ], "repeated": 0, "id": 452 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9004", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002d6" }, { "name": "ValueName", "value": "InprocServer32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\InprocServer32" } ], "repeated": 0, "id": 453 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9004", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d6" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\(Default)" } ], "repeated": 0, "id": 454 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9004", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d6" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "C:\\Windows\\System32\\thumbcache.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\(Default)" } ], "repeated": 0, "id": 455 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9004", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d8d32", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d6" }, { "name": "ValueName", "value": "ThreadingModel" }, { "name": "Data", "value": "Apartment" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\ThreadingModel" } ], "repeated": 0, "id": 456 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9004", "caller": "0x7fff584d855f", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d6" } ], "repeated": 0, "id": 457 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9004", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d2" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 458 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9004", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d2" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 459 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9004", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xc7\\xaf\\xdc\\xb4\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\xd2\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xb4\\x00\\x00\\x00 \\xc8\\xaf\\xdc\\xb4\\x00\\x00\\x00" } ], "repeated": 0, "id": 460 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9004", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocHandler32" } ], "repeated": 0, "id": 461 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9004", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d2" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 462 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9004", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d2" }, { "name": "ObjectAttributesName", "value": "InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocHandler32" } ], "repeated": 0, "id": 463 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9004", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d2" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 464 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9004", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d2" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 465 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9004", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xc7\\xaf\\xdc\\xb4\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\xd2\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xb4\\x00\\x00\\x00 \\xc8\\xaf\\xdc\\xb4\\x00\\x00\\x00" } ], "repeated": 0, "id": 466 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9004", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocHandler" } ], "repeated": 0, "id": 467 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9004", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d2" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 468 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9004", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d2" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocHandler" } ], "repeated": 0, "id": 469 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9004", "caller": "0x7fff584d8010", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d2" } ], "repeated": 0, "id": 470 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9004", "caller": "0x7fff585494b2", "parentcaller": "0x7fff585354b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\OLE" }, { "name": "Handle", "value": "0x000002d0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\OLE" } ], "repeated": 0, "id": 471 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9004", "caller": "0x7fff585494ea", "parentcaller": "0x7fff585354b4", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002d0" }, { "name": "ValueName", "value": "MaxSxSHashCount" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\MaxSxSHashCount" } ], "repeated": 0, "id": 472 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9004", "caller": "0x7fff58549503", "parentcaller": "0x7fff585354b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d0" } ], "repeated": 0, "id": 473 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9004", "caller": "0x7fff5854de68", "parentcaller": "0x7fff585071ff", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\COM3" }, { "name": "Handle", "value": "0x000002d0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\COM3" } ], "repeated": 0, "id": 474 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9004", "caller": "0x7fff5854dea4", "parentcaller": "0x7fff585071ff", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002d0" }, { "name": "ValueName", "value": "GipActivityBypass" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\COM3\\GipActivityBypass" } ], "repeated": 0, "id": 475 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9004", "caller": "0x7fff5854debd", "parentcaller": "0x7fff585071ff", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d0" } ], "repeated": 0, "id": 476 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9004", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00030196" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 477 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9000", "caller": "0x7fff59f93f7a", "parentcaller": "0x7fff59770ed7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 478 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9000", "caller": "0x7fff59770cd1", "parentcaller": "0x7fff5976f28f", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x000002dc" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 479 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9000", "caller": "0x7fff5781026b", "parentcaller": "0x7fff59770daf", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000002e0" } ], "repeated": 0, "id": 480 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9000", "caller": "0x7fff59f88cde", "parentcaller": "0x7fff59fc9c4e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "A^\\x08\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 481 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9000", "caller": "0x7fff59fb6e46", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "x\\xa6\\x00YF\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05" } ], "repeated": 0, "id": 482 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9000", "caller": "0x7fff59fb6e9b", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xa0\\xa7\\x00YF\\x02\\x00\\x00`\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 483 }, { "timestamp": "2026-05-29 01:05:04,534", "thread_id": "9000", "caller": "0x7fff59fb6ec0", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 484 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff59fb6f0e", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "8_\\x01YF\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 485 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff59fb6f37", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 486 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff59fb6f8f", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "x\\xa0\\x00YF\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 487 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff59fb7048", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x81\\x1a\\xff\\x7f\\x00\\x00\\xebPY\\x1a\\xff\\x7f\\x00\\x003!\\xd9KL\\x93\\x00\\x00(N}\\x1a\\xff\\x7f\\x00\\x00 \\xd6\\xbf\\xdc\\xb4\\x00\\x00\\x00\\x18\\xd6\\xbf\\xdc\\xb4\\x00\\x00\\x00\\xe8\\xd5\\xbf\\xdc\\xb4\\x00\\x00\\x00\\x08\\xd6\\xbf\\xdc" } ], "repeated": 0, "id": 488 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff59fb707b", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xa0\\x00YF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8Z\\x1a\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x08\\xd4\\xbf\\xdc\\xb4\\x00\\x00\\x00\\xe0\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2}\\x1a" } ], "repeated": 0, "id": 489 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24659032000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 490 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff59f88cde", "parentcaller": "0x7fff59f8953a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "A^\\x08\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 491 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff59fb6e46", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "X\\xa2\\x00YF\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05" } ], "repeated": 0, "id": 492 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff59fb6e9b", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\x10`\\x00YF\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 493 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff59fb6ec0", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 494 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff59fb6f0e", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\x98_\\x01YF\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 495 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff59fb6f37", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 496 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff59fb6f8f", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "hQ\\x00YF\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 497 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff59fb7048", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x81\\x1a\\xff\\x7f\\x00\\x00\\xebPY\\x1a\\xff\\x7f\\x00\\x00\\x93&\\xd9KL\\x93\\x00\\x00(N}\\x1a\\xff\\x7f\\x00\\x00\\x80\\xd2\\xbf\\xdc\\xb4\\x00\\x00\\x00x\\xd2\\xbf\\xdc\\xb4\\x00\\x00\\x00H\\xd2\\xbf\\xdc\\xb4\\x00\\x00\\x00h\\xd2\\xbf\\xdc" } ], "repeated": 0, "id": 498 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff59fb707b", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`Q\\x00YF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8Z\\x1a\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00h\\xd0\\xbf\\xdc\\xb4\\x00\\x00\\x00\\xe0\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2}\\x1a" } ], "repeated": 0, "id": 499 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff59770e27", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002dc" } ], "repeated": 0, "id": 500 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff59770e49", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e0" } ], "repeated": 0, "id": 501 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9004", "caller": "0x7fff5781c06d", "parentcaller": "0x7fff577cd794", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2465aa00000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 502 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9004", "caller": "0x7fff577ced78", "parentcaller": "0x7fff578206f5", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e0" }, { "name": "MutexName", "value": "" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 503 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9004", "caller": "0x7fff577cdbb1", "parentcaller": "0x7fff577cd381", "category": "misc", "api": "GetSystemInfo", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 504 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9004", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff577cdda6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e0" }, { "name": "Milliseconds", "value": "4000" } ], "repeated": 0, "id": 505 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9004", "caller": "0x7fff5781c06d", "parentcaller": "0x7fff577cdcda", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2465aa10000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 506 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9004", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff577cdd0d", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e0" } ], "repeated": 0, "id": 507 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9004", "caller": "0x7fff59fc1963", "parentcaller": "0x7fff59fc18a2", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x246590e2000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 508 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9004", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00030196" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 509 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 510 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff584d7b74", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000232" }, { "name": "SubKey", "value": "CLSID\\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" }, { "name": "Handle", "value": "0x000002de" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" } ], "repeated": 0, "id": 511 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002de" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 512 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002de" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 513 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xd0\\xcc\\xbf\\xdc\\xb4\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\xde\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xb4\\x00\\x00\\x00\\xd0\\xcd\\xbf\\xdc\\xb4\\x00\\x00\\x00" } ], "repeated": 0, "id": 514 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\TreatAs" } ], "repeated": 0, "id": 515 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002de" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 516 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002de" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\TreatAs" } ], "repeated": 0, "id": 517 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff585622e1", "parentcaller": "0x7fff584d7c1d", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002de" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 518 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d81f5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002de" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 519 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002de" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\(Default)" } ], "repeated": 0, "id": 520 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002de" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "Thumbnail Cache Class Factory for Out of Proc Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\(Default)" } ], "repeated": 0, "id": 521 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff584d8485", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000002de" }, { "name": "SubKey", "value": "InprocServer32" }, { "name": "Handle", "value": "0x000002e6" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32" } ], "repeated": 0, "id": 522 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e6" }, { "name": "ValueName", "value": "InprocServer32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\InprocServer32" } ], "repeated": 0, "id": 523 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e6" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\(Default)" } ], "repeated": 0, "id": 524 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e6" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "C:\\Windows\\System32\\thumbcache.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\(Default)" } ], "repeated": 0, "id": 525 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d8d32", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e6" }, { "name": "ValueName", "value": "ThreadingModel" }, { "name": "Data", "value": "Apartment" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\ThreadingModel" } ], "repeated": 0, "id": 526 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff584d855f", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e6" } ], "repeated": 0, "id": 527 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002de" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 528 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002de" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 529 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "`\\xcb\\xbf\\xdc\\xb4\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\xde\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xb4\\x00\\x00\\x00`\\xcc\\xbf\\xdc\\xb4\\x00\\x00\\x00" } ], "repeated": 0, "id": 530 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocHandler32" } ], "repeated": 0, "id": 531 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002de" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 532 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002de" }, { "name": "ObjectAttributesName", "value": "InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocHandler32" } ], "repeated": 0, "id": 533 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002de" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 534 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002de" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 535 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "`\\xcb\\xbf\\xdc\\xb4\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\xde\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xb4\\x00\\x00\\x00`\\xcc\\xbf\\xdc\\xb4\\x00\\x00\\x00" } ], "repeated": 0, "id": 536 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocHandler" } ], "repeated": 0, "id": 537 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002de" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 538 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002de" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocHandler" } ], "repeated": 0, "id": 539 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff584dab08", "parentcaller": "0x7fff584da7d9", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000002de" }, { "name": "SubKey", "value": "LocalServer32" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\LocalServer32" } ], "repeated": 0, "id": 540 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584da825", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002de" }, { "name": "ValueName", "value": "AppID" }, { "name": "Data", "value": "{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\AppID" } ], "repeated": 0, "id": 541 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff58575483", "parentcaller": "0x7fff584f4bdc", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000232" }, { "name": "SubKey", "value": "AppID\\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" }, { "name": "Handle", "value": "0x000002e6" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\AppID\\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" } ], "repeated": 0, "id": 542 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff585622e1", "parentcaller": "0x7fff584f4c07", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002e6" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 543 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e6" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\(Default)" } ], "repeated": 0, "id": 544 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e6" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "Thumbnail Cache Out of Proc Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\(Default)" } ], "repeated": 0, "id": 545 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e6" }, { "name": "ValueName", "value": "LocalService" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\LocalService" } ], "repeated": 0, "id": 546 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e6" }, { "name": "ValueName", "value": "DllSurrogate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\DllSurrogate" } ], "repeated": 0, "id": 547 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e6" }, { "name": "ValueName", "value": "DllSurrogate" }, { "name": "Data", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\DllSurrogate" } ], "repeated": 0, "id": 548 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d9bff", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e6" }, { "name": "ValueName", "value": "RunAs" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\RunAs" } ], "repeated": 0, "id": 549 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d9d1a", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e6" }, { "name": "ValueName", "value": "ActivateAtStorage" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ActivateAtStorage" } ], "repeated": 0, "id": 550 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff584d9e39", "parentcaller": "0x7fff584f4dd5", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000232" }, { "name": "SubKey", "value": "AppID\\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" }, { "name": "Handle", "value": "0x000002ea" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\AppID\\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" } ], "repeated": 0, "id": 551 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff584d9e8d", "parentcaller": "0x7fff584f4dd5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002ea" }, { "name": "ValueName", "value": "ROTFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ROTFlags" } ], "repeated": 0, "id": 552 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff584d9ee0", "parentcaller": "0x7fff584f4dd5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002ea" }, { "name": "ValueName", "value": "AppIDFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\AppIDFlags" } ], "repeated": 0, "id": 553 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff584d9f30", "parentcaller": "0x7fff584f4dd5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002ea" }, { "name": "ValueName", "value": "MGOTFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\MGOTFlags" } ], "repeated": 0, "id": 554 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff584d9f84", "parentcaller": "0x7fff584f4dd5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002ea" }, { "name": "ValueName", "value": "ProcessMitigationPolicy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ProcessMitigationPolicy" } ], "repeated": 0, "id": 555 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff584d9fa7", "parentcaller": "0x7fff584f4dd5", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ea" } ], "repeated": 0, "id": 556 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff58569058", "parentcaller": "0x7fff584d9fcb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e6" }, { "name": "ValueName", "value": "LaunchPermission" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\LaunchPermission" } ], "repeated": 0, "id": 557 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff584da010", "parentcaller": "0x7fff584f4dd5", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\OLE" }, { "name": "Handle", "value": "0x000002e8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\OLE" } ], "repeated": 0, "id": 558 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff584da052", "parentcaller": "0x7fff584f4dd5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "LegacyAuthenticationLevel" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\LegacyAuthenticationLevel" } ], "repeated": 0, "id": 559 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff584da0a5", "parentcaller": "0x7fff584f4dd5", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "LegacyImpersonationLevel" }, { "name": "Data", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\LegacyImpersonationLevel" } ], "repeated": 0, "id": 560 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff584da0de", "parentcaller": "0x7fff584f4dd5", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 561 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff584da123", "parentcaller": "0x7fff584f4dd5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e6" }, { "name": "ValueName", "value": "AuthenticationLevel" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\AuthenticationLevel" } ], "repeated": 0, "id": 562 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e6" }, { "name": "ValueName", "value": "RemoteServerName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\RemoteServerName" } ], "repeated": 0, "id": 563 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff584da1c8", "parentcaller": "0x7fff584f4dd5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e6" }, { "name": "ValueName", "value": "SRPTrustLevel" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\SRPTrustLevel" } ], "repeated": 0, "id": 564 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff584da227", "parentcaller": "0x7fff584f4dd5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e6" }, { "name": "ValueName", "value": "PreferredServerBitness" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\PreferredServerBitness" } ], "repeated": 0, "id": 565 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff584da28a", "parentcaller": "0x7fff584f4dd5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e6" }, { "name": "ValueName", "value": "LoadUserSettings" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\LoadUserSettings" } ], "repeated": 0, "id": 566 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff584da318", "parentcaller": "0x7fff584f4dd5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e6" }, { "name": "ValueName", "value": "ProtectionLevel" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ProtectionLevel" } ], "repeated": 0, "id": 567 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff584f4e2a", "parentcaller": "0x7fff584da9ba", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e6" } ], "repeated": 0, "id": 568 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff5857450c", "parentcaller": "0x7fff584daa90", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000002de" }, { "name": "SubKey", "value": "InprocServer32" }, { "name": "Handle", "value": "0x000002e6" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32" } ], "repeated": 0, "id": 569 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff58574529", "parentcaller": "0x7fff584daa90", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e6" } ], "repeated": 0, "id": 570 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577cddf0", "parentcaller": "0x7fff58574a29", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "0", "pretty_value": "FILE_SUPERSEDE" } ], "repeated": 0, "id": 571 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577cde10", "parentcaller": "0x7fff58574a29", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "1", "pretty_value": "FILE_OPEN" } ], "repeated": 0, "id": 572 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002de" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 573 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002de" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 574 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xa0\\xca\\xbf\\xdc\\xb4\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\xde\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xb4\\x00\\x00\\x00\\xa0\\xcb\\xbf\\xdc\\xb4\\x00\\x00\\x00" } ], "repeated": 0, "id": 575 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\LocalServer" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\LocalServer" } ], "repeated": 0, "id": 576 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002de" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 577 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002de" }, { "name": "ObjectAttributesName", "value": "LocalServer" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\LocalServer" } ], "repeated": 0, "id": 578 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff584dad16", "parentcaller": "0x7fff584d83b8", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000232" }, { "name": "SubKey", "value": "CLSID\\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" }, { "name": "Handle", "value": "0x000002e6" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" } ], "repeated": 0, "id": 579 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff584dad4d", "parentcaller": "0x7fff584d83b8", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000002e6" }, { "name": "SubKey", "value": "Elevation" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\Elevation" } ], "repeated": 0, "id": 580 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff584dadb1", "parentcaller": "0x7fff584d83b8", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e6" } ], "repeated": 0, "id": 581 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff584d8010", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002de" } ], "repeated": 0, "id": 582 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff584d25e9", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000252" }, { "name": "SubKey", "value": "CLSID\\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" }, { "name": "Handle", "value": "0x000002de" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" } ], "repeated": 0, "id": 583 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff5854f8f8", "parentcaller": "0x7fff584d213b", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000002de" }, { "name": "SubKey", "value": "TreatAs" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\TreatAs" } ], "repeated": 0, "id": 584 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff584d2160", "parentcaller": "0x7fff584c9277", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002de" } ], "repeated": 0, "id": 585 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\shcore" }, { "name": "DllBase", "value": "0x7fff58070000" } ], "repeated": 0, "id": 586 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff59fb7cc6", "parentcaller": "0x7fff59f8ddf7", "category": "system", "api": "NtQuerySystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 587 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff59fb7cc6", "parentcaller": "0x7fff59f8ddf7", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\thumbcache" }, { "name": "DllBase", "value": "0x7fff432b0000" } ], "repeated": 0, "id": 588 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\thumbcache.dll" }, { "name": "BaseAddress", "value": "0x7fff432b0000" } ], "repeated": 0, "id": 589 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff432b0000", "arguments": [ { "name": "lpLibFileName", "value": "C:\\Windows\\System32\\thumbcache.dll" }, { "name": "dwFlags", "value": "0x00002008" } ], "repeated": 0, "id": 590 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577dac31", "parentcaller": "0x7fff584f6acf", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "thumbcache.dll" }, { "name": "ModuleHandle", "value": "0x7fff432b0000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff432ca900" } ], "repeated": 0, "id": 591 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577dac31", "parentcaller": "0x7fff584f6ae8", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "thumbcache.dll" }, { "name": "ModuleHandle", "value": "0x7fff432b0000" }, { "name": "FunctionName", "value": "DllGetActivationFactory" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff432dc5c0" } ], "repeated": 0, "id": 592 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577dac31", "parentcaller": "0x7fff584f6b08", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "thumbcache.dll" }, { "name": "ModuleHandle", "value": "0x7fff432b0000" }, { "name": "FunctionName", "value": "DllCanUnloadNow" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff432cbe50" } ], "repeated": 0, "id": 593 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff43313000" }, { "name": "ModuleName", "value": "thumbcache.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 594 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff43313000" }, { "name": "ModuleName", "value": "thumbcache.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 595 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff432c5294", "parentcaller": "0x7fff58535144", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0000034B-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "0000015B-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 596 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577ce76a", "parentcaller": "0x7fff584e0e64", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7fff584a0000" } ], "repeated": 0, "id": 597 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577dac31", "parentcaller": "0x7fff584e0e82", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7fff584a0000" }, { "name": "FunctionName", "value": "CoGetMarshalSizeMax" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff5850c590" } ], "repeated": 0, "id": 598 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577dac31", "parentcaller": "0x7fff584e0e9f", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7fff584a0000" }, { "name": "FunctionName", "value": "CoMarshalInterface" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff5851b0b0" } ], "repeated": 0, "id": 599 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577dac31", "parentcaller": "0x7fff584e0ebc", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7fff584a0000" }, { "name": "FunctionName", "value": "CoUnmarshalInterface" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff58518b50" } ], "repeated": 0, "id": 600 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577dac31", "parentcaller": "0x7fff584e0ed9", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7fff584a0000" }, { "name": "FunctionName", "value": "CoReleaseMarshalData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff584ce790" } ], "repeated": 0, "id": 601 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff5854fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000252" }, { "name": "SubKey", "value": "Interface\\{75121952-E0D0-43E5-9380-1D80483ACF72}" }, { "name": "Handle", "value": "0x000002ea" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{75121952-E0D0-43E5-9380-1D80483ACF72}" } ], "repeated": 0, "id": 602 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff5854fa51", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000002ea" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x000002ee" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{75121952-e0d0-43e5-9380-1d80483acf72}\\ProxyStubClsid32" } ], "repeated": 0, "id": 603 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff5854fa8c", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ee" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{75121952-e0d0-43e5-9380-1d80483acf72}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 604 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff5854fad3", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ee" } ], "repeated": 0, "id": 605 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff5854fae4", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ea" } ], "repeated": 0, "id": 606 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff584d7b74", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000232" }, { "name": "SubKey", "value": "CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}" }, { "name": "Handle", "value": "0x000002ea" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}" } ], "repeated": 0, "id": 607 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ea" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 608 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ea" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 609 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x00\\xbd\\xbf\\xdc\\xb4\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\xea\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xb4\\x00\\x00\\x00\\x00\\xbe\\xbf\\xdc\\xb4\\x00\\x00\\x00" } ], "repeated": 0, "id": 610 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\TreatAs" } ], "repeated": 0, "id": 611 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ea" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 612 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002ea" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\TreatAs" } ], "repeated": 0, "id": 613 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff585622e1", "parentcaller": "0x7fff584d7c1d", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ea" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 614 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d81f5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002ea" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 615 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ea" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\(Default)" } ], "repeated": 0, "id": 616 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ea" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "PSFactoryBuffer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\(Default)" } ], "repeated": 0, "id": 617 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff584d8485", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000002ea" }, { "name": "SubKey", "value": "InprocServer32" }, { "name": "Handle", "value": "0x000002ee" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InprocServer32" } ], "repeated": 0, "id": 618 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002ee" }, { "name": "ValueName", "value": "InprocServer32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InProcServer32\\InprocServer32" } ], "repeated": 0, "id": 619 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ee" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 620 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577f4aa9", "parentcaller": "0x7fff577d31c6", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ee" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "%SystemRoot%\\system32\\propsys.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InProcServer32\\(Default)" } ], "repeated": 1, "id": 621 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d8d32", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ee" }, { "name": "ValueName", "value": "ThreadingModel" }, { "name": "Data", "value": "Both" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InProcServer32\\ThreadingModel" } ], "repeated": 0, "id": 622 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff584d855f", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ee" } ], "repeated": 0, "id": 623 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ea" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 624 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ea" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 625 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x90\\xbb\\xbf\\xdc\\xb4\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\xea\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xb4\\x00\\x00\\x00\\x90\\xbc\\xbf\\xdc\\xb4\\x00\\x00\\x00" } ], "repeated": 0, "id": 626 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InprocHandler32" } ], "repeated": 0, "id": 627 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ea" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 628 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002ea" }, { "name": "ObjectAttributesName", "value": "InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InprocHandler32" } ], "repeated": 0, "id": 629 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ea" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 630 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ea" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 631 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x90\\xbb\\xbf\\xdc\\xb4\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\xea\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xb4\\x00\\x00\\x00\\x90\\xbc\\xbf\\xdc\\xb4\\x00\\x00\\x00" } ], "repeated": 0, "id": 632 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InprocHandler" } ], "repeated": 0, "id": 633 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ea" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 634 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002ea" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InprocHandler" } ], "repeated": 0, "id": 635 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff584d8010", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ea" } ], "repeated": 0, "id": 636 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 637 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000244" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 638 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff584d7b74", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000232" }, { "name": "SubKey", "value": "CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}" }, { "name": "Handle", "value": "0x000002ea" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}" } ], "repeated": 0, "id": 639 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ea" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 640 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ea" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 641 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xc0\\xb9\\xbf\\xdc\\xb4\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\xea\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xb4\\x00\\x00\\x00\\xc0\\xba\\xbf\\xdc\\xb4\\x00\\x00\\x00" } ], "repeated": 0, "id": 642 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\TreatAs" } ], "repeated": 0, "id": 643 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ea" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 644 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002ea" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\TreatAs" } ], "repeated": 0, "id": 645 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff585622e1", "parentcaller": "0x7fff584d7c1d", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ea" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 646 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d81f5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002ea" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 647 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ea" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\(Default)" } ], "repeated": 0, "id": 648 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ea" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "PSFactoryBuffer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\(Default)" } ], "repeated": 0, "id": 649 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff584d8485", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000002ea" }, { "name": "SubKey", "value": "InprocServer32" }, { "name": "Handle", "value": "0x000002ee" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InprocServer32" } ], "repeated": 0, "id": 650 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002ee" }, { "name": "ValueName", "value": "InprocServer32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InProcServer32\\InprocServer32" } ], "repeated": 0, "id": 651 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ee" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 652 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577f4aa9", "parentcaller": "0x7fff577d31c6", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ee" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "%SystemRoot%\\system32\\propsys.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InProcServer32\\(Default)" } ], "repeated": 1, "id": 653 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d8d32", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ee" }, { "name": "ValueName", "value": "ThreadingModel" }, { "name": "Data", "value": "Both" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InProcServer32\\ThreadingModel" } ], "repeated": 0, "id": 654 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff584d855f", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ee" } ], "repeated": 0, "id": 655 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ea" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 656 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ea" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 657 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xb8\\xbf\\xdc\\xb4\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\xea\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xb4\\x00\\x00\\x00P\\xb9\\xbf\\xdc\\xb4\\x00\\x00\\x00" } ], "repeated": 0, "id": 658 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InprocHandler32" } ], "repeated": 0, "id": 659 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ea" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 660 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002ea" }, { "name": "ObjectAttributesName", "value": "InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InprocHandler32" } ], "repeated": 0, "id": 661 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ea" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 662 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ea" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 663 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xb8\\xbf\\xdc\\xb4\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\xea\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xb4\\x00\\x00\\x00P\\xb9\\xbf\\xdc\\xb4\\x00\\x00\\x00" } ], "repeated": 0, "id": 664 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InprocHandler" } ], "repeated": 0, "id": 665 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ea" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 666 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002ea" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InprocHandler" } ], "repeated": 0, "id": 667 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff584dab08", "parentcaller": "0x7fff584da7d9", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000002ea" }, { "name": "SubKey", "value": "LocalServer32" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\LocalServer32" } ], "repeated": 0, "id": 668 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584da825", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002ea" }, { "name": "ValueName", "value": "AppID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\AppID" } ], "repeated": 0, "id": 669 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ea" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 670 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ea" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 671 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x90\\xb7\\xbf\\xdc\\xb4\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\xea\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xb4\\x00\\x00\\x00\\x90\\xb8\\xbf\\xdc\\xb4\\x00\\x00\\x00" } ], "repeated": 0, "id": 672 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\LocalServer" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\LocalServer" } ], "repeated": 0, "id": 673 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ea" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 674 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002ea" }, { "name": "ObjectAttributesName", "value": "LocalServer" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\LocalServer" } ], "repeated": 0, "id": 675 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff584dad16", "parentcaller": "0x7fff584d83b8", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000232" }, { "name": "SubKey", "value": "CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}" }, { "name": "Handle", "value": "0x000002ee" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}" } ], "repeated": 0, "id": 676 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff584dad4d", "parentcaller": "0x7fff584d83b8", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000002ee" }, { "name": "SubKey", "value": "Elevation" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\Elevation" } ], "repeated": 0, "id": 677 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff584dadb1", "parentcaller": "0x7fff584d83b8", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ee" } ], "repeated": 0, "id": 678 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff584d8010", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ea" } ], "repeated": 0, "id": 679 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff584d25e9", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000252" }, { "name": "SubKey", "value": "CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}" }, { "name": "Handle", "value": "0x000002ea" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}" } ], "repeated": 0, "id": 680 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff5854f8f8", "parentcaller": "0x7fff584d213b", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000002ea" }, { "name": "SubKey", "value": "TreatAs" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\TreatAs" } ], "repeated": 0, "id": 681 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff584d2160", "parentcaller": "0x7fff584c9277", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ea" } ], "repeated": 0, "id": 682 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 683 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000244" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 684 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\propsys" }, { "name": "DllBase", "value": "0x7fff52860000" } ], "repeated": 0, "id": 685 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\propsys.dll" }, { "name": "BaseAddress", "value": "0x7fff52860000" } ], "repeated": 0, "id": 686 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff52860000", "arguments": [ { "name": "lpLibFileName", "value": "C:\\Windows\\system32\\propsys.dll" }, { "name": "dwFlags", "value": "0x00002008" } ], "repeated": 0, "id": 687 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577dac31", "parentcaller": "0x7fff584f6acf", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "propsys.dll" }, { "name": "ModuleHandle", "value": "0x7fff52860000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff5286b810" } ], "repeated": 0, "id": 688 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577dac31", "parentcaller": "0x7fff584f6ae8", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": false, "return": "0xffffffffc0000139", "pretty_return": "ENTRYPOINT_NOT_FOUND", "arguments": [ { "name": "ModuleName", "value": "propsys.dll" }, { "name": "ModuleHandle", "value": "0x7fff52860000" }, { "name": "FunctionName", "value": "DllGetActivationFactory" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x00000000" } ], "repeated": 0, "id": 689 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577dac31", "parentcaller": "0x7fff584f6b08", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "propsys.dll" }, { "name": "ModuleHandle", "value": "0x7fff52860000" }, { "name": "FunctionName", "value": "DllCanUnloadNow" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff52896430" } ], "repeated": 0, "id": 690 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff59f93f7a", "parentcaller": "0x7fff59770ed7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 691 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff59770cd1", "parentcaller": "0x7fff5976f28f", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x000002f8" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 692 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff5781026b", "parentcaller": "0x7fff59770daf", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000002fc" } ], "repeated": 0, "id": 693 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff59f88cde", "parentcaller": "0x7fff59fc9c4e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "A^\\x08\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 694 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff59fb6e46", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "hQ\\x00YF\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05" } ], "repeated": 0, "id": 695 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff59fb6e9b", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "PV\\x00YF\\x02\\x00\\x00`\\x00\\x00\\x00COM;\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00MD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC\\x00PROCESSOR_ARCHITECT" } ], "repeated": 0, "id": 696 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff59fb6ec0", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 697 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff59fb6f0e", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "HK\\x03YF\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 698 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff59fb6f37", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 699 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff59fb6f8f", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "H_\\x00YF\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 700 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff59fb7048", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x81\\x1a\\xff\\x7f\\x00\\x00\\xebPY\\x1a\\xff\\x7f\\x00\\x00C.\\xd9KL\\x93\\x00\\x00(N}\\x1a\\xff\\x7f\\x00\\x00P\\xcb\\xbf\\xdc\\xb4\\x00\\x00\\x00H\\xcb\\xbf\\xdc\\xb4\\x00\\x00\\x00\\x18\\xcb\\xbf\\xdc\\xb4\\x00\\x00\\x008\\xcb\\xbf\\xdc" } ], "repeated": 0, "id": 701 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff59fb707b", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@_\\x00YF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8Z\\x1a\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x008\\xc9\\xbf\\xdc\\xb4\\x00\\x00\\x00\\xfc\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2}\\x1a" } ], "repeated": 0, "id": 702 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff59f88cde", "parentcaller": "0x7fff59f8953a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "A^\\x08\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 703 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff59fb6e46", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\xc8W\\x00YF\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00o\\x00r\\x00e\\x00-\\x00w\\x00i\\x00n\\x003\\x002\\x00k\\x00-\\x00f\\x00u\\x00l\\x00l\\x00u\\x00s\\x00e\\x00r\\x00-\\x00l\\x001\\x00-\\x001\\x00-\\x000\\x00" } ], "repeated": 0, "id": 704 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff59fb6e9b", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\x10W\\x00YF\\x02\\x00\\x00`\\x00\\x00\\x00e03\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00C:\\ProgramData\\x00ProgramFiles=C:\\Program Files\\x00ProgramFile" } ], "repeated": 0, "id": 705 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff59fb6ec0", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 706 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff59fb6f0e", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xc8I\\x03YF\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 707 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff59fb6f37", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 708 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff59fb6f8f", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xc8T\\x00YF\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 709 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff59fb7048", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x81\\x1a\\xff\\x7f\\x00\\x00\\xebPY\\x1a\\xff\\x7f\\x00\\x00\\xa3S\\xd9KL\\x93\\x00\\x00(N}\\x1a\\xff\\x7f\\x00\\x00\\xb0\\xc7\\xbf\\xdc\\xb4\\x00\\x00\\x00\\xa8\\xc7\\xbf\\xdc\\xb4\\x00\\x00\\x00x\\xc7\\xbf\\xdc\\xb4\\x00\\x00\\x00\\x98\\xc7\\xbf\\xdc" } ], "repeated": 0, "id": 710 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff59fb707b", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0T\\x00YF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8Z\\x1a\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x98\\xc5\\xbf\\xdc\\xb4\\x00\\x00\\x00\\xfc\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2}\\x1a" } ], "repeated": 0, "id": 711 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff59770e27", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" } ], "repeated": 0, "id": 712 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff59770e49", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002fc" } ], "repeated": 0, "id": 713 }, { "timestamp": "2026-05-29 01:05:04,549", "thread_id": "9004", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 714 }, { "timestamp": "2026-05-29 01:05:04,565", "thread_id": "9004", "caller": "0x7fff58520e98", "parentcaller": "0x7fff5859b785", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00030196" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 715 }, { "timestamp": "2026-05-29 01:05:04,565", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 716 }, { "timestamp": "2026-05-29 01:05:04,565", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001fc" }, { "name": "Milliseconds", "value": "5000" } ], "repeated": 0, "id": 717 }, { "timestamp": "2026-05-29 01:05:04,565", "thread_id": "9004", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff584fb0ca", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 718 }, { "timestamp": "2026-05-29 01:05:04,565", "thread_id": "9004", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 719 }, { "timestamp": "2026-05-29 01:05:04,565", "thread_id": "9004", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 720 }, { "timestamp": "2026-05-29 01:05:04,565", "thread_id": "9004", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000244" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 721 }, { "timestamp": "2026-05-29 01:05:04,565", "thread_id": "9004", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00030196" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 722 }, { "timestamp": "2026-05-29 01:05:04,565", "thread_id": "9000", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 723 }, { "timestamp": "2026-05-29 01:05:04,565", "thread_id": "9000", "caller": "0x7fff432c5294", "parentcaller": "0x7fff58535144", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0000034B-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "0000015B-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 724 }, { "timestamp": "2026-05-29 01:05:04,565", "thread_id": "9004", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 725 }, { "timestamp": "2026-05-29 01:05:04,565", "thread_id": "9004", "caller": "0x7fff58520e98", "parentcaller": "0x7fff5859b785", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00030196" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 726 }, { "timestamp": "2026-05-29 01:05:04,565", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 727 }, { "timestamp": "2026-05-29 01:05:04,565", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001fc" }, { "name": "Milliseconds", "value": "5000" } ], "repeated": 0, "id": 728 }, { "timestamp": "2026-05-29 01:05:04,565", "thread_id": "9004", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff584fb0ca", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 729 }, { "timestamp": "2026-05-29 01:05:04,565", "thread_id": "9004", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 730 }, { "timestamp": "2026-05-29 01:05:04,565", "thread_id": "9004", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 731 }, { "timestamp": "2026-05-29 01:05:04,565", "thread_id": "9004", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000244" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 732 }, { "timestamp": "2026-05-29 01:05:04,565", "thread_id": "9004", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00030196" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 733 }, { "timestamp": "2026-05-29 01:05:04,565", "thread_id": "9000", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 734 }, { "timestamp": "2026-05-29 01:05:04,565", "thread_id": "9000", "caller": "0x7fff432c5294", "parentcaller": "0x7fff58535144", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0000034B-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "0000015B-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 735 }, { "timestamp": "2026-05-29 01:05:04,565", "thread_id": "9004", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 736 }, { "timestamp": "2026-05-29 01:05:04,581", "thread_id": "9004", "caller": "0x7fff58520e98", "parentcaller": "0x7fff5859b785", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00030196" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 737 }, { "timestamp": "2026-05-29 01:05:04,581", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 738 }, { "timestamp": "2026-05-29 01:05:04,581", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001fc" }, { "name": "Milliseconds", "value": "5000" } ], "repeated": 0, "id": 739 }, { "timestamp": "2026-05-29 01:05:04,581", "thread_id": "9004", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff584fb0ca", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 740 }, { "timestamp": "2026-05-29 01:05:04,581", "thread_id": "9004", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 741 }, { "timestamp": "2026-05-29 01:05:04,581", "thread_id": "9004", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 742 }, { "timestamp": "2026-05-29 01:05:04,581", "thread_id": "9004", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000244" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 743 }, { "timestamp": "2026-05-29 01:05:04,581", "thread_id": "9004", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00030196" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 744 }, { "timestamp": "2026-05-29 01:05:04,581", "thread_id": "9000", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 745 }, { "timestamp": "2026-05-29 01:05:04,581", "thread_id": "9000", "caller": "0x7fff432c5294", "parentcaller": "0x7fff58535144", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0000034B-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "0000015B-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 746 }, { "timestamp": "2026-05-29 01:05:04,581", "thread_id": "9004", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 747 }, { "timestamp": "2026-05-29 01:05:04,581", "thread_id": "9004", "caller": "0x7fff58520e98", "parentcaller": "0x7fff5859b785", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00030196" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 748 }, { "timestamp": "2026-05-29 01:05:04,581", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 749 }, { "timestamp": "2026-05-29 01:05:04,581", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001fc" }, { "name": "Milliseconds", "value": "5000" } ], "repeated": 0, "id": 750 }, { "timestamp": "2026-05-29 01:05:04,581", "thread_id": "9004", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff584fb0ca", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 751 }, { "timestamp": "2026-05-29 01:05:04,581", "thread_id": "9004", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 752 }, { "timestamp": "2026-05-29 01:05:04,581", "thread_id": "9004", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 753 }, { "timestamp": "2026-05-29 01:05:04,581", "thread_id": "9004", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000244" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 754 }, { "timestamp": "2026-05-29 01:05:04,581", "thread_id": "9004", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00030196" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 755 }, { "timestamp": "2026-05-29 01:05:04,581", "thread_id": "9000", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 756 }, { "timestamp": "2026-05-29 01:05:04,581", "thread_id": "9000", "caller": "0x7fff432c5294", "parentcaller": "0x7fff58535144", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0000034B-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "0000015B-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 757 }, { "timestamp": "2026-05-29 01:05:04,581", "thread_id": "9004", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 758 }, { "timestamp": "2026-05-29 01:05:04,581", "thread_id": "9004", "caller": "0x7fff58520e98", "parentcaller": "0x7fff5859b785", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00030196" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 759 }, { "timestamp": "2026-05-29 01:05:04,581", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 760 }, { "timestamp": "2026-05-29 01:05:04,581", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001fc" }, { "name": "Milliseconds", "value": "5000" } ], "repeated": 0, "id": 761 }, { "timestamp": "2026-05-29 01:05:04,596", "thread_id": "9004", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff584fb0ca", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 762 }, { "timestamp": "2026-05-29 01:05:04,596", "thread_id": "9004", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 763 }, { "timestamp": "2026-05-29 01:05:04,596", "thread_id": "9004", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 764 }, { "timestamp": "2026-05-29 01:05:04,596", "thread_id": "9004", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000244" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 765 }, { "timestamp": "2026-05-29 01:05:04,596", "thread_id": "9004", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00030196" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 766 }, { "timestamp": "2026-05-29 01:05:04,596", "thread_id": "9000", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 767 }, { "timestamp": "2026-05-29 01:05:04,596", "thread_id": "9000", "caller": "0x7fff432c5294", "parentcaller": "0x7fff58535144", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0000034B-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "0000015B-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 768 }, { "timestamp": "2026-05-29 01:05:04,596", "thread_id": "9004", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 769 }, { "timestamp": "2026-05-29 01:05:04,596", "thread_id": "9004", "caller": "0x7fff58520e98", "parentcaller": "0x7fff5859b785", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00030196" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 770 }, { "timestamp": "2026-05-29 01:05:04,596", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 771 }, { "timestamp": "2026-05-29 01:05:04,596", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001fc" }, { "name": "Milliseconds", "value": "5000" } ], "repeated": 0, "id": 772 }, { "timestamp": "2026-05-29 01:05:04,612", "thread_id": "9004", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff584fb0ca", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 773 }, { "timestamp": "2026-05-29 01:05:04,612", "thread_id": "9004", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 774 }, { "timestamp": "2026-05-29 01:05:04,612", "thread_id": "9004", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 775 }, { "timestamp": "2026-05-29 01:05:04,612", "thread_id": "9004", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000244" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 776 }, { "timestamp": "2026-05-29 01:05:04,612", "thread_id": "9004", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00030196" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 777 }, { "timestamp": "2026-05-29 01:05:04,612", "thread_id": "9000", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 778 }, { "timestamp": "2026-05-29 01:05:04,612", "thread_id": "9000", "caller": "0x7fff432c5294", "parentcaller": "0x7fff58535144", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0000034B-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "0000015B-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 779 }, { "timestamp": "2026-05-29 01:05:04,612", "thread_id": "9004", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 780 }, { "timestamp": "2026-05-29 01:05:04,612", "thread_id": "9004", "caller": "0x7fff58520e98", "parentcaller": "0x7fff5859b785", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00030196" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 781 }, { "timestamp": "2026-05-29 01:05:04,612", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 782 }, { "timestamp": "2026-05-29 01:05:04,612", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001fc" }, { "name": "Milliseconds", "value": "5000" } ], "repeated": 0, "id": 783 }, { "timestamp": "2026-05-29 01:05:04,612", "thread_id": "9004", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff584fb0ca", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 784 }, { "timestamp": "2026-05-29 01:05:04,612", "thread_id": "9004", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 785 }, { "timestamp": "2026-05-29 01:05:04,612", "thread_id": "9004", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 786 }, { "timestamp": "2026-05-29 01:05:04,612", "thread_id": "9004", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000244" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 787 }, { "timestamp": "2026-05-29 01:05:04,612", "thread_id": "9004", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00030196" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 788 }, { "timestamp": "2026-05-29 01:05:04,612", "thread_id": "9000", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 789 }, { "timestamp": "2026-05-29 01:05:04,612", "thread_id": "9000", "caller": "0x7fff432c5294", "parentcaller": "0x7fff58535144", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0000034B-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "0000015B-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 790 }, { "timestamp": "2026-05-29 01:05:04,612", "thread_id": "9004", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 791 }, { "timestamp": "2026-05-29 01:05:04,612", "thread_id": "9004", "caller": "0x7fff58520e98", "parentcaller": "0x7fff5859b785", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00030196" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 792 }, { "timestamp": "2026-05-29 01:05:04,612", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 793 }, { "timestamp": "2026-05-29 01:05:04,612", "thread_id": "8632", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001fc" }, { "name": "Milliseconds", "value": "5000" } ], "repeated": 0, "id": 794 }, { "timestamp": "2026-05-29 01:05:09,612", "thread_id": "8632", "caller": "0x7ff6706b1176", "parentcaller": "0x7ff6706b1466", "category": "windows", "api": "PostThreadMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessId", "value": "8636" }, { "name": "ThreadId", "value": "9000" }, { "name": "Message", "value": "1033" } ], "repeated": 0, "id": 795 }, { "timestamp": "2026-05-29 01:05:09,612", "thread_id": "8632", "caller": "0x7ff6706b1176", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000268" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 796 }, { "timestamp": "2026-05-29 01:05:09,612", "thread_id": "9000", "caller": "0x7fff59fa0444", "parentcaller": "0x7fff432dc60f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 797 }, { "timestamp": "2026-05-29 01:05:09,612", "thread_id": "9000", "caller": "0x7fff577ce76a", "parentcaller": "0x7fff432c9248", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 798 }, { "timestamp": "2026-05-29 01:05:09,612", "thread_id": "9000", "caller": "0x7fff577dac31", "parentcaller": "0x7fff432c774b", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fb3410" } ], "repeated": 0, "id": 799 }, { "timestamp": "2026-05-29 01:05:09,612", "thread_id": "9000", "caller": "0x7fff577dac31", "parentcaller": "0x7fff432c774b", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\System32\\thumbcache" }, { "name": "DllBase", "value": "0x7fff432b0000" } ], "repeated": 0, "id": 800 }, { "timestamp": "2026-05-29 01:05:09,612", "thread_id": "9000", "caller": "0x7fff59fa0444", "parentcaller": "0x7fff580a4def", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002dc" } ], "repeated": 0, "id": 801 }, { "timestamp": "2026-05-29 01:05:09,612", "thread_id": "9000", "caller": "0x7fff577ce76a", "parentcaller": "0x7fff5808c408", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 802 }, { "timestamp": "2026-05-29 01:05:09,612", "thread_id": "9000", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5808c3cb", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fb3410" } ], "repeated": 0, "id": 803 }, { "timestamp": "2026-05-29 01:05:09,612", "thread_id": "9000", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5808c3cb", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\System32\\shcore" }, { "name": "DllBase", "value": "0x7fff58070000" } ], "repeated": 0, "id": 804 }, { "timestamp": "2026-05-29 01:05:09,612", "thread_id": "9000", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff58070000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 805 }, { "timestamp": "2026-05-29 01:05:09,612", "thread_id": "9000", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff432b0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 806 }, { "timestamp": "2026-05-29 01:05:09,612", "thread_id": "9000", "caller": "0x7fff577ce76a", "parentcaller": "0x7fff584cea0e", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "oleaut32.dll" }, { "name": "ModuleHandle", "value": "0x7fff58860000" } ], "repeated": 0, "id": 807 }, { "timestamp": "2026-05-29 01:05:09,612", "thread_id": "9000", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff587d1000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 808 }, { "timestamp": "2026-05-29 01:05:09,612", "thread_id": "9000", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff587d1000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 809 }, { "timestamp": "2026-05-29 01:05:09,612", "thread_id": "8632", "caller": "0x7ff6706b1176", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000268" } ], "repeated": 0, "id": 810 }, { "timestamp": "2026-05-29 01:05:09,612", "thread_id": "8632", "caller": "0x7ff6706b1176", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000204" } ], "repeated": 0, "id": 811 }, { "timestamp": "2026-05-29 01:05:09,612", "thread_id": "8632", "caller": "0x7ff6706b1176", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000021c" } ], "repeated": 0, "id": 812 }, { "timestamp": "2026-05-29 01:05:09,612", "thread_id": "8632", "caller": "0x7ff6706b1176", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000020c" } ], "repeated": 0, "id": 813 }, { "timestamp": "2026-05-29 01:05:09,612", "thread_id": "8632", "caller": "0x7ff6706b1176", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000025c" } ], "repeated": 0, "id": 814 }, { "timestamp": "2026-05-29 01:05:09,612", "thread_id": "8632", "caller": "0x7ff6706b1176", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000264" } ], "repeated": 0, "id": 815 }, { "timestamp": "2026-05-29 01:05:09,627", "thread_id": "9000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff58542ec5", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002dc" } ], "repeated": 0, "id": 816 }, { "timestamp": "2026-05-29 01:05:09,627", "thread_id": "9000", "caller": "0x7fff584ccd6e", "parentcaller": "0x7fff58542ed4", "category": "system", "api": "IsDebuggerPresent", "status": false, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 817 }, { "timestamp": "2026-05-29 01:05:09,627", "thread_id": "9000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff58544324", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000274" } ], "repeated": 0, "id": 818 }, { "timestamp": "2026-05-29 01:05:09,627", "thread_id": "9000", "caller": "0x7fff59fa467e", "parentcaller": "0x7fff5781f79a", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "12" }, { "name": "ThreadInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "9000" } ], "repeated": 0, "id": 819 }, { "timestamp": "2026-05-29 01:05:09,627", "thread_id": "9000", "caller": "0x7fff581815b8", "parentcaller": "0x7fff59f69a1d", "category": "misc", "api": "GetKeyboardLayout", "status": true, "return": "0x04090409", "arguments": [ { "name": "KeyboardLayout", "value": "0x00000409" }, { "name": "LanguageName", "value": "English (United States)" } ], "repeated": 0, "id": 820 }, { "timestamp": "2026-05-29 01:05:09,627", "thread_id": "9000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff597be41e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ac" } ], "repeated": 0, "id": 821 }, { "timestamp": "2026-05-29 01:05:09,627", "thread_id": "9000", "caller": "0x7fff577d6785", "parentcaller": "0x7fff597be4e4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a8" } ], "repeated": 0, "id": 822 }, { "timestamp": "2026-05-29 01:05:09,627", "thread_id": "9000", "caller": "0x7fff59fa469e", "parentcaller": "0x7fff5781f79a", "category": "threading", "api": "NtTerminateThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00000000" }, { "name": "ExitStatus", "value": "0x00000000" }, { "name": "ThreadId", "value": "0" }, { "name": "ProcessId", "value": "0" } ], "repeated": 0, "id": 823 }, { "timestamp": "2026-05-29 01:05:09,627", "thread_id": "9004", "caller": "0x7fff597abf07", "parentcaller": "0x7fff597abe66", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 824 }, { "timestamp": "2026-05-29 01:05:09,627", "thread_id": "8632", "caller": "0x7ff6706b1176", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24659010000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 825 }, { "timestamp": "2026-05-29 01:05:09,627", "thread_id": "8632", "caller": "0x7ff6706b1176", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2465903d000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 826 }, { "timestamp": "2026-05-29 01:05:09,627", "thread_id": "8632", "caller": "0x7ff6706b1176", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2465901b000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 827 }, { "timestamp": "2026-05-29 01:05:09,627", "thread_id": "8632", "caller": "0x7ff6706b1176", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2465a9e0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 828 }, { "timestamp": "2026-05-29 01:05:09,627", "thread_id": "8632", "caller": "0x7ff6706b1176", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000022c" } ], "repeated": 0, "id": 829 }, { "timestamp": "2026-05-29 01:05:09,627", "thread_id": "8632", "caller": "0x7ff6706b1176", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000232" } ], "repeated": 0, "id": 830 }, { "timestamp": "2026-05-29 01:05:09,627", "thread_id": "8632", "caller": "0x7ff6706b1176", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "oleaut32.dll" }, { "name": "ModuleHandle", "value": "0x7fff58860000" } ], "repeated": 0, "id": 831 }, { "timestamp": "2026-05-29 01:05:09,627", "thread_id": "8632", "caller": "0x7ff6706b1193", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtTerminateProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "ExitCode", "value": "0x00000000" } ], "repeated": 0, "id": 832 } ], "threads": [ "8632", "8868", "8872", "8908", "8860", "9012", "9008", "9004", "9000", "9204" ], "environ": { "UserName": "admin", "ComputerName": "DESKTOP-74SUV8W", "WindowsPath": "C:\\Windows", "TempPath": "C:\\Users\\admin\\AppData\\Local\\Temp\\", "CommandLine": "C:\\Windows\\system32\\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}", "RegisteredOwner": "", "RegisteredOrganization": "", "ProductName": "", "SystemVolumeSerialNumber": "b34c-3674", "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000", "MachineGUID": "", "MainExeBase": "0x7ff6706b0000", "MainExeSize": "0x00009000", "Bitness": "64-bit" }, "file_activities": { "read_files": [], "write_files": [], "delete_files": [] } }, { "process_id": 2912, "process_name": "msedge.exe", "parent_id": 4484, "module_path": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe", "first_seen": "2026-05-29 01:05:13,275", "calls": [ { "timestamp": "2026-05-29 01:05:13,338", "thread_id": "2780", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\bcryptprimitives" }, { "name": "DllBase", "value": "0x7fff57ef0000" } ], "repeated": 0, "id": 0 }, { "timestamp": "2026-05-29 01:05:13,338", "thread_id": "2780", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\version" }, { "name": "DllBase", "value": "0x7fff43500000" } ], "repeated": 0, "id": 1 }, { "timestamp": "2026-05-29 01:05:13,338", "thread_id": "2780", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\shcore" }, { "name": "DllBase", "value": "0x7fff58070000" } ], "repeated": 0, "id": 2 }, { "timestamp": "2026-05-29 01:05:13,338", "thread_id": "2780", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\System32\\shcore" }, { "name": "DllBase", "value": "0x7fff58070000" } ], "repeated": 0, "id": 3 }, { "timestamp": "2026-05-29 01:05:13,338", "thread_id": "2780", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\Wldp" }, { "name": "DllBase", "value": "0x7fff56fa0000" } ], "repeated": 0, "id": 4 }, { "timestamp": "2026-05-29 01:05:13,338", "thread_id": "2780", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\windows.storage" }, { "name": "DllBase", "value": "0x7fff55710000" } ], "repeated": 0, "id": 5 }, { "timestamp": "2026-05-29 01:05:13,338", "thread_id": "2780", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\SHCORE" }, { "name": "DllBase", "value": "0x7fff58070000" } ], "repeated": 0, "id": 6 }, { "timestamp": "2026-05-29 01:05:13,353", "thread_id": "2780", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\ntmarta" }, { "name": "DllBase", "value": "0x7fff56770000" } ], "repeated": 0, "id": 7 }, { "timestamp": "2026-05-29 01:05:13,588", "thread_id": "2780", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\WINMM" }, { "name": "DllBase", "value": "0x7fff453c0000" } ], "repeated": 0, "id": 8 }, { "timestamp": "2026-05-29 01:05:13,588", "thread_id": "2780", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge" }, { "name": "DllBase", "value": "0x1e76a000000" } ], "repeated": 0, "id": 9 }, { "timestamp": "2026-05-29 01:05:13,603", "thread_id": "2780", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\KBDUS" }, { "name": "DllBase", "value": "0x7fff45010000" } ], "repeated": 0, "id": 10 }, { "timestamp": "2026-05-29 01:05:13,603", "thread_id": "2780", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\KBDUS" }, { "name": "DllBase", "value": "0x7fff45010000" } ], "repeated": 0, "id": 11 }, { "timestamp": "2026-05-29 01:05:13,603", "thread_id": "2780", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\uxtheme" }, { "name": "DllBase", "value": "0x7fff54fc0000" } ], "repeated": 0, "id": 12 }, { "timestamp": "2026-05-29 01:05:13,603", "thread_id": "2780", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\kernel.appcore" }, { "name": "DllBase", "value": "0x7fff55510000" } ], "repeated": 0, "id": 13 }, { "timestamp": "2026-05-29 01:05:13,603", "thread_id": "4156", "caller": "0x7fff577fc5f2", "parentcaller": "0x7fff577f89f3", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000370" }, { "name": "ThreadHandle", "value": "0x0000036c" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=crashpad-handler \"--user-data-dir=C:\\Users\\admin\\AppData\\Local\\Microsoft\\Edge\\User Data\" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler \"--database=C:\\Users\\admin\\AppData\\Local\\Microsoft\\Edge\\User Data\\Crashpad\" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=148.0.7778.180 \"--annotation=exe=C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=148.0.3967.83 --initial-client-data=0x25c,0x34c,0x350,0x20c,0x358,0x7fff18e25d58,0x7fff18e25d64,0x7fff18e25d70" }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "4408" } ], "repeated": 0, "id": 14 }, { "timestamp": "2026-05-29 01:05:13,603", "thread_id": "2780", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\clbcatq" }, { "name": "DllBase", "value": "0x7fff58b30000" } ], "repeated": 0, "id": 15 }, { "timestamp": "2026-05-29 01:05:13,603", "thread_id": "2780", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings" }, { "name": "DllBase", "value": "0x7fff4d010000" } ], "repeated": 0, "id": 16 }, { "timestamp": "2026-05-29 01:05:13,603", "thread_id": "2780", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\msvcp110_win" }, { "name": "DllBase", "value": "0x7fff566c0000" } ], "repeated": 0, "id": 17 }, { "timestamp": "2026-05-29 01:05:13,603", "thread_id": "4156", "caller": "0x7fff577f89f3", "parentcaller": "0x7fff599d7d70", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=crashpad-handler \"--user-data-dir=C:\\Users\\admin\\AppData\\Local\\Microsoft\\Edge\\User Data\" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler \"--database=C:\\Users\\admin\\AppData\\Local\\Microsoft\\Edge\\User Data\\Crashpad\" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=148.0.7778.180 \"--annotation=exe=C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=148.0.3967.83 --initial-client-data=0x25c,0x34c,0x350,0x20c,0x358,0x7fff18e25d58,0x7fff18e25d64,0x7fff18e25d70" }, { "name": "CreationFlags", "value": "0x00080000", "pretty_value": "EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "4408" }, { "name": "ThreadId", "value": "4512" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x00000370" }, { "name": "ThreadHandle", "value": "0x0000036c" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 18 }, { "timestamp": "2026-05-29 01:05:13,603", "thread_id": "2780", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\policymanager" }, { "name": "DllBase", "value": "0x7fff522d0000" } ], "repeated": 0, "id": 19 }, { "timestamp": "2026-05-29 01:05:13,619", "thread_id": "2780", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\policymanager" }, { "name": "DllBase", "value": "0x7fff522d0000" } ], "repeated": 0, "id": 20 }, { "timestamp": "2026-05-29 01:05:13,619", "thread_id": "2780", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\msvcp110_win" }, { "name": "DllBase", "value": "0x7fff566c0000" } ], "repeated": 0, "id": 21 }, { "timestamp": "2026-05-29 01:05:13,619", "thread_id": "2780", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\USERENV" }, { "name": "DllBase", "value": "0x7fff57520000" } ], "repeated": 0, "id": 22 }, { "timestamp": "2026-05-29 01:05:13,619", "thread_id": "2780", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\gpapi" }, { "name": "DllBase", "value": "0x7fff55ec0000" } ], "repeated": 0, "id": 23 }, { "timestamp": "2026-05-29 01:05:13,619", "thread_id": "2780", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\wkscli" }, { "name": "DllBase", "value": "0x7fff56750000" } ], "repeated": 0, "id": 24 }, { "timestamp": "2026-05-29 01:05:13,619", "thread_id": "2780", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\netutils" }, { "name": "DllBase", "value": "0x7fff56a30000" } ], "repeated": 0, "id": 25 }, { "timestamp": "2026-05-29 01:05:13,619", "thread_id": "2780", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\msvcp110_win" }, { "name": "DllBase", "value": "0x7fff566c0000" } ], "repeated": 0, "id": 26 }, { "timestamp": "2026-05-29 01:05:13,619", "thread_id": "2780", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\MDMRegistration" }, { "name": "DllBase", "value": "0x7fff46470000" } ], "repeated": 0, "id": 27 }, { "timestamp": "2026-05-29 01:05:13,619", "thread_id": "2780", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\powrprof" }, { "name": "DllBase", "value": "0x7fff57490000" } ], "repeated": 0, "id": 28 }, { "timestamp": "2026-05-29 01:05:13,619", "thread_id": "2780", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\CRYPTSP" }, { "name": "DllBase", "value": "0x7fff56ef0000" } ], "repeated": 0, "id": 29 }, { "timestamp": "2026-05-29 01:05:13,619", "thread_id": "2780", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\ncrypt" }, { "name": "DllBase", "value": "0x7fff57010000" } ], "repeated": 0, "id": 30 }, { "timestamp": "2026-05-29 01:05:13,619", "thread_id": "2780", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\imagehlp" }, { "name": "DllBase", "value": "0x7fff59ef0000" } ], "repeated": 0, "id": 31 }, { "timestamp": "2026-05-29 01:05:13,619", "thread_id": "2780", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\tbs" }, { "name": "DllBase", "value": "0x7fff4fa10000" } ], "repeated": 0, "id": 32 }, { "timestamp": "2026-05-29 01:05:13,619", "thread_id": "2780", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\DMCmnUtils" }, { "name": "DllBase", "value": "0x7fff42d90000" } ], "repeated": 0, "id": 33 }, { "timestamp": "2026-05-29 01:05:13,619", "thread_id": "2780", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\omadmapi" }, { "name": "DllBase", "value": "0x7fff46fc0000" } ], "repeated": 0, "id": 34 }, { "timestamp": "2026-05-29 01:05:13,619", "thread_id": "2780", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\UMPDC" }, { "name": "DllBase", "value": "0x7fff57470000" } ], "repeated": 0, "id": 35 }, { "timestamp": "2026-05-29 01:05:13,619", "thread_id": "2780", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\NTASN1" }, { "name": "DllBase", "value": "0x7fff56fd0000" } ], "repeated": 0, "id": 36 }, { "timestamp": "2026-05-29 01:05:13,619", "thread_id": "2780", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\MDMRegistration" }, { "name": "DllBase", "value": "0x7fff46470000" } ], "repeated": 0, "id": 37 }, { "timestamp": "2026-05-29 01:05:13,619", "thread_id": "2780", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\omadmapi" }, { "name": "DllBase", "value": "0x7fff46fc0000" } ], "repeated": 0, "id": 38 }, { "timestamp": "2026-05-29 01:05:13,619", "thread_id": "2780", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\msvcp110_win" }, { "name": "DllBase", "value": "0x7fff566c0000" } ], "repeated": 0, "id": 39 }, { "timestamp": "2026-05-29 01:05:13,619", "thread_id": "2780", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\powrprof" }, { "name": "DllBase", "value": "0x7fff57490000" } ], "repeated": 0, "id": 40 }, { "timestamp": "2026-05-29 01:05:13,619", "thread_id": "2780", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\UMPDC" }, { "name": "DllBase", "value": "0x7fff57470000" } ], "repeated": 0, "id": 41 }, { "timestamp": "2026-05-29 01:05:13,619", "thread_id": "2780", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\DMCmnUtils" }, { "name": "DllBase", "value": "0x7fff42d90000" } ], "repeated": 0, "id": 42 }, { "timestamp": "2026-05-29 01:05:13,619", "thread_id": "2780", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\CRYPTSP" }, { "name": "DllBase", "value": "0x7fff56ef0000" } ], "repeated": 0, "id": 43 }, { "timestamp": "2026-05-29 01:05:13,619", "thread_id": "2780", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\ncrypt" }, { "name": "DllBase", "value": "0x7fff57010000" } ], "repeated": 0, "id": 44 }, { "timestamp": "2026-05-29 01:05:13,619", "thread_id": "2780", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\NTASN1" }, { "name": "DllBase", "value": "0x7fff56fd0000" } ], "repeated": 0, "id": 45 }, { "timestamp": "2026-05-29 01:05:13,619", "thread_id": "2780", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\tbs" }, { "name": "DllBase", "value": "0x7fff4fa10000" } ], "repeated": 0, "id": 46 }, { "timestamp": "2026-05-29 01:05:13,619", "thread_id": "2780", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\System32\\imagehlp" }, { "name": "DllBase", "value": "0x7fff59ef0000" } ], "repeated": 0, "id": 47 }, { "timestamp": "2026-05-29 01:05:13,619", "thread_id": "2780", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\netapi32" }, { "name": "DllBase", "value": "0x7fff43550000" } ], "repeated": 0, "id": 48 }, { "timestamp": "2026-05-29 01:05:13,619", "thread_id": "2780", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\msvcp110_win" }, { "name": "DllBase", "value": "0x7fff566c0000" } ], "repeated": 0, "id": 49 }, { "timestamp": "2026-05-29 01:05:13,619", "thread_id": "2780", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\cryptsp" }, { "name": "DllBase", "value": "0x7fff56ef0000" } ], "repeated": 0, "id": 50 }, { "timestamp": "2026-05-29 01:05:13,619", "thread_id": "2780", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\DSREG" }, { "name": "DllBase", "value": "0x7fff52f20000" } ], "repeated": 0, "id": 51 }, { "timestamp": "2026-05-29 01:05:13,634", "thread_id": "2780", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\profapi" }, { "name": "DllBase", "value": "0x7fff57560000" } ], "repeated": 0, "id": 52 }, { "timestamp": "2026-05-29 01:05:13,634", "thread_id": "2780", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\netapi32" }, { "name": "DllBase", "value": "0x7fff43550000" } ], "repeated": 0, "id": 53 }, { "timestamp": "2026-05-29 01:05:13,634", "thread_id": "2780", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\DSREG" }, { "name": "DllBase", "value": "0x7fff52f20000" } ], "repeated": 0, "id": 54 }, { "timestamp": "2026-05-29 01:05:13,634", "thread_id": "2780", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\msvcp110_win" }, { "name": "DllBase", "value": "0x7fff566c0000" } ], "repeated": 0, "id": 55 }, { "timestamp": "2026-05-29 01:05:13,634", "thread_id": "2780", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\cryptsp" }, { "name": "DllBase", "value": "0x7fff56ef0000" } ], "repeated": 0, "id": 56 }, { "timestamp": "2026-05-29 01:05:13,634", "thread_id": "9368", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\AssignedAccessRuntime" }, { "name": "DllBase", "value": "0x7fff4cfa0000" } ], "repeated": 0, "id": 57 }, { "timestamp": "2026-05-29 01:05:13,634", "thread_id": "2780", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\MSCTF" }, { "name": "DllBase", "value": "0x7fff58380000" } ], "repeated": 0, "id": 58 }, { "timestamp": "2026-05-29 01:05:13,634", "thread_id": "9368", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\SystemSettings.DataModel" }, { "name": "DllBase", "value": "0x7fff4d3d0000" } ], "repeated": 0, "id": 59 }, { "timestamp": "2026-05-29 01:05:13,634", "thread_id": "2780", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\powrprof" }, { "name": "DllBase", "value": "0x7fff57490000" } ], "repeated": 0, "id": 60 }, { "timestamp": "2026-05-29 01:05:13,634", "thread_id": "2780", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\UMPDC" }, { "name": "DllBase", "value": "0x7fff57470000" } ], "repeated": 0, "id": 61 }, { "timestamp": "2026-05-29 01:05:13,650", "thread_id": "2780", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\DWrite" }, { "name": "DllBase", "value": "0x7fff49a90000" } ], "repeated": 0, "id": 62 }, { "timestamp": "2026-05-29 01:05:13,650", "thread_id": "9412", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\OneCoreUAPCommonProxyStub" }, { "name": "DllBase", "value": "0x7fff50870000" } ], "repeated": 0, "id": 63 }, { "timestamp": "2026-05-29 01:05:13,650", "thread_id": "2780", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.3636_none_60b6a03d71f818d5\\COMCTL32" }, { "name": "DllBase", "value": "0x7fff44d50000" } ], "repeated": 0, "id": 64 }, { "timestamp": "2026-05-29 01:05:13,650", "thread_id": "2780", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\DPAPI" }, { "name": "DllBase", "value": "0x7fff57350000" } ], "repeated": 0, "id": 65 }, { "timestamp": "2026-05-29 01:05:13,650", "thread_id": "2780", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\IPHLPAPI" }, { "name": "DllBase", "value": "0x7fff569f0000" } ], "repeated": 0, "id": 66 }, { "timestamp": "2026-05-29 01:05:13,650", "thread_id": "2780", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\NLAapi" }, { "name": "DllBase", "value": "0x7fff52960000" } ], "repeated": 0, "id": 67 }, { "timestamp": "2026-05-29 01:05:13,650", "thread_id": "9416", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\CFGMGR32" }, { "name": "DllBase", "value": "0x7fff57750000" } ], "repeated": 0, "id": 68 }, { "timestamp": "2026-05-29 01:05:13,650", "thread_id": "9448", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\StructuredQuery" }, { "name": "DllBase", "value": "0x7fff4b070000" } ], "repeated": 0, "id": 69 }, { "timestamp": "2026-05-29 01:05:13,650", "thread_id": "2780", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\NSI" }, { "name": "DllBase", "value": "0x7fff58b20000" } ], "repeated": 0, "id": 70 }, { "timestamp": "2026-05-29 01:05:13,650", "thread_id": "2780", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\dhcpcsvc6" }, { "name": "DllBase", "value": "0x7fff515c0000" } ], "repeated": 0, "id": 71 }, { "timestamp": "2026-05-29 01:05:13,650", "thread_id": "9448", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\PROPSYS" }, { "name": "DllBase", "value": "0x7fff52860000" } ], "repeated": 0, "id": 72 }, { "timestamp": "2026-05-29 01:05:13,650", "thread_id": "2780", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\dhcpcsvc" }, { "name": "DllBase", "value": "0x7fff515a0000" } ], "repeated": 0, "id": 73 }, { "timestamp": "2026-05-29 01:05:13,650", "thread_id": "2780", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\DNSAPI" }, { "name": "DllBase", "value": "0x7fff56a40000" } ], "repeated": 0, "id": 74 }, { "timestamp": "2026-05-29 01:05:13,666", "thread_id": "9484", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\Windows.StateRepositoryPS" }, { "name": "DllBase", "value": "0x7fff4cbf0000" } ], "repeated": 0, "id": 75 }, { "timestamp": "2026-05-29 01:05:13,666", "thread_id": "2780", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\CoreMessaging" }, { "name": "DllBase", "value": "0x7fff54850000" } ], "repeated": 0, "id": 76 }, { "timestamp": "2026-05-29 01:05:13,666", "thread_id": "2780", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\wintypes" }, { "name": "DllBase", "value": "0x7fff52dc0000" } ], "repeated": 0, "id": 77 }, { "timestamp": "2026-05-29 01:05:13,666", "thread_id": "2780", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\CoreUIComponents" }, { "name": "DllBase", "value": "0x7fff54170000" } ], "repeated": 0, "id": 78 }, { "timestamp": "2026-05-29 01:05:13,666", "thread_id": "2780", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\textinputframework" }, { "name": "DllBase", "value": "0x7fff4b680000" } ], "repeated": 0, "id": 79 }, { "timestamp": "2026-05-29 01:05:13,666", "thread_id": "9448", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\Windows.Storage.Search" }, { "name": "DllBase", "value": "0x7fff4cd70000" } ], "repeated": 0, "id": 80 }, { "timestamp": "2026-05-29 01:05:13,666", "thread_id": "2780", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\twinapi.appcore" }, { "name": "DllBase", "value": "0x7fff517c0000" } ], "repeated": 0, "id": 81 }, { "timestamp": "2026-05-29 01:05:13,666", "thread_id": "9484", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\mssprxy" }, { "name": "DllBase", "value": "0x7fff4cd40000" } ], "repeated": 0, "id": 82 }, { "timestamp": "2026-05-29 01:05:13,666", "thread_id": "2780", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\twinapi" }, { "name": "DllBase", "value": "0x7fff45580000" } ], "repeated": 0, "id": 83 }, { "timestamp": "2026-05-29 01:05:13,681", "thread_id": "2780", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\wevtapi" }, { "name": "DllBase", "value": "0x7fff52420000" } ], "repeated": 0, "id": 84 }, { "timestamp": "2026-05-29 01:05:13,681", "thread_id": "9412", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\edputil" }, { "name": "DllBase", "value": "0x7fff47ab0000" } ], "repeated": 0, "id": 85 }, { "timestamp": "2026-05-29 01:05:13,681", "thread_id": "2780", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\WindowManagementAPI" }, { "name": "DllBase", "value": "0x7fff51a60000" } ], "repeated": 0, "id": 86 }, { "timestamp": "2026-05-29 01:05:13,681", "thread_id": "2780", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\InputHost" }, { "name": "DllBase", "value": "0x7fff4af10000" } ], "repeated": 0, "id": 87 }, { "timestamp": "2026-05-29 01:05:13,681", "thread_id": "2780", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\Windows.UI" }, { "name": "DllBase", "value": "0x7fff4bfb0000" } ], "repeated": 0, "id": 88 }, { "timestamp": "2026-05-29 01:05:13,681", "thread_id": "9368", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\iertutil" }, { "name": "DllBase", "value": "0x7fff4d6a0000" } ], "repeated": 0, "id": 89 }, { "timestamp": "2026-05-29 01:05:13,681", "thread_id": "9368", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\Windows.Web" }, { "name": "DllBase", "value": "0x7fff47980000" } ], "repeated": 0, "id": 90 }, { "timestamp": "2026-05-29 01:05:13,681", "thread_id": "9504", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\WTSAPI32" }, { "name": "DllBase", "value": "0x7fff52b00000" } ], "repeated": 0, "id": 91 }, { "timestamp": "2026-05-29 01:05:13,697", "thread_id": "9504", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\WINSTA" }, { "name": "DllBase", "value": "0x7fff57360000" } ], "repeated": 0, "id": 92 }, { "timestamp": "2026-05-29 01:05:13,697", "thread_id": "9584", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\ColorAdapterClient" }, { "name": "DllBase", "value": "0x7fff515e0000" } ], "repeated": 0, "id": 93 }, { "timestamp": "2026-05-29 01:05:13,697", "thread_id": "9584", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\mscms" }, { "name": "DllBase", "value": "0x7fff51600000" } ], "repeated": 0, "id": 94 }, { "timestamp": "2026-05-29 01:05:13,697", "thread_id": "9368", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\WINHTTP" }, { "name": "DllBase", "value": "0x7fff52560000" } ], "repeated": 0, "id": 95 }, { "timestamp": "2026-05-29 01:05:13,713", "thread_id": "9608", "caller": "0x7fff577fc5f2", "parentcaller": "0x7fff577f9666", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000009fc" }, { "name": "ThreadHandle", "value": "0x00000a00" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --startup-read-main-dll --metrics-shmem-handle=2500,i,17352379975158527417,5452024415252857313,524288 --field-trial-handle=2376,i,2486498761407102215,4751250841002754599,262144 --variations-seed-version --pseudonymization-salt-handle=2380,i,3263214349813826573,14564590449473430223,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2540 /prefetch:3" }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "9648" } ], "repeated": 0, "id": 96 }, { "timestamp": "2026-05-29 01:05:13,713", "thread_id": "9368", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\oneauth" }, { "name": "DllBase", "value": "0x7fff01a30000" } ], "repeated": 0, "id": 97 }, { "timestamp": "2026-05-29 01:05:13,713", "thread_id": "9608", "caller": "0x7fff577f9666", "parentcaller": "0x7fff57fccec4", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --startup-read-main-dll --metrics-shmem-handle=2500,i,17352379975158527417,5452024415252857313,524288 --field-trial-handle=2376,i,2486498761407102215,4751250841002754599,262144 --variations-seed-version --pseudonymization-salt-handle=2380,i,3263214349813826573,14564590449473430223,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2540 /prefetch:3" }, { "name": "CreationFlags", "value": "0x00080000", "pretty_value": "EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "9648" }, { "name": "ThreadId", "value": "9652" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x000009fc" }, { "name": "ThreadHandle", "value": "0x00000a00" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 98 }, { "timestamp": "2026-05-29 01:05:13,713", "thread_id": "9380", "caller": "0x7ff7f5477d66", "parentcaller": "0x7ff7f54781c2", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000a24" }, { "name": "ThreadHandle", "value": "0x000009c0" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --startup-read-main-dll --metrics-shmem-handle=2164,i,17729507851450693562,7945516971294949965,262144 --field-trial-handle=2376,i,2486498761407102215,4751250841002754599,262144 --variations-seed-version --pseudonymization-salt-handle=2380,i,3263214349813826573,14564590449473430223,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2316 /prefetch:2" }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "9704" } ], "repeated": 0, "id": 99 }, { "timestamp": "2026-05-29 01:05:13,713", "thread_id": "9368", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\Secur32" }, { "name": "DllBase", "value": "0x7fff48330000" } ], "repeated": 0, "id": 100 }, { "timestamp": "2026-05-29 01:05:13,713", "thread_id": "9380", "caller": "0x7ff7f5477d66", "parentcaller": "0x7ff7f54781c2", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --startup-read-main-dll --metrics-shmem-handle=2164,i,17729507851450693562,7945516971294949965,262144 --field-trial-handle=2376,i,2486498761407102215,4751250841002754599,262144 --variations-seed-version --pseudonymization-salt-handle=2380,i,3263214349813826573,14564590449473430223,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2316 /prefetch:2" }, { "name": "CreationFlags", "value": "0x0008040c", "pretty_value": "CREATE_SUSPENDED|DETACHED_PROCESS|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "9704" }, { "name": "ThreadId", "value": "9708" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x00000a24" }, { "name": "ThreadHandle", "value": "0x000009c0" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 101 }, { "timestamp": "2026-05-29 01:05:13,728", "thread_id": "2780", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\Windows.UI.Immersive" }, { "name": "DllBase", "value": "0x7fff49d10000" } ], "repeated": 0, "id": 102 }, { "timestamp": "2026-05-29 01:05:13,791", "thread_id": "9372", "caller": "0x7ff7f5477d66", "parentcaller": "0x7ff7f54781c2", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000b14" }, { "name": "ThreadHandle", "value": "0x00000b04" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --startup-read-main-dll --metrics-shmem-handle=2732,i,738588744081239923,13341823937824962432,524288 --field-trial-handle=2376,i,2486498761407102215,4751250841002754599,262144 --variations-seed-version --pseudonymization-salt-handle=2380,i,3263214349813826573,14564590449473430223,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2744 /prefetch:8" }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "9904" } ], "repeated": 0, "id": 103 }, { "timestamp": "2026-05-29 01:05:13,791", "thread_id": "9576", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\LINKINFO" }, { "name": "DllBase", "value": "0x7fff43590000" } ], "repeated": 0, "id": 104 }, { "timestamp": "2026-05-29 01:05:13,806", "thread_id": "9372", "caller": "0x7ff7f5477d66", "parentcaller": "0x7ff7f54781c2", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --startup-read-main-dll --metrics-shmem-handle=2732,i,738588744081239923,13341823937824962432,524288 --field-trial-handle=2376,i,2486498761407102215,4751250841002754599,262144 --variations-seed-version --pseudonymization-salt-handle=2380,i,3263214349813826573,14564590449473430223,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2744 /prefetch:8" }, { "name": "CreationFlags", "value": "0x0008040c", "pretty_value": "CREATE_SUSPENDED|DETACHED_PROCESS|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "9904" }, { "name": "ThreadId", "value": "9908" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x00000b14" }, { "name": "ThreadHandle", "value": "0x00000b04" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 105 }, { "timestamp": "2026-05-29 01:05:13,884", "thread_id": "2780", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\dxgi" }, { "name": "DllBase", "value": "0x7fff55ef0000" } ], "repeated": 0, "id": 106 }, { "timestamp": "2026-05-29 01:05:13,884", "thread_id": "2780", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\d3d11" }, { "name": "DllBase", "value": "0x7fff53070000" } ], "repeated": 0, "id": 107 }, { "timestamp": "2026-05-29 01:05:13,884", "thread_id": "2780", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\dcomp" }, { "name": "DllBase", "value": "0x7fff538a0000" } ], "repeated": 0, "id": 108 }, { "timestamp": "2026-05-29 01:05:13,884", "thread_id": "2780", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\dataexchange" }, { "name": "DllBase", "value": "0x7fff43630000" } ], "repeated": 0, "id": 109 }, { "timestamp": "2026-05-29 01:05:13,916", "thread_id": "9368", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\Windows.System.Profile.RetailInfo" }, { "name": "DllBase", "value": "0x7fff46fb0000" } ], "repeated": 0, "id": 110 }, { "timestamp": "2026-05-29 01:05:13,947", "thread_id": "2780", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\OLEACC" }, { "name": "DllBase", "value": "0x7fff43990000" } ], "repeated": 0, "id": 111 }, { "timestamp": "2026-05-29 01:05:13,947", "thread_id": "9372", "caller": "0x7ff7f5477d66", "parentcaller": "0x7ff7f54781c2", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000ecc" }, { "name": "ThreadHandle", "value": "0x00000ec4" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale=en_AU --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1780016673570366 --launch-time-ticks=40377722 --ssd-no-pressure-read-main-dll --metrics-shmem-handle=3532,i,17405635345557999243,7315870348493156192,2097152 --field-trial-handle=2376,i,2486498761407102215,4751250841002754599,262144 --variations-seed-version --pseudonymization-salt-handle=2380,i,3263214349813826573,14564590449473430223,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3544 /prefetch:1" }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "10100" } ], "repeated": 0, "id": 112 }, { "timestamp": "2026-05-29 01:05:13,947", "thread_id": "9380", "caller": "0x7ff7f5477d66", "parentcaller": "0x7ff7f54781c2", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000e90" }, { "name": "ThreadHandle", "value": "0x00000e84" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale=en_AU --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1780016673570366 --launch-time-ticks=40380842 --skip-read-main-dll --metrics-shmem-handle=3620,i,8132589701981763471,12149817066489070021,2097152 --field-trial-handle=2376,i,2486498761407102215,4751250841002754599,262144 --variations-seed-version --pseudonymization-salt-handle=2380,i,3263214349813826573,14564590449473430223,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3752 /prefetch:1" }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "10116" } ], "repeated": 0, "id": 113 }, { "timestamp": "2026-05-29 01:05:13,947", "thread_id": "2780", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\directmanipulation" }, { "name": "DllBase", "value": "0x7fff488b0000" } ], "repeated": 0, "id": 114 }, { "timestamp": "2026-05-29 01:05:13,947", "thread_id": "9372", "caller": "0x7ff7f5477d66", "parentcaller": "0x7ff7f54781c2", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale=en_AU --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1780016673570366 --launch-time-ticks=40377722 --ssd-no-pressure-read-main-dll --metrics-shmem-handle=3532,i,17405635345557999243,7315870348493156192,2097152 --field-trial-handle=2376,i,2486498761407102215,4751250841002754599,262144 --variations-seed-version --pseudonymization-salt-handle=2380,i,3263214349813826573,14564590449473430223,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3544 /prefetch:1" }, { "name": "CreationFlags", "value": "0x0008040c", "pretty_value": "CREATE_SUSPENDED|DETACHED_PROCESS|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "10100" }, { "name": "ThreadId", "value": "10104" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x00000ecc" }, { "name": "ThreadHandle", "value": "0x00000ec4" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 115 }, { "timestamp": "2026-05-29 01:05:13,947", "thread_id": "9380", "caller": "0x7ff7f5477d66", "parentcaller": "0x7ff7f54781c2", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale=en_AU --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1780016673570366 --launch-time-ticks=40380842 --skip-read-main-dll --metrics-shmem-handle=3620,i,8132589701981763471,12149817066489070021,2097152 --field-trial-handle=2376,i,2486498761407102215,4751250841002754599,262144 --variations-seed-version --pseudonymization-salt-handle=2380,i,3263214349813826573,14564590449473430223,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3752 /prefetch:1" }, { "name": "CreationFlags", "value": "0x0008040c", "pretty_value": "CREATE_SUSPENDED|DETACHED_PROCESS|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "10116" }, { "name": "ThreadId", "value": "10120" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x00000e90" }, { "name": "ThreadHandle", "value": "0x00000e84" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 116 }, { "timestamp": "2026-05-29 01:05:13,978", "thread_id": "10152", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\Windows.Security.Authentication.OnlineId" }, { "name": "DllBase", "value": "0x7fff3ea70000" } ], "repeated": 0, "id": 117 }, { "timestamp": "2026-05-29 01:05:13,978", "thread_id": "10152", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\netapi32" }, { "name": "DllBase", "value": "0x7fff43550000" } ], "repeated": 0, "id": 118 }, { "timestamp": "2026-05-29 01:05:14,041", "thread_id": "2780", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\dwmapi" }, { "name": "DllBase", "value": "0x7fff55220000" } ], "repeated": 0, "id": 119 }, { "timestamp": "2026-05-29 01:05:14,072", "thread_id": "9580", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Edge\\User Data\\Well Known Domains\\1.2.0.0\\well_known_domains" }, { "name": "DllBase", "value": "0x7fff3f8b0000" } ], "repeated": 0, "id": 120 }, { "timestamp": "2026-05-29 01:05:14,088", "thread_id": "9596", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\VCRUNTIME140" }, { "name": "DllBase", "value": "0x7fff46fe0000" } ], "repeated": 0, "id": 121 }, { "timestamp": "2026-05-29 01:05:14,088", "thread_id": "9596", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Edge\\User Data\\Domain Actions\\3.0.0.18\\domain_actions" }, { "name": "DllBase", "value": "0x7fff46430000" } ], "repeated": 0, "id": 122 }, { "timestamp": "2026-05-29 01:05:14,088", "thread_id": "9876", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\Windows.Security.Authentication.Web.Core" }, { "name": "DllBase", "value": "0x7fff456d0000" } ], "repeated": 0, "id": 123 }, { "timestamp": "2026-05-29 01:05:14,088", "thread_id": "9416", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\OneCoreCommonProxyStub" }, { "name": "DllBase", "value": "0x7fff48780000" } ], "repeated": 0, "id": 124 }, { "timestamp": "2026-05-29 01:05:14,088", "thread_id": "9416", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\vaultcli" }, { "name": "DllBase", "value": "0x7fff3e730000" } ], "repeated": 0, "id": 125 }, { "timestamp": "2026-05-29 01:05:14,103", "thread_id": "10204", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\MicrosoftAccountWAMExtension" }, { "name": "DllBase", "value": "0x7fff3f7a0000" } ], "repeated": 0, "id": 126 }, { "timestamp": "2026-05-29 01:05:14,119", "thread_id": "9368", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\MSASN1" }, { "name": "DllBase", "value": "0x7fff57130000" } ], "repeated": 0, "id": 127 }, { "timestamp": "2026-05-29 01:05:14,119", "thread_id": "9368", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\CRYPTSP" }, { "name": "DllBase", "value": "0x7fff56ef0000" } ], "repeated": 0, "id": 128 }, { "timestamp": "2026-05-29 01:05:14,119", "thread_id": "9368", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\rsaenh" }, { "name": "DllBase", "value": "0x7fff56630000" } ], "repeated": 0, "id": 129 }, { "timestamp": "2026-05-29 01:05:15,650", "thread_id": "9368", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\msvcp110_win" }, { "name": "DllBase", "value": "0x7fff566c0000" } ], "repeated": 0, "id": 130 }, { "timestamp": "2026-05-29 01:05:15,713", "thread_id": "9368", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\policymanager" }, { "name": "DllBase", "value": "0x7fff522d0000" } ], "repeated": 0, "id": 131 }, { "timestamp": "2026-05-29 01:05:15,713", "thread_id": "9368", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\policymanager" }, { "name": "DllBase", "value": "0x7fff522d0000" } ], "repeated": 0, "id": 132 }, { "timestamp": "2026-05-29 01:05:15,713", "thread_id": "9368", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\msvcp110_win" }, { "name": "DllBase", "value": "0x7fff566c0000" } ], "repeated": 0, "id": 133 }, { "timestamp": "2026-05-29 01:05:17,728", "thread_id": "9360", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\sxs" }, { "name": "DllBase", "value": "0x7fff573c0000" } ], "repeated": 0, "id": 134 }, { "timestamp": "2026-05-29 01:05:17,759", "thread_id": "2780", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\RMCLIENT" }, { "name": "DllBase", "value": "0x7fff55410000" } ], "repeated": 0, "id": 135 }, { "timestamp": "2026-05-29 01:05:17,759", "thread_id": "2780", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\XmlLite" }, { "name": "DllBase", "value": "0x7fff523e0000" } ], "repeated": 0, "id": 136 }, { "timestamp": "2026-05-29 01:05:17,759", "thread_id": "2780", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\wpnapps" }, { "name": "DllBase", "value": "0x7fff40fb0000" } ], "repeated": 0, "id": 137 }, { "timestamp": "2026-05-29 01:05:17,791", "thread_id": "9360", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\usermgrcli" }, { "name": "DllBase", "value": "0x7fff52490000" } ], "repeated": 0, "id": 138 }, { "timestamp": "2026-05-29 01:05:17,791", "thread_id": "9360", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\Windows.Internal.UI.Shell.WindowTabManager" }, { "name": "DllBase", "value": "0x7fff409a0000" } ], "repeated": 0, "id": 139 }, { "timestamp": "2026-05-29 01:05:18,416", "thread_id": "2780", "caller": "0x7ff7f5420661", "parentcaller": "0x7ff7f541f1a0", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001478" }, { "name": "ThreadHandle", "value": "0x00000c94" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --no-startup-window" }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "11768" } ], "repeated": 0, "id": 140 } ], "threads": [ "2780", "4156", "9368", "9412", "9416", "9448", "9484", "9504", "9584", "9608", "9380", "9372", "9576", "10152", "9580", "9596", "9876", "10204", "9360" ], "environ": { "UserName": "admin", "ComputerName": "DESKTOP-74SUV8W", "WindowsPath": "C:\\Windows", "TempPath": "C:\\Users\\admin\\AppData\\Local\\Temp\\", "CommandLine": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" \"d\"", "RegisteredOwner": "", "RegisteredOrganization": "", "ProductName": "", "SystemVolumeSerialNumber": "b34c-3674", "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000", "MachineGUID": "", "MainExeBase": "0x7ff7f5380000", "MainExeSize": "0x00505000", "Bitness": "64-bit" }, "file_activities": { "read_files": [], "write_files": [], "delete_files": [] } }, { "process_id": 676, "process_name": "services.exe", "parent_id": 556, "module_path": "C:\\Windows\\System32\\services.exe", "first_seen": "2026-05-29 01:05:15,072", "calls": [ { "timestamp": "2026-05-29 01:05:16,541", "thread_id": "4436", "caller": "0x7ff7839a400a", "parentcaller": "0x7ff7839b9e14", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000008d0" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000ac4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 0 }, { "timestamp": "2026-05-29 01:05:16,541", "thread_id": "4136", "caller": "0x7ff7839a400a", "parentcaller": "0x7ff7839b9e14", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000008d0" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000ac0" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1 }, { "timestamp": "2026-05-29 01:05:16,697", "thread_id": "4136", "caller": "0x7ff7839a400a", "parentcaller": "0x7ff7839b9e14", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000368" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000a60" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 2 }, { "timestamp": "2026-05-29 01:05:16,791", "thread_id": "4136", "caller": "0x7ff7839b4ddc", "parentcaller": "0x7ff7839a9473", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000a68" }, { "name": "ThreadHandle", "value": "0x000009fc" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\elevation_service.exe" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\elevation_service.exe\"" }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "140733193398464" } ], "repeated": 0, "id": 3 }, { "timestamp": "2026-05-29 01:05:16,838", "thread_id": "4136", "caller": "0x7ff7839b4ddc", "parentcaller": "0x7ff7839a9473", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\Wldp" }, { "name": "DllBase", "value": "0x7fff56fa0000" } ], "repeated": 0, "id": 4 }, { "timestamp": "2026-05-29 01:05:16,838", "thread_id": "4136", "caller": "0x7ff7839b4ddc", "parentcaller": "0x7ff7839a9473", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\windows.storage" }, { "name": "DllBase", "value": "0x7fff55710000" } ], "repeated": 0, "id": 5 }, { "timestamp": "2026-05-29 01:05:16,853", "thread_id": "4136", "caller": "0x7ff7839b4ddc", "parentcaller": "0x7ff7839a9473", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\SHCORE" }, { "name": "DllBase", "value": "0x7fff58070000" } ], "repeated": 0, "id": 6 }, { "timestamp": "2026-05-29 01:05:16,931", "thread_id": "4436", "caller": "0x7ff7839a400a", "parentcaller": "0x7ff7839b9e14", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000368" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000b18" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 7 }, { "timestamp": "2026-05-29 01:05:17,181", "thread_id": "4436", "caller": "0x7ff7839a400a", "parentcaller": "0x7ff7839b9e14", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000368" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000b1c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 8 }, { "timestamp": "2026-05-29 01:05:17,197", "thread_id": "4136", "caller": "0x7ff7839b4ddc", "parentcaller": "0x7ff7839a9473", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\elevation_service.exe\"" }, { "name": "CreationFlags", "value": "0x0008040c", "pretty_value": "CREATE_SUSPENDED|DETACHED_PROCESS|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "10432" }, { "name": "ThreadId", "value": "10428" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x00000a68" }, { "name": "ThreadHandle", "value": "0x000009fc" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9 }, { "timestamp": "2026-05-29 01:05:17,338", "thread_id": "4136", "caller": "0x7ff7839b5593", "parentcaller": "0x7ff7839a9473", "category": "threading", "api": "NtResumeThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x000009fc" }, { "name": "SuspendCount", "value": "1" }, { "name": "ThreadId", "value": "10428" }, { "name": "ProcessId", "value": "10432" } ], "repeated": 0, "id": 10 }, { "timestamp": "2026-05-29 01:05:17,681", "thread_id": "4136", "caller": "0x7ff7839a400a", "parentcaller": "0x7ff7839b9e14", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000a68" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000009e4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 11 }, { "timestamp": "2026-05-29 01:05:17,853", "thread_id": "2968", "caller": "0x7ff7839b9924", "parentcaller": "0x7ff7839b97f5", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000a68" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000ac4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 12 }, { "timestamp": "2026-05-29 01:05:19,822", "thread_id": "4136", "caller": "0x7ff7839b4ddc", "parentcaller": "0x7ff7839a9473", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000ab8" }, { "name": "ThreadHandle", "value": "0x00000b1c" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\elevation_service.exe" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\elevation_service.exe\"" }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "140733193399660" } ], "repeated": 0, "id": 13 }, { "timestamp": "2026-05-29 01:05:20,978", "thread_id": "4136", "caller": "0x7ff7839b4ddc", "parentcaller": "0x7ff7839a9473", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\elevation_service.exe\"" }, { "name": "CreationFlags", "value": "0x0008040c", "pretty_value": "CREATE_SUSPENDED|DETACHED_PROCESS|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "11628" }, { "name": "ThreadId", "value": "9840" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x00000ab8" }, { "name": "ThreadHandle", "value": "0x00000b1c" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 14 } ], "threads": [ "4436", "4136", "2968" ], "environ": { "UserName": "SYSTEM", "ComputerName": "DESKTOP-74SUV8W", "WindowsPath": "C:\\Windows", "TempPath": "C:\\Windows\\TEMP\\", "CommandLine": "C:\\Windows\\system32\\services.exe", "RegisteredOwner": "", "RegisteredOrganization": "", "ProductName": "", "SystemVolumeSerialNumber": "b34c-3674", "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000", "MachineGUID": "", "MainExeBase": "0x7ff7839a0000", "MainExeSize": "0x000b0000", "Bitness": "64-bit" }, "file_activities": { "read_files": [], "write_files": [], "delete_files": [] } }, { "process_id": 11260, "process_name": "powershell.exe", "parent_id": 4484, "module_path": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", "first_seen": "2026-05-29 01:05:17,321", "calls": [ { "timestamp": "2026-05-29 01:05:17,415", "thread_id": "9696", "caller": "0x7fff59fbc2c7", "parentcaller": "0x7fff59fbc05a", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\atl" }, { "name": "BaseAddress", "value": "0x7fff46410000" }, { "name": "InitRoutine", "value": "0x7fff46411d50" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 0 }, { "timestamp": "2026-05-29 01:05:17,415", "thread_id": "9696", "caller": "0x7fff3f9af3f0", "parentcaller": "0x7fff3f9abe2a", "category": "misc", "api": "HeapCreate", "status": true, "return": "0x1f5c3790000", "arguments": [ { "name": "Options", "value": "0" }, { "name": "InitialSize", "value": "0x00001000" }, { "name": "MaximumSize", "value": "0x00000000" } ], "repeated": 0, "id": 1 }, { "timestamp": "2026-05-29 01:05:17,415", "thread_id": "9696", "caller": "0x7fff3f9abe49", "parentcaller": "0x7fff3f9abff1", "category": "misc", "api": "GetCommandLineA", "status": true, "return": "0x1f5c0393520", "arguments": [ { "name": "CommandLine", "value": "\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" " } ], "repeated": 0, "id": 2 }, { "timestamp": "2026-05-29 01:05:17,415", "thread_id": "9696", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1f5c3792000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3 }, { "timestamp": "2026-05-29 01:05:17,415", "thread_id": "9696", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1f5c3793000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4 }, { "timestamp": "2026-05-29 01:05:17,415", "thread_id": "9696", "caller": "0x7fff577ced78", "parentcaller": "0x7fff3f99203e", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000234" }, { "name": "MutexName", "value": "" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 5 }, { "timestamp": "2026-05-29 01:05:17,415", "thread_id": "9696", "caller": "0x7fff3f992068", "parentcaller": "0x7fff3f9815ac", "category": "misc", "api": "GetSystemInfo", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 6 }, { "timestamp": "2026-05-29 01:05:17,415", "thread_id": "9696", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1f5c3795000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7 }, { "timestamp": "2026-05-29 01:05:17,415", "thread_id": "9696", "caller": "0x7fff59fccc72", "parentcaller": "0x7fff59f938c0", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000238" }, { "name": "DesiredAccess", "value": "0x00000009", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Control\\Session Manager" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Session Manager" } ], "repeated": 0, "id": 8 }, { "timestamp": "2026-05-29 01:05:17,415", "thread_id": "9696", "caller": "0x7fff59fccca1", "parentcaller": "0x7fff59f938c0", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000238" }, { "name": "ValueName", "value": "ResourcePolicies" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Session Manager\\ResourcePolicies" } ], "repeated": 0, "id": 9 }, { "timestamp": "2026-05-29 01:05:17,415", "thread_id": "9696", "caller": "0x7fff59fcccb7", "parentcaller": "0x7fff59f938c0", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000238" } ], "repeated": 0, "id": 10 }, { "timestamp": "2026-05-29 01:05:17,415", "thread_id": "9696", "caller": "0x7fff59f948aa", "parentcaller": "0x7fff59f94b80", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1f5c1ec0000" }, { "name": "RegionSize", "value": "0x00032000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 11 }, { "timestamp": "2026-05-29 01:05:17,415", "thread_id": "9696", "caller": "0x7fff59f94901", "parentcaller": "0x7fff59f94b80", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1f5c1ec0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 12 }, { "timestamp": "2026-05-29 01:05:17,415", "thread_id": "9696", "caller": "0x7fff59f94901", "parentcaller": "0x7fff59f94b80", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\mscoree" }, { "name": "BaseAddress", "value": "0x7fff3f980000" }, { "name": "InitRoutine", "value": "0x7fff3f9abd50" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 13 }, { "timestamp": "2026-05-29 01:05:17,415", "thread_id": "9696", "caller": "0x7fff59fc507d", "parentcaller": "0x7fff59fc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 14 }, { "timestamp": "2026-05-29 01:05:17,415", "thread_id": "11004", "caller": "0x7fff59faeb32", "parentcaller": "0x7fff59f677c3", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000038" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 2, "id": 15 }, { "timestamp": "2026-05-29 01:05:17,415", "thread_id": "11016", "caller": "0x7fff577b7861", "parentcaller": "0x7fff577b7530", "category": "device", "api": "NtDeviceIoControlFile", "status": false, "return": "0xffffffffc00700bb", "arguments": [ { "name": "FileHandle", "value": "0x00000054" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\n\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\xe0\\xf0/\\x12l\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe8\\xf0/\\x12l\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 16 }, { "timestamp": "2026-05-29 01:05:17,415", "thread_id": "11004", "caller": "0x7fff577b7861", "parentcaller": "0x7fff577b7530", "category": "device", "api": "NtDeviceIoControlFile", "status": false, "return": "0xffffffffc00700bb", "arguments": [ { "name": "FileHandle", "value": "0x00000054" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xebG\\x12l\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\xebG\\x12l\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 17 }, { "timestamp": "2026-05-29 01:05:17,415", "thread_id": "11016", "caller": "0x7fff59fc507d", "parentcaller": "0x7fff59fc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 18 }, { "timestamp": "2026-05-29 01:05:17,415", "thread_id": "11016", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7fff1a5f1a00" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 19 }, { "timestamp": "2026-05-29 01:05:17,415", "thread_id": "11004", "caller": "0x7fff59fc507d", "parentcaller": "0x7fff59fc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 20 }, { "timestamp": "2026-05-29 01:05:17,415", "thread_id": "11004", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7fff1a5f1ed0" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 21 }, { "timestamp": "2026-05-29 01:05:17,415", "thread_id": "11008", "caller": "0x7fff577b7861", "parentcaller": "0x7fff577b7530", "category": "device", "api": "NtDeviceIoControlFile", "status": false, "return": "0xffffffffc00700bb", "arguments": [ { "name": "FileHandle", "value": "0x00000054" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\n\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\xa0\\xed?\\x12l\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa8\\xed?\\x12l\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 22 }, { "timestamp": "2026-05-29 01:05:17,415", "thread_id": "11008", "caller": "0x7fff59fc507d", "parentcaller": "0x7fff59fc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 23 }, { "timestamp": "2026-05-29 01:05:17,415", "thread_id": "11008", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7fff1a5f2030" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 24 }, { "timestamp": "2026-05-29 01:05:17,415", "thread_id": "11012", "caller": "0x7fff577b7861", "parentcaller": "0x7fff577b7530", "category": "device", "api": "NtDeviceIoControlFile", "status": false, "return": "0xffffffffc00700bb", "arguments": [ { "name": "FileHandle", "value": "0x00000054" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xf27\\x12l\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\xf27\\x12l\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 25 }, { "timestamp": "2026-05-29 01:05:17,415", "thread_id": "11012", "caller": "0x7fff59fc507d", "parentcaller": "0x7fff59fc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 26 }, { "timestamp": "2026-05-29 01:05:17,415", "thread_id": "11012", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7fff1a5f1e10" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 27 }, { "timestamp": "2026-05-29 01:05:17,415", "thread_id": "9696", "caller": "0x7ff7e4154d21", "parentcaller": "0x7ff7e41545e9", "category": "hooking", "api": "SetUnhandledExceptionFilter", "status": true, "return": "0x00000001", "arguments": [ { "name": "ExceptionFilter", "value": "0x7ff7e4154cd0" } ], "repeated": 0, "id": 28 }, { "timestamp": "2026-05-29 01:05:17,415", "thread_id": "9696", "caller": "0x7ff7e415452e", "parentcaller": "0x7ff7e4154629", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1f5c1d77000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 29 }, { "timestamp": "2026-05-29 01:05:17,415", "thread_id": "9696", "caller": "0x7ff7e415202a", "parentcaller": "0x7ff7e415468d", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000054" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xf7\\xec\\x11l\\x00\\x00\\x00\\x08\\x00\\x00\\x00l\\x00\\x00\\x00X\\xf7\\xec\\x11l\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 30 }, { "timestamp": "2026-05-29 01:05:17,415", "thread_id": "9696", "caller": "0x7ff7e415ec8a", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "LdrGetDllHandle", "status": false, "return": "0xffffffffc0000135", "pretty_return": "DLL_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\system32\\rpcss.dll" }, { "name": "ModuleHandle", "value": "0x00000000" } ], "repeated": 0, "id": 31 }, { "timestamp": "2026-05-29 01:05:17,415", "thread_id": "9696", "caller": "0x7ff7e415ec8a", "parentcaller": "0x7ff7e415205e", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "0", "pretty_value": "FILE_SUPERSEDE" } ], "repeated": 0, "id": 32 }, { "timestamp": "2026-05-29 01:05:17,415", "thread_id": "9696", "caller": "0x7ff7e415ec8a", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "93" }, { "name": "ProcessInformation", "value": "\\x7f7\\x9e}" } ], "repeated": 0, "id": 33 }, { "timestamp": "2026-05-29 01:05:17,415", "thread_id": "9696", "caller": "0x7ff7e415ec8a", "parentcaller": "0x7ff7e415205e", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "42" }, { "name": "ThreadInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "9696" } ], "repeated": 0, "id": 34 }, { "timestamp": "2026-05-29 01:05:17,415", "thread_id": "9696", "caller": "0x7ff7e415ec8a", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "kernel.appcore.dll" } ], "repeated": 0, "id": 35 }, { "timestamp": "2026-05-29 01:05:17,415", "thread_id": "9696", "caller": "0x7ff7e415ec8a", "parentcaller": "0x7ff7e415205e", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\kernel.appcore.dll" } ], "repeated": 0, "id": 36 }, { "timestamp": "2026-05-29 01:05:17,415", "thread_id": "9696", "caller": "0x7ff7e415ec8a", "parentcaller": "0x7ff7e415205e", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000244" }, { "name": "DesiredAccess", "value": "0x00100021", "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\kernel.appcore.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 37 }, { "timestamp": "2026-05-29 01:05:17,415", "thread_id": "9696", "caller": "0x7ff7e415ec8a", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000248" }, { "name": "DesiredAccess", "value": "0x0000000d", "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x00000244" }, { "name": "FileName", "value": "C:\\Windows\\System32\\kernel.appcore.dll" } ], "repeated": 0, "id": 38 }, { "timestamp": "2026-05-29 01:05:17,415", "thread_id": "9696", "caller": "0x7ff7e415ec8a", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000248" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55510000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00012000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 39 }, { "timestamp": "2026-05-29 01:05:17,415", "thread_id": "9696", "caller": "0x7ff7e415ec8a", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5551f000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 40 }, { "timestamp": "2026-05-29 01:05:17,415", "thread_id": "9696", "caller": "0x7ff7e415ec8a", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55515000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 41 }, { "timestamp": "2026-05-29 01:05:17,415", "thread_id": "9696", "caller": "0x7ff7e415ec8a", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55515000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 42 }, { "timestamp": "2026-05-29 01:05:17,415", "thread_id": "9696", "caller": "0x7ff7e415ec8a", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55515000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 43 }, { "timestamp": "2026-05-29 01:05:17,415", "thread_id": "9696", "caller": "0x7ff7e415ec8a", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55515000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 44 }, { "timestamp": "2026-05-29 01:05:17,415", "thread_id": "9696", "caller": "0x7ff7e415ec8a", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55515000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 45 }, { "timestamp": "2026-05-29 01:05:17,415", "thread_id": "9696", "caller": "0x7ff7e415ec8a", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000248" } ], "repeated": 0, "id": 46 }, { "timestamp": "2026-05-29 01:05:17,415", "thread_id": "9696", "caller": "0x7ff7e415ec8a", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000244" } ], "repeated": 0, "id": 47 }, { "timestamp": "2026-05-29 01:05:17,415", "thread_id": "9696", "caller": "0x7ff7e415ec8a", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55515000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 48 }, { "timestamp": "2026-05-29 01:05:17,415", "thread_id": "9696", "caller": "0x7ff7e415ec8a", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\kernel.appcore" }, { "name": "DllBase", "value": "0x7fff55510000" } ], "repeated": 0, "id": 49 }, { "timestamp": "2026-05-29 01:05:17,430", "thread_id": "9696", "caller": "0x7ff7e415ec8a", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\kernel.appcore" }, { "name": "BaseAddress", "value": "0x7fff55510000" }, { "name": "InitRoutine", "value": "0x7fff55513f10" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 50 }, { "timestamp": "2026-05-29 01:05:17,430", "thread_id": "9696", "caller": "0x7ff7e415ec8a", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff587d1000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 51 }, { "timestamp": "2026-05-29 01:05:17,430", "thread_id": "9696", "caller": "0x7ff7e415ec8a", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff587d1000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 52 }, { "timestamp": "2026-05-29 01:05:17,430", "thread_id": "9696", "caller": "0x7ff7e415ec8a", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "93" }, { "name": "ProcessInformation", "value": "\\x7f7\\x9e}" } ], "repeated": 0, "id": 53 }, { "timestamp": "2026-05-29 01:05:17,430", "thread_id": "9696", "caller": "0x7ff7e415ec8a", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000022c" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "bcryptPrimitives.dll" } ], "repeated": 0, "id": 54 }, { "timestamp": "2026-05-29 01:05:17,430", "thread_id": "9696", "caller": "0x7ff7e415ec8a", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000022c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57ef0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00082000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 55 }, { "timestamp": "2026-05-29 01:05:17,430", "thread_id": "9696", "caller": "0x7ff7e415ec8a", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57f57000" }, { "name": "ModuleName", "value": "bcryptPrimitives.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 56 }, { "timestamp": "2026-05-29 01:05:17,430", "thread_id": "9696", "caller": "0x7ff7e415ec8a", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57f57000" }, { "name": "ModuleName", "value": "bcryptPrimitives.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 57 }, { "timestamp": "2026-05-29 01:05:17,430", "thread_id": "9696", "caller": "0x7ff7e415ec8a", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57f57000" }, { "name": "ModuleName", "value": "bcryptPrimitives.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 58 }, { "timestamp": "2026-05-29 01:05:17,430", "thread_id": "9696", "caller": "0x7ff7e415ec8a", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57f57000" }, { "name": "ModuleName", "value": "bcryptPrimitives.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 59 }, { "timestamp": "2026-05-29 01:05:17,430", "thread_id": "9696", "caller": "0x7ff7e415ec8a", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57f57000" }, { "name": "ModuleName", "value": "bcryptPrimitives.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 60 }, { "timestamp": "2026-05-29 01:05:17,430", "thread_id": "9696", "caller": "0x7ff7e415ec8a", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000022c" } ], "repeated": 0, "id": 61 }, { "timestamp": "2026-05-29 01:05:17,430", "thread_id": "9696", "caller": "0x7ff7e415ec8a", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57f57000" }, { "name": "ModuleName", "value": "bcryptPrimitives.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 62 }, { "timestamp": "2026-05-29 01:05:17,430", "thread_id": "9696", "caller": "0x7ff7e415ec8a", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\bcryptPrimitives" }, { "name": "DllBase", "value": "0x7fff57ef0000" } ], "repeated": 0, "id": 63 }, { "timestamp": "2026-05-29 01:05:17,430", "thread_id": "9696", "caller": "0x7ff7e415ec8a", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000228" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy" } ], "repeated": 0, "id": 64 }, { "timestamp": "2026-05-29 01:05:17,430", "thread_id": "9696", "caller": "0x7ff7e415ec8a", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000228" }, { "name": "ValueName", "value": "STE" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\STE" } ], "repeated": 0, "id": 65 }, { "timestamp": "2026-05-29 01:05:17,430", "thread_id": "9696", "caller": "0x7ff7e415ec8a", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000228" } ], "repeated": 0, "id": 66 }, { "timestamp": "2026-05-29 01:05:17,430", "thread_id": "9696", "caller": "0x7ff7e415ec8a", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000228" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy" } ], "repeated": 0, "id": 67 }, { "timestamp": "2026-05-29 01:05:17,430", "thread_id": "9696", "caller": "0x7ff7e415ec8a", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000228" }, { "name": "ValueName", "value": "Enabled" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled" } ], "repeated": 0, "id": 68 }, { "timestamp": "2026-05-29 01:05:17,430", "thread_id": "9696", "caller": "0x7ff7e415ec8a", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000224" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Lsa" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa" } ], "repeated": 0, "id": 69 }, { "timestamp": "2026-05-29 01:05:17,430", "thread_id": "9696", "caller": "0x7ff7e415ec8a", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000224" }, { "name": "ValueName", "value": "FipsAlgorithmPolicy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy" } ], "repeated": 0, "id": 70 }, { "timestamp": "2026-05-29 01:05:17,430", "thread_id": "9696", "caller": "0x7ff7e415ec8a", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000228" }, { "name": "ValueName", "value": "MDMEnabled" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\MDMEnabled" } ], "repeated": 0, "id": 71 }, { "timestamp": "2026-05-29 01:05:17,430", "thread_id": "9696", "caller": "0x7ff7e415ec8a", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000228" } ], "repeated": 0, "id": 72 }, { "timestamp": "2026-05-29 01:05:17,430", "thread_id": "9696", "caller": "0x7ff7e415ec8a", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000224" } ], "repeated": 0, "id": 73 }, { "timestamp": "2026-05-29 01:05:17,430", "thread_id": "9696", "caller": "0x7ff7e415ec8a", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "NtOpenKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Policies\\Microsoft\\Cryptography\\Configuration" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Policies\\Microsoft\\Cryptography\\Configuration" } ], "repeated": 0, "id": 74 }, { "timestamp": "2026-05-29 01:05:17,430", "thread_id": "9696", "caller": "0x7ff7e415ec8a", "parentcaller": "0x7ff7e415205e", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000224" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "\\Device\\CNG" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 75 }, { "timestamp": "2026-05-29 01:05:17,430", "thread_id": "9696", "caller": "0x7ff7e415ec8a", "parentcaller": "0x7ff7e415205e", "category": "device", "api": "DeviceIoControl", "status": true, "return": "0x00000001", "arguments": [ { "name": "DeviceHandle", "value": "0x00000224" }, { "name": "IoControlCode", "value": "0x00390008", "pretty_value": "IOCTL_KSEC_RANDOM_FILL_BUFFER" }, { "name": "InBuffer", "value": "" }, { "name": "OutBuffer", "value": "\\x9be\\x1a\\x86\\x0e\\xf8xV\\xa1\\x86\\xf0y\\xf8\\xd8\\xf5HO\\x96(\\xb60\\xda\\xa3\\xa2\\xac\\xca\\xbeE\\x06C\\xaa\\x82#\\x84p\\xd6\\xe7\\xbe\\x8f\r\\x80\\x05\\Mc\\xfb8A" } ], "repeated": 0, "id": 76 }, { "timestamp": "2026-05-29 01:05:17,430", "thread_id": "9696", "caller": "0x7ff7e415ec8a", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\bcryptprimitives" }, { "name": "BaseAddress", "value": "0x7fff57ef0000" }, { "name": "InitRoutine", "value": "0x7fff57f28b60" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 77 }, { "timestamp": "2026-05-29 01:05:17,430", "thread_id": "9696", "caller": "0x7ff7e415ec8a", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5987e000" }, { "name": "ModuleName", "value": "RPCRT4.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 78 }, { "timestamp": "2026-05-29 01:05:17,430", "thread_id": "9696", "caller": "0x7ff7e415ec8a", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5987e000" }, { "name": "ModuleName", "value": "RPCRT4.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 79 }, { "timestamp": "2026-05-29 01:05:17,430", "thread_id": "9696", "caller": "0x7ff7e415ec8a", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1f5c03ba000" }, { "name": "RegionSize", "value": "0x00006000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 80 }, { "timestamp": "2026-05-29 01:05:17,430", "thread_id": "9696", "caller": "0x7ff7e415ec8a", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff587d1000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 81 }, { "timestamp": "2026-05-29 01:05:17,430", "thread_id": "9696", "caller": "0x7ff7e415ec8a", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff587d1000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 82 }, { "timestamp": "2026-05-29 01:05:17,430", "thread_id": "9696", "caller": "0x7ff7e415ec8a", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\uxtheme" }, { "name": "DllBase", "value": "0x7fff54fc0000" } ], "repeated": 0, "id": 83 }, { "timestamp": "2026-05-29 01:05:17,430", "thread_id": "9696", "caller": "0x7ff7e415ec8a", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\uxtheme.dll" }, { "name": "BaseAddress", "value": "0x7fff54fc0000" } ], "repeated": 0, "id": 84 }, { "timestamp": "2026-05-29 01:05:17,430", "thread_id": "9696", "caller": "0x7ff7e415ec8a", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff54fc0000", "arguments": [ { "name": "lpLibFileName", "value": "C:\\Windows\\system32\\uxtheme.dll" }, { "name": "dwFlags", "value": "0x00000008" } ], "repeated": 0, "id": 85 }, { "timestamp": "2026-05-29 01:05:17,430", "thread_id": "9696", "caller": "0x7ff7e415ec8a", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "uxtheme.dll" }, { "name": "ModuleHandle", "value": "0x7fff54fc0000" }, { "name": "FunctionName", "value": "ThemeInitApiHook" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff54fccde0" } ], "repeated": 0, "id": 86 }, { "timestamp": "2026-05-29 01:05:17,430", "thread_id": "9696", "caller": "0x7ff7e415ec8a", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "IsDebuggerPresent", "status": false, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 87 }, { "timestamp": "2026-05-29 01:05:17,430", "thread_id": "9696", "caller": "0x7ff7e415ec8a", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "p\\xeb\\xec\\x11l\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 88 }, { "timestamp": "2026-05-29 01:05:17,430", "thread_id": "9696", "caller": "0x7ff7e415ec8a", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000254" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 89 }, { "timestamp": "2026-05-29 01:05:17,430", "thread_id": "9696", "caller": "0x7ff7e415ec8a", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000254" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 90 }, { "timestamp": "2026-05-29 01:05:17,430", "thread_id": "9696", "caller": "0x7ff7e415ec8a", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000258" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000254" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" } ], "repeated": 0, "id": 91 }, { "timestamp": "2026-05-29 01:05:17,430", "thread_id": "9696", "caller": "0x7ff7e415ec8a", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000258" }, { "name": "ValueName", "value": "AppsUseLightTheme" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\\AppsUseLightTheme" } ], "repeated": 0, "id": 92 }, { "timestamp": "2026-05-29 01:05:17,430", "thread_id": "9696", "caller": "0x7ff7e415ec8a", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000258" } ], "repeated": 0, "id": 93 }, { "timestamp": "2026-05-29 01:05:17,430", "thread_id": "9696", "caller": "0x7ff7e415ec8a", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000254" } ], "repeated": 0, "id": 94 }, { "timestamp": "2026-05-29 01:05:17,430", "thread_id": "9696", "caller": "0x7ff7e415ecbc", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\clbcatq" }, { "name": "DllBase", "value": "0x7fff58b30000" } ], "repeated": 0, "id": 95 }, { "timestamp": "2026-05-29 01:05:17,446", "thread_id": "9696", "caller": "0x7ff7e415ecbc", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\Wldp" }, { "name": "DllBase", "value": "0x7fff56fa0000" } ], "repeated": 0, "id": 96 }, { "timestamp": "2026-05-29 01:05:17,446", "thread_id": "9696", "caller": "0x7ff7e415ecbc", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\windows.storage" }, { "name": "DllBase", "value": "0x7fff55710000" } ], "repeated": 0, "id": 97 }, { "timestamp": "2026-05-29 01:05:17,446", "thread_id": "9696", "caller": "0x7ff7e415ecbc", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\windows.storage.dll" }, { "name": "BaseAddress", "value": "0x7fff55710000" } ], "repeated": 0, "id": 98 }, { "timestamp": "2026-05-29 01:05:17,446", "thread_id": "9696", "caller": "0x7ff7e415ecbc", "parentcaller": "0x7ff7e415205e", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "77F10CF0-3DB5-4966-B520-B7C54FD35ED6" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "6332DEBF-87B5-4670-90C0-5E57B408A49E" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 99 }, { "timestamp": "2026-05-29 01:05:17,462", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 100 }, { "timestamp": "2026-05-29 01:05:17,462", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 101 }, { "timestamp": "2026-05-29 01:05:17,462", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\Bcp47Langs" }, { "name": "DllBase", "value": "0x7fff4c520000" } ], "repeated": 0, "id": 102 }, { "timestamp": "2026-05-29 01:05:17,462", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\SHCORE" }, { "name": "DllBase", "value": "0x7fff58070000" } ], "repeated": 0, "id": 103 }, { "timestamp": "2026-05-29 01:05:17,462", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtQuerySystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 104 }, { "timestamp": "2026-05-29 01:05:17,462", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\sppc" }, { "name": "DllBase", "value": "0x7fff56140000" } ], "repeated": 0, "id": 105 }, { "timestamp": "2026-05-29 01:05:17,462", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\SLC" }, { "name": "DllBase", "value": "0x7fff56170000" } ], "repeated": 0, "id": 106 }, { "timestamp": "2026-05-29 01:05:17,462", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\USERENV" }, { "name": "DllBase", "value": "0x7fff57520000" } ], "repeated": 0, "id": 107 }, { "timestamp": "2026-05-29 01:05:17,462", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\appresolver" }, { "name": "DllBase", "value": "0x7fff44bb0000" } ], "repeated": 0, "id": 108 }, { "timestamp": "2026-05-29 01:05:17,462", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\appresolver.dll" }, { "name": "BaseAddress", "value": "0x7fff44bb0000" } ], "repeated": 0, "id": 109 }, { "timestamp": "2026-05-29 01:05:17,462", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 110 }, { "timestamp": "2026-05-29 01:05:17,462", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "kernel32.dll" }, { "name": "BaseAddress", "value": "0x7fff57fb0000" } ], "repeated": 0, "id": 111 }, { "timestamp": "2026-05-29 01:05:17,462", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 112 }, { "timestamp": "2026-05-29 01:05:17,462", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000002cc" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "11260" } ], "repeated": 0, "id": 113 }, { "timestamp": "2026-05-29 01:05:17,462", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000002cc" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000002e8" } ], "repeated": 0, "id": 114 }, { "timestamp": "2026-05-29 01:05:17,462", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 115 }, { "timestamp": "2026-05-29 01:05:17,462", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x82<\\xc0\\xf5\\x01\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00(\\x82<\\xc0\\xf5\\x01\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x82<\\xc0\\xf5\\x01\\x00\\x00T\\x00S\\x00A\\x00:\\x00/\\x00/\\x00P\\x00r\\x00o\\x00c\\x00U\\x00n\\x00i\\x00q\\x00u\\x00e\\x00\\xa3\\x00\\x00\\x00\\x00\\x00\\x00\\x00T<\n\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 116 }, { "timestamp": "2026-05-29 01:05:17,462", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 117 }, { "timestamp": "2026-05-29 01:05:17,462", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000002e8" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "11260" } ], "repeated": 0, "id": 118 }, { "timestamp": "2026-05-29 01:05:17,462", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000002e8" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000002dc" } ], "repeated": 0, "id": 119 }, { "timestamp": "2026-05-29 01:05:17,462", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\x00\\x82<\\xc0\\xf5\\x01\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 120 }, { "timestamp": "2026-05-29 01:05:17,462", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002dc" } ], "repeated": 0, "id": 121 }, { "timestamp": "2026-05-29 01:05:17,462", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 122 }, { "timestamp": "2026-05-29 01:05:17,462", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002e8" }, { "name": "DesiredAccess", "value": "0x00020000", "pretty_value": "READ_CONTROL" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 123 }, { "timestamp": "2026-05-29 01:05:17,462", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 124 }, { "timestamp": "2026-05-29 01:05:17,462", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002e8" }, { "name": "DesiredAccess", "value": "0x00020000", "pretty_value": "READ_CONTROL" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 125 }, { "timestamp": "2026-05-29 01:05:17,462", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 126 }, { "timestamp": "2026-05-29 01:05:17,462", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002cc" } ], "repeated": 0, "id": 127 }, { "timestamp": "2026-05-29 01:05:17,462", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 128 }, { "timestamp": "2026-05-29 01:05:17,462", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 129 }, { "timestamp": "2026-05-29 01:05:17,462", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff58117000" }, { "name": "ModuleName", "value": "SHCORE.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 130 }, { "timestamp": "2026-05-29 01:05:17,462", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff58117000" }, { "name": "ModuleName", "value": "SHCORE.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 131 }, { "timestamp": "2026-05-29 01:05:17,462", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff58b12000" }, { "name": "ModuleName", "value": "SHLWAPI.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 132 }, { "timestamp": "2026-05-29 01:05:17,462", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff58b12000" }, { "name": "ModuleName", "value": "SHLWAPI.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 133 }, { "timestamp": "2026-05-29 01:05:17,462", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff58b12000" }, { "name": "ModuleName", "value": "SHLWAPI.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 134 }, { "timestamp": "2026-05-29 01:05:17,462", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff58b12000" }, { "name": "ModuleName", "value": "SHLWAPI.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 135 }, { "timestamp": "2026-05-29 01:05:17,462", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "Handle", "value": "0x000002cc" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 136 }, { "timestamp": "2026-05-29 01:05:17,462", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002cc" }, { "name": "ValueName", "value": "NoPropertiesMyComputer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoPropertiesMyComputer" } ], "repeated": 0, "id": 137 }, { "timestamp": "2026-05-29 01:05:17,462", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002cc" } ], "repeated": 0, "id": 138 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 139 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "Handle", "value": "0x000002cc" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 140 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002cc" }, { "name": "ValueName", "value": "NoPropertiesRecycleBin" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoPropertiesRecycleBin" } ], "repeated": 0, "id": 141 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002cc" } ], "repeated": 0, "id": 142 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 143 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 144 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlRegisterFeatureConfigurationChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59f593b0" } ], "repeated": 0, "id": 145 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "NtQueryWnfStateData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fefc40" } ], "repeated": 0, "id": 146 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlSubscribeWnfStateChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59f92460" } ], "repeated": 0, "id": 147 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDisownModuleHeapAllocation" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fcfa30" } ], "repeated": 0, "id": 148 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlQueryFeatureConfiguration" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59facbd0" } ], "repeated": 0, "id": 149 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fb3410" } ], "repeated": 0, "id": 150 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x000002cc" }, { "name": "MutexName", "value": "Local\\SM0:11260:304:WilStaging_02" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 151 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002cc" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 152 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 153 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 154 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 155 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002dc" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 156 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002dc" } ], "repeated": 0, "id": 157 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 158 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002cc" } ], "repeated": 0, "id": 159 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002cc" } ], "repeated": 0, "id": 160 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x000002cc" }, { "name": "MutexName", "value": "Local\\SM0:11260:120:WilError_03" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 161 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002cc" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 162 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 163 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 164 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 165 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002dc" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 166 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002dc" } ], "repeated": 0, "id": 167 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 168 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002cc" } ], "repeated": 0, "id": 169 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002cc" } ], "repeated": 0, "id": 170 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "Handle", "value": "0x000002cc" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 171 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002cc" }, { "name": "ValueName", "value": "NoControlPanel" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoControlPanel" } ], "repeated": 0, "id": 172 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002cc" } ], "repeated": 0, "id": 173 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 174 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "Handle", "value": "0x000002cc" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 175 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002cc" }, { "name": "ValueName", "value": "NoSetFolders" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoSetFolders" } ], "repeated": 0, "id": 176 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002cc" } ], "repeated": 0, "id": 177 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 178 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "Handle", "value": "0x000002cc" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 179 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002cc" }, { "name": "ValueName", "value": "NoInternetIcon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoInternetIcon" } ], "repeated": 0, "id": 180 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002cc" } ], "repeated": 0, "id": 181 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 182 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ShellCompatibility\\Applications\\powershell.exe" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ShellCompatibility\\Applications\\powershell.exe" } ], "repeated": 0, "id": 183 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 184 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000000e8" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 185 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002cc" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000000e8" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 186 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002cc" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 187 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002cc" } ], "repeated": 0, "id": 188 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 189 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000000e8" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 190 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002cc" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000000e8" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 191 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002cc" }, { "name": "ValueName", "value": "MonitorRegistry" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\MonitorRegistry" } ], "repeated": 0, "id": 192 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002cc" } ], "repeated": 0, "id": 193 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 194 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 195 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "Handle", "value": "0x000002cc" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 196 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002cc" }, { "name": "ValueName", "value": "NoCommonGroups" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoCommonGroups" } ], "repeated": 0, "id": 197 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002cc" } ], "repeated": 0, "id": 198 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 199 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 200 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 201 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 202 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 203 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder" }, { "name": "Handle", "value": "0x000002ea" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder" } ], "repeated": 0, "id": 204 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 205 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 206 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002ea" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\Attributes" } ], "repeated": 0, "id": 207 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002ea" }, { "name": "ValueName", "value": "CallForAttributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\CallForAttributes" } ], "repeated": 0, "id": 208 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002ea" }, { "name": "ValueName", "value": "RestrictedAttributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\RestrictedAttributes" } ], "repeated": 0, "id": 209 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ea" }, { "name": "ValueName", "value": "FolderValueFlags" }, { "name": "Data", "value": "1581568" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\FolderValueFlags" } ], "repeated": 0, "id": 210 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ea" } ], "repeated": 0, "id": 211 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 212 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 213 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder" } ], "repeated": 0, "id": 214 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder" } ], "repeated": 0, "id": 215 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum" } ], "repeated": 0, "id": 216 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum" }, { "name": "Handle", "value": "0x000002e8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum" } ], "repeated": 0, "id": 217 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "{20D04FE0-3AEA-1069-A2D8-08002B30309D}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}" } ], "repeated": 0, "id": 218 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 219 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 220 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000000e8" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 221 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002e8" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000000e8" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" } ], "repeated": 0, "id": 222 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 223 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 224 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 225 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000000e8" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 226 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002e8" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000000e8" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" } ], "repeated": 0, "id": 227 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "MonitorRegistry" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\MonitorRegistry" } ], "repeated": 0, "id": 228 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 229 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 230 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 231 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "Drive\\shellex\\FolderExtensions" }, { "name": "Handle", "value": "0x000002ea" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\Drive\\shellex\\FolderExtensions" } ], "repeated": 0, "id": 232 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ea" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "{fbeb8a05-beee-4442-804e-409d6c4515e9}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Drive\\shellex\\FolderExtensions\\{fbeb8a05-beee-4442-804e-409d6c4515e9}" } ], "repeated": 0, "id": 233 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "Drive\\shellex\\FolderExtensions\\{fbeb8a05-beee-4442-804e-409d6c4515e9}" }, { "name": "Handle", "value": "0x000002de" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\Drive\\shellex\\FolderExtensions\\{fbeb8a05-beee-4442-804e-409d6c4515e9}" } ], "repeated": 0, "id": 234 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002de" }, { "name": "ValueName", "value": "DriveMask" }, { "name": "Data", "value": "32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Drive\\shellex\\FolderExtensions\\{fbeb8a05-beee-4442-804e-409d6c4515e9}\\DriveMask" } ], "repeated": 0, "id": 235 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002de" } ], "repeated": 0, "id": 236 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegEnumKeyExW", "status": false, "return": "0x00000103", "pretty_return": "NO_MORE_ITEMS", "arguments": [ { "name": "Handle", "value": "0x000002ea" }, { "name": "Index", "value": "1" }, { "name": "Name", "value": "" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Drive\\shellex\\FolderExtensions\\" } ], "repeated": 0, "id": 237 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ea" } ], "repeated": 0, "id": 238 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e86000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 239 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e86000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 240 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff58928000" }, { "name": "ModuleName", "value": "OLEAUT32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 241 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff58928000" }, { "name": "ModuleName", "value": "OLEAUT32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 242 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "Handle", "value": "0x000002ec" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 243 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002ec" }, { "name": "ValueName", "value": "AllowFileCLSIDJunctions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\AllowFileCLSIDJunctions" } ], "repeated": 0, "id": 244 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ec" } ], "repeated": 0, "id": 245 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 246 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "Handle", "value": "0x000002ec" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 247 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002ec" }, { "name": "ValueName", "value": "DontShowSuperHidden" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\DontShowSuperHidden" } ], "repeated": 0, "id": 248 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ec" } ], "repeated": 0, "id": 249 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 250 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000002e4" }, { "name": "SubKey", "value": "" }, { "name": "Handle", "value": "0x000002ec" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\" } ], "repeated": 0, "id": 251 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ec" }, { "name": "ValueName", "value": "ShellState" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ShellState" } ], "repeated": 0, "id": 252 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ec" }, { "name": "ValueName", "value": "ShellState" }, { "name": "Data", "value": "$\\x00\\x00\\x004(\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x13\\x00\\x00\\x00\\x00\\x00\\x00\\x00b\\x00\\x00\\x00" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ShellState" } ], "repeated": 0, "id": 253 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ec" } ], "repeated": 0, "id": 254 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "Handle", "value": "0x000002ec" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 255 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002ec" }, { "name": "ValueName", "value": "NoWebView" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoWebView" } ], "repeated": 0, "id": 256 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ec" } ], "repeated": 0, "id": 257 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 258 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "Handle", "value": "0x000002ec" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 259 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002ec" }, { "name": "ValueName", "value": "ClassicShell" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\ClassicShell" } ], "repeated": 0, "id": 260 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ec" } ], "repeated": 0, "id": 261 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 262 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "Handle", "value": "0x000002ec" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 263 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002ec" }, { "name": "ValueName", "value": "SeparateProcess" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\SeparateProcess" } ], "repeated": 0, "id": 264 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ec" } ], "repeated": 0, "id": 265 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 266 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "Handle", "value": "0x000002e8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 267 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "NoNetCrawling" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoNetCrawling" } ], "repeated": 0, "id": 268 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 269 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 270 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000002e4" }, { "name": "SubKey", "value": "Advanced" }, { "name": "Handle", "value": "0x000002e8" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced" } ], "repeated": 0, "id": 271 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "Hidden" }, { "name": "Data", "value": "2" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Hidden" } ], "repeated": 0, "id": 272 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "ShowCompColor" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowCompColor" } ], "repeated": 0, "id": 273 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "HideFileExt" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\HideFileExt" } ], "repeated": 0, "id": 274 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "DontPrettyPath" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\DontPrettyPath" } ], "repeated": 0, "id": 275 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "ShowInfoTip" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowInfoTip" } ], "repeated": 0, "id": 276 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "HideIcons" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\HideIcons" } ], "repeated": 0, "id": 277 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "MapNetDrvBtn" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\MapNetDrvBtn" } ], "repeated": 0, "id": 278 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "WebView" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\WebView" } ], "repeated": 0, "id": 279 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "Filter" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Filter" } ], "repeated": 0, "id": 280 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "ShowSuperHidden" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowSuperHidden" } ], "repeated": 0, "id": 281 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "SeparateProcess" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\SeparateProcess" } ], "repeated": 0, "id": 282 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlRegisterFeatureConfigurationChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59f593b0" } ], "repeated": 0, "id": 283 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "NtQueryWnfStateData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fefc40" } ], "repeated": 0, "id": 284 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlSubscribeWnfStateChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59f92460" } ], "repeated": 0, "id": 285 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDisownModuleHeapAllocation" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fcfa30" } ], "repeated": 0, "id": 286 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlQueryFeatureConfiguration" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59facbd0" } ], "repeated": 0, "id": 287 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1f5c03cd000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 288 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x000002dc" }, { "name": "MutexName", "value": "Local\\SM0:11260:304:WilStaging_02" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 289 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002dc" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 290 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 291 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ec" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 292 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 293 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f0" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 294 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f0" } ], "repeated": 0, "id": 295 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ec" } ], "repeated": 0, "id": 296 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002dc" } ], "repeated": 0, "id": 297 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002dc" } ], "repeated": 0, "id": 298 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "NoNetCrawling" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\NoNetCrawling" } ], "repeated": 0, "id": 299 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "AutoCheckSelect" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\AutoCheckSelect" } ], "repeated": 0, "id": 300 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "IconsOnly" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\IconsOnly" } ], "repeated": 0, "id": 301 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "ShowTypeOverlay" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowTypeOverlay" } ], "repeated": 0, "id": 302 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "ShowStatusBar" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowStatusBar" } ], "repeated": 0, "id": 303 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 304 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000002e8" } ], "repeated": 0, "id": 305 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "18" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 306 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "20" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 307 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 308 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "Directory" }, { "name": "Handle", "value": "0x000002ea" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\Directory" } ], "repeated": 0, "id": 309 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000002ea" }, { "name": "SubKey", "value": "ShellEx\\IconHandler" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\ShellEx\\IconHandler" } ], "repeated": 0, "id": 310 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "Folder" }, { "name": "Handle", "value": "0x000002f6" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\Folder" } ], "repeated": 0, "id": 311 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000002f6" }, { "name": "SubKey", "value": "ShellEx\\IconHandler" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\ShellEx\\IconHandler" } ], "repeated": 0, "id": 312 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "AllFilesystemObjects" }, { "name": "Handle", "value": "0x000002fa" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\AllFilesystemObjects" } ], "repeated": 0, "id": 313 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000002fa" }, { "name": "SubKey", "value": "ShellEx\\IconHandler" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\ShellEx\\IconHandler" } ], "repeated": 0, "id": 314 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002ea" }, { "name": "ValueName", "value": "DocObject" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\DocObject" } ], "repeated": 0, "id": 315 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000002ea" }, { "name": "SubKey", "value": "DocObject" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\DocObject" } ], "repeated": 0, "id": 316 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002f6" }, { "name": "ValueName", "value": "DocObject" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\DocObject" } ], "repeated": 0, "id": 317 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000002f6" }, { "name": "SubKey", "value": "DocObject" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\DocObject" } ], "repeated": 0, "id": 318 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002fa" }, { "name": "ValueName", "value": "DocObject" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\DocObject" } ], "repeated": 0, "id": 319 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000002fa" }, { "name": "SubKey", "value": "DocObject" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\DocObject" } ], "repeated": 0, "id": 320 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002ea" }, { "name": "ValueName", "value": "BrowseInPlace" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\BrowseInPlace" } ], "repeated": 0, "id": 321 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000002ea" }, { "name": "SubKey", "value": "BrowseInPlace" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\BrowseInPlace" } ], "repeated": 0, "id": 322 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002f6" }, { "name": "ValueName", "value": "BrowseInPlace" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\BrowseInPlace" } ], "repeated": 0, "id": 323 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000002f6" }, { "name": "SubKey", "value": "BrowseInPlace" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\BrowseInPlace" } ], "repeated": 0, "id": 324 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002fa" }, { "name": "ValueName", "value": "BrowseInPlace" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\BrowseInPlace" } ], "repeated": 0, "id": 325 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000002fa" }, { "name": "SubKey", "value": "BrowseInPlace" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\BrowseInPlace" } ], "repeated": 0, "id": 326 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000002ea" }, { "name": "SubKey", "value": "Clsid" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\Clsid" } ], "repeated": 0, "id": 327 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000002f6" }, { "name": "SubKey", "value": "Clsid" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\Clsid" } ], "repeated": 0, "id": 328 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000002fa" }, { "name": "SubKey", "value": "Clsid" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\Clsid" } ], "repeated": 0, "id": 329 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002ea" }, { "name": "ValueName", "value": "IsShortcut" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\IsShortcut" } ], "repeated": 0, "id": 330 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002f6" }, { "name": "ValueName", "value": "IsShortcut" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\IsShortcut" } ], "repeated": 0, "id": 331 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002fa" }, { "name": "ValueName", "value": "IsShortcut" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\IsShortcut" } ], "repeated": 0, "id": 332 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ea" }, { "name": "ValueName", "value": "AlwaysShowExt" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\AlwaysShowExt" } ], "repeated": 0, "id": 333 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002ea" }, { "name": "ValueName", "value": "NeverShowExt" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\NeverShowExt" } ], "repeated": 0, "id": 334 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002f6" }, { "name": "ValueName", "value": "NeverShowExt" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\NeverShowExt" } ], "repeated": 0, "id": 335 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002fa" }, { "name": "ValueName", "value": "NeverShowExt" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\NeverShowExt" } ], "repeated": 0, "id": 336 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ea" } ], "repeated": 0, "id": 337 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f6" } ], "repeated": 0, "id": 338 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002fa" } ], "repeated": 0, "id": 339 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1f5c03ce000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 340 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 341 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlAreLongPathsEnabled" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fc5280" } ], "repeated": 0, "id": 342 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1f5c03cf000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 343 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "MutexName", "value": "Local\\SM0:11260:120:WilError_03" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 344 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 345 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 346 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f4" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 347 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 348 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 349 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 350 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f4" } ], "repeated": 0, "id": 351 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" } ], "repeated": 0, "id": 352 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" } ], "repeated": 0, "id": 353 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000002f8" } ], "repeated": 0, "id": 354 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "18" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 355 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "20" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 356 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" } ], "repeated": 0, "id": 357 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": ".lnk" }, { "name": "Handle", "value": "0x000002fa" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\.lnk" } ], "repeated": 0, "id": 358 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002fa" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "lnkfile" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.lnk\\(Default)" } ], "repeated": 0, "id": 359 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "lnkfile" }, { "name": "Handle", "value": "0x000002f6" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\lnkfile" } ], "repeated": 0, "id": 360 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002f6" }, { "name": "KeyInformation", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\lnkfile" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 361 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002f6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 1, "id": 362 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002f6" }, { "name": "ObjectAttributesName", "value": "CurVer" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\lnkfile\\CurVer" } ], "repeated": 0, "id": 363 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\lnkfile\\CurVer" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\lnkfile\\CurVer" } ], "repeated": 0, "id": 364 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000002f6" }, { "name": "SubKey", "value": "" }, { "name": "Handle", "value": "0x000002ea" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\lnkfile\\" } ], "repeated": 0, "id": 365 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f6" } ], "repeated": 0, "id": 366 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ea" }, { "name": "ValueName", "value": "IsShortcut" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\lnkfile\\IsShortcut" } ], "repeated": 0, "id": 367 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ea" }, { "name": "KeyInformation", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\lnkfile" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 368 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ea" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 1, "id": 369 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002ea" }, { "name": "ObjectAttributesName", "value": "ShellEx\\{000214F9-0000-0000-C000-000000000046}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\lnkfile\\ShellEx\\{000214F9-0000-0000-C000-000000000046}" } ], "repeated": 0, "id": 370 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\lnkfile\\ShellEx\\{000214F9-0000-0000-C000-000000000046}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\lnkfile\\ShellEx\\{000214F9-0000-0000-C000-000000000046}" } ], "repeated": 0, "id": 371 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002fa" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\.lnk" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 372 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002fa" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 373 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xd9\\xec\\x11l\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\xfa\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00l\\x00\\x00\\x00\\xb0\\xda\\xec\\x11l\\x00\\x00\\x00" } ], "repeated": 0, "id": 374 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\.lnk\\ShellEx\\{000214F9-0000-0000-C000-000000000046}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\.lnk\\ShellEx\\{000214F9-0000-0000-C000-000000000046}" } ], "repeated": 0, "id": 375 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002fa" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 376 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002f4" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002fa" }, { "name": "ObjectAttributesName", "value": "ShellEx\\{000214F9-0000-0000-C000-000000000046}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.lnk\\ShellEx\\{000214F9-0000-0000-C000-000000000046}" } ], "repeated": 0, "id": 377 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f6" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{00021401-0000-0000-C000-000000000046}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.lnk\\ShellEx\\{000214F9-0000-0000-C000-000000000046}\\(Default)" } ], "repeated": 0, "id": 378 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f6" } ], "repeated": 0, "id": 379 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002fa" } ], "repeated": 0, "id": 380 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ea" } ], "repeated": 0, "id": 381 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "CLSID\\{00021401-0000-0000-C000-000000000046}" }, { "name": "Handle", "value": "0x000002ea" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\CLSID\\{00021401-0000-0000-C000-000000000046}" } ], "repeated": 0, "id": 382 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ea" }, { "name": "ValueName", "value": "DisableProcessIsolation" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{00021401-0000-0000-C000-000000000046}\\DisableProcessIsolation" } ], "repeated": 0, "id": 383 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ea" }, { "name": "ValueName", "value": "NoOplock" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{00021401-0000-0000-C000-000000000046}\\NoOplock" } ], "repeated": 0, "id": 384 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002ea" }, { "name": "ValueName", "value": "UseInProcHandlerCache" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{00021401-0000-0000-C000-000000000046}\\UseInProcHandlerCache" } ], "repeated": 0, "id": 385 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002ea" }, { "name": "ValueName", "value": "UseOutOfProcHandlerCache" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{00021401-0000-0000-C000-000000000046}\\UseOutOfProcHandlerCache" } ], "repeated": 0, "id": 386 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ea" } ], "repeated": 0, "id": 387 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00002000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 388 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00002000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 389 }, { "timestamp": "2026-05-29 01:05:17,477", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "MutexName", "value": "" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 390 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f4" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 391 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1f5c1d78000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 392 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 393 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 394 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 395 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" } ], "repeated": 0, "id": 396 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f4" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk" }, { "name": "Buffer", "value": "L\\x00\\x00\\x00\\x01\\x14\\x02\\x00\\x00\\x00\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00F\\xdf\\x02\\x00\\x00 \\x00\\x00\\x00\\x9b\\xaf\\x96\\xb7\\xcdj\\xcd\\x01\\x9b\\xaf\\x96\\xb7\\xcdj\\xcd\\x01\\x80\\x1d\\x02\\xa8\\xddj\\xcd\\x01\\x00\\xf0\\x06\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf1\\x01\\x14\\x00\\x1fP\\xe0O\\xd0 \\xea:i\\x10\\xa2\\xd8\\x08\\x00+00\\x9d\\x19\\x00/C:\\\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00R\\x001\\x00\\x00\\x00\\x00\\x00\\xc7B\\x02\\xb00\\x00Windows\\x00<\\x00\\x08\\x00\\x04\\x00\\xef\\xbe\\xfa@\\xc0,\\xc7B\\x02\\xb0*\\x00\\x00\\x00\\x1f\\x10\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00\\x00\\x00\\x16\\x00V\\x001\\x00\\x00\\x00\\x00\\x00\\xc7B]\\x050\\x00System32\\x00\\x00>\\x00\\x08\\x00\\x04\\x00\\xef\\xbe\\xfa@\\xc1,\\xc7B]\\x05*\\x00\\x00\\x00\n\\x18\\x00\\x00\\x00\\x00\\x01" }, { "name": "Length", "value": "2539" } ], "repeated": 0, "id": 397 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 398 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 399 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" } ], "repeated": 1, "id": 400 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 401 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 402 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 403 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" } ], "repeated": 0, "id": 404 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 405 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 406 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" } ], "repeated": 1, "id": 407 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 408 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 409 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 410 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" } ], "repeated": 0, "id": 411 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 412 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 413 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" } ], "repeated": 1, "id": 414 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 415 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 416 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 417 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" } ], "repeated": 0, "id": 418 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 419 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 420 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" } ], "repeated": 1, "id": 421 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 422 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000000e8" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 423 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002fc" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000000e8" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 424 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002fc" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 425 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002fc" } ], "repeated": 0, "id": 426 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 427 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000000e8" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 428 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002fc" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000000e8" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 429 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002fc" }, { "name": "ValueName", "value": "MonitorRegistry" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\MonitorRegistry" } ], "repeated": 0, "id": 430 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002fc" } ], "repeated": 0, "id": 431 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 432 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000000e8" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 433 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002fc" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000000e8" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" } ], "repeated": 0, "id": 434 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002fc" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 435 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002fc" } ], "repeated": 0, "id": 436 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 437 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000000e8" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 438 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002fc" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000000e8" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" } ], "repeated": 0, "id": 439 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002fc" }, { "name": "ValueName", "value": "MonitorRegistry" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\MonitorRegistry" } ], "repeated": 0, "id": 440 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002fc" } ], "repeated": 0, "id": 441 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1f5c03d0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 442 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "93" }, { "name": "ProcessInformation", "value": "\\x7f7\\x9e}" } ], "repeated": 0, "id": 443 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "PROPSYS.dll" } ], "repeated": 0, "id": 444 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\propsys.dll" } ], "repeated": 0, "id": 445 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "DesiredAccess", "value": "0x00100021", "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\propsys.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 446 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002f0" }, { "name": "DesiredAccess", "value": "0x0000000d", "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x000002ec" }, { "name": "FileName", "value": "C:\\Windows\\System32\\propsys.dll" } ], "repeated": 0, "id": 447 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002f0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff52860000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x000f6000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 448 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5294f000" }, { "name": "ModuleName", "value": "PROPSYS.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 449 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5291d000" }, { "name": "ModuleName", "value": "PROPSYS.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 450 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5291d000" }, { "name": "ModuleName", "value": "PROPSYS.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 451 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5291d000" }, { "name": "ModuleName", "value": "PROPSYS.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 452 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5291d000" }, { "name": "ModuleName", "value": "PROPSYS.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 453 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5291c000" }, { "name": "ModuleName", "value": "PROPSYS.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00002000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 454 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f0" } ], "repeated": 0, "id": 455 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ec" } ], "repeated": 0, "id": 456 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5291c000" }, { "name": "ModuleName", "value": "PROPSYS.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00002000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 457 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\PROPSYS" }, { "name": "DllBase", "value": "0x7fff52860000" } ], "repeated": 0, "id": 458 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff52860000", "arguments": [ { "name": "lpLibFileName", "value": "propsys.dll" }, { "name": "dwFlags", "value": "0x00000022" } ], "repeated": 0, "id": 459 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\propsys" }, { "name": "BaseAddress", "value": "0x7fff52860000" }, { "name": "InitRoutine", "value": "0x7fff528a2b20" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 460 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 461 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 462 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\KindMap" }, { "name": "Handle", "value": "0x00000300" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\KindMap" } ], "repeated": 0, "id": 463 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000300" }, { "name": "ValueName", "value": ".exe" }, { "name": "Data", "value": "program" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\KindMap\\.exe" } ], "repeated": 0, "id": 464 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000300" } ], "repeated": 0, "id": 465 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": ".exe" }, { "name": "Handle", "value": "0x00000302" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\.exe" } ], "repeated": 0, "id": 466 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000302" }, { "name": "ValueName", "value": "Content Type" }, { "name": "Data", "value": "application/x-msdownload" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.exe\\Content Type" } ], "repeated": 0, "id": 467 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000302" } ], "repeated": 0, "id": 468 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5294f000" }, { "name": "ModuleName", "value": "PROPSYS.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 469 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5294f000" }, { "name": "ModuleName", "value": "PROPSYS.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 470 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5294f000" }, { "name": "ModuleName", "value": "PROPSYS.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 471 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5294f000" }, { "name": "ModuleName", "value": "PROPSYS.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 472 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5294f000" }, { "name": "ModuleName", "value": "PROPSYS.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 473 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5294f000" }, { "name": "ModuleName", "value": "PROPSYS.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 474 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\propsys.dll" }, { "name": "BaseAddress", "value": "0x7fff52860000" } ], "repeated": 0, "id": 475 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "1F486A52-3CB1-48FD-8F50-B8DC300D9F9D" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "ECF31D61-E474-453C-BEE7-DE68E441C6D0" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 476 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1f5c03d3000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 477 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5294f000" }, { "name": "ModuleName", "value": "PROPSYS.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 478 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5294f000" }, { "name": "ModuleName", "value": "PROPSYS.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 479 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 480 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDisownModuleHeapAllocation" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fcfa30" } ], "repeated": 0, "id": 481 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "Global\\C:*ProgramData*Microsoft*Windows*Caches*cversions.2" } ], "repeated": 0, "id": 482 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "Local\\C:*ProgramData*Microsoft*Windows*Caches*cversions.2" } ], "repeated": 0, "id": 483 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000308" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "Global\\C:*ProgramData*Microsoft*Windows*Caches*cversions.2.ro" } ], "repeated": 0, "id": 484 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000308" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1f5c1f00000" }, { "name": "SectionOffset", "value": "0x6c11ecc250" }, { "name": "ViewSize", "value": "0x00004000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 485 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000030c" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "Global\\C:*ProgramData*Microsoft*Windows*Caches*{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000001.db" } ], "repeated": 0, "id": 486 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000030c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1f5c1f10000" }, { "name": "SectionOffset", "value": "0x6c11ecd1b0" }, { "name": "ViewSize", "value": "0x00049000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 487 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5294f000" }, { "name": "ModuleName", "value": "PROPSYS.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 488 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5294f000" }, { "name": "ModuleName", "value": "PROPSYS.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 489 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\SysWOW64\\propsys.dll" } ], "repeated": 1, "id": 490 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "filesystem", "api": "NtQueryFullAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\propsys.dll" } ], "repeated": 0, "id": 491 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "Global\\C:*ProgramData*Microsoft*Windows*Caches*cversions.2" } ], "repeated": 0, "id": 492 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "Local\\C:*ProgramData*Microsoft*Windows*Caches*cversions.2" } ], "repeated": 0, "id": 493 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000310" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "Global\\C:*ProgramData*Microsoft*Windows*Caches*cversions.2.ro" } ], "repeated": 0, "id": 494 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000310" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1f5c1f60000" }, { "name": "SectionOffset", "value": "0x6c11ecc300" }, { "name": "ViewSize", "value": "0x00004000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 495 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000314" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "Global\\C:*ProgramData*Microsoft*Windows*Caches*{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db" } ], "repeated": 0, "id": 496 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000314" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1f5c3690000" }, { "name": "SectionOffset", "value": "0x6c11ecd260" }, { "name": "ViewSize", "value": "0x0009c000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 497 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\SysWOW64\\propsys.dll" } ], "repeated": 1, "id": 498 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "filesystem", "api": "NtQueryFullAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\propsys.dll" } ], "repeated": 0, "id": 499 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "NtOpenKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US" } ], "repeated": 0, "id": 500 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000304" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\en-US\\PROPSYS.dll.mui" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 501 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000318" }, { "name": "DesiredAccess", "value": "0x000f0005", "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x00000304" }, { "name": "FileName", "value": "C:\\Windows\\System32\\en-US\\propsys.dll.mui" } ], "repeated": 0, "id": 502 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000318" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1f5c3730000" }, { "name": "SectionOffset", "value": "0x6c11ecbe60" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 503 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" } ], "repeated": 0, "id": 504 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1f5c03d6000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 505 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000318" } ], "repeated": 0, "id": 506 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "18" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 507 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "20" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 508 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" } ], "repeated": 0, "id": 509 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": ".exe" }, { "name": "Handle", "value": "0x0000031a" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\.exe" } ], "repeated": 0, "id": 510 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000031a" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "exefile" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.exe\\(Default)" } ], "repeated": 0, "id": 511 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "exefile" }, { "name": "Handle", "value": "0x0000031e" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\exefile" } ], "repeated": 0, "id": 512 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000031e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\exefile" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 513 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000031e" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 514 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "p\\xcd\\xec\\x11l\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\x1e\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00l\\x00\\x00\\x00p\\xce\\xec\\x11l\\x00\\x00\\x00" } ], "repeated": 0, "id": 515 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\exefile\\CurVer" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\exefile\\CurVer" } ], "repeated": 0, "id": 516 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000031e" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 517 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000031e" }, { "name": "ObjectAttributesName", "value": "CurVer" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\CurVer" } ], "repeated": 0, "id": 518 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000031e" }, { "name": "SubKey", "value": "" }, { "name": "Handle", "value": "0x00000322" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\" } ], "repeated": 0, "id": 519 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000031e" } ], "repeated": 0, "id": 520 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000322" }, { "name": "SubKey", "value": "ShellEx\\IconHandler" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\ShellEx\\IconHandler" } ], "repeated": 0, "id": 521 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "SystemFileAssociations\\.exe" }, { "name": "Handle", "value": "0x0000031e" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\SystemFileAssociations\\.exe" } ], "repeated": 0, "id": 522 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x0000031e" }, { "name": "SubKey", "value": "ShellEx\\IconHandler" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\SystemFileAssociations\\.exe\\ShellEx\\IconHandler" } ], "repeated": 0, "id": 523 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000322" }, { "name": "ValueName", "value": "DocObject" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\DocObject" } ], "repeated": 0, "id": 524 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000322" }, { "name": "SubKey", "value": "DocObject" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\DocObject" } ], "repeated": 0, "id": 525 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000031e" }, { "name": "ValueName", "value": "DocObject" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\SystemFileAssociations\\.exe\\DocObject" } ], "repeated": 0, "id": 526 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x0000031e" }, { "name": "SubKey", "value": "DocObject" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\SystemFileAssociations\\.exe\\DocObject" } ], "repeated": 0, "id": 527 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000322" }, { "name": "ValueName", "value": "BrowseInPlace" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\BrowseInPlace" } ], "repeated": 0, "id": 528 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000322" }, { "name": "SubKey", "value": "BrowseInPlace" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\BrowseInPlace" } ], "repeated": 0, "id": 529 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000031e" }, { "name": "ValueName", "value": "BrowseInPlace" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\SystemFileAssociations\\.exe\\BrowseInPlace" } ], "repeated": 0, "id": 530 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x0000031e" }, { "name": "SubKey", "value": "BrowseInPlace" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\SystemFileAssociations\\.exe\\BrowseInPlace" } ], "repeated": 0, "id": 531 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000031a" }, { "name": "ValueName", "value": "Content Type" }, { "name": "Data", "value": "application/x-msdownload" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.exe\\Content Type" } ], "repeated": 0, "id": 532 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000322" }, { "name": "SubKey", "value": "Clsid" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\Clsid" } ], "repeated": 0, "id": 533 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x0000031e" }, { "name": "SubKey", "value": "Clsid" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\SystemFileAssociations\\.exe\\Clsid" } ], "repeated": 0, "id": 534 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000322" }, { "name": "ValueName", "value": "IsShortcut" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\IsShortcut" } ], "repeated": 0, "id": 535 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000031e" }, { "name": "ValueName", "value": "IsShortcut" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\SystemFileAssociations\\.exe\\IsShortcut" } ], "repeated": 0, "id": 536 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000322" }, { "name": "ValueName", "value": "AlwaysShowExt" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\AlwaysShowExt" } ], "repeated": 0, "id": 537 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000031e" }, { "name": "ValueName", "value": "AlwaysShowExt" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\SystemFileAssociations\\.exe\\AlwaysShowExt" } ], "repeated": 0, "id": 538 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000322" }, { "name": "ValueName", "value": "NeverShowExt" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\NeverShowExt" } ], "repeated": 0, "id": 539 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000031e" }, { "name": "ValueName", "value": "NeverShowExt" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\SystemFileAssociations\\.exe\\NeverShowExt" } ], "repeated": 0, "id": 540 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000031a" } ], "repeated": 0, "id": 541 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000322" } ], "repeated": 0, "id": 542 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000031e" } ], "repeated": 0, "id": 543 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "Handle", "value": "0x0000031c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 544 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000031c" }, { "name": "ValueName", "value": "NormalizeLinkNetPidls" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NormalizeLinkNetPidls" } ], "repeated": 0, "id": 545 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000031c" } ], "repeated": 0, "id": 546 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 547 }, { "timestamp": "2026-05-29 01:05:17,493", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 548 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 549 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 550 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" } ], "repeated": 0, "id": 551 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f4" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk" }, { "name": "FileInformationClass", "value": "4", "pretty_value": "FileBasicInformation" }, { "name": "FileInformation", "value": "\\\\xbd\\xd6\\x9c\\xb6\\xee\\xdc\\x01\\xa7H\\xa56\\x07\\xef\\xdc\\x01z\\xe4:{\\xde\\xac\\xd5\\x01\\xbe7\\xc0\\xa1\\xb7\\xee\\xdc\\x01 \\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 552 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f4" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xeb\t\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 553 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 554 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 555 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" } ], "repeated": 1, "id": 556 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 557 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 558 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 559 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" } ], "repeated": 0, "id": 560 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 561 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 562 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" } ], "repeated": 1, "id": 563 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 564 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 565 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 566 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" } ], "repeated": 0, "id": 567 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 568 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 569 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" } ], "repeated": 1, "id": 570 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e86000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 571 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e86000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 572 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "93" }, { "name": "ProcessInformation", "value": "\\x7f7\\x9e}" } ], "repeated": 0, "id": 573 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "LINKINFO.dll" } ], "repeated": 0, "id": 574 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1f5c03d7000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 575 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "filesystem", "api": "NtQueryAttributesFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\LINKINFO.dll" } ], "repeated": 0, "id": 576 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\linkinfo.dll" } ], "repeated": 0, "id": 577 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000031c" }, { "name": "DesiredAccess", "value": "0x00100021", "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\linkinfo.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 578 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000320" }, { "name": "DesiredAccess", "value": "0x0000000d", "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x0000031c" }, { "name": "FileName", "value": "C:\\Windows\\System32\\linkinfo.dll" } ], "repeated": 0, "id": 579 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000320" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff43590000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x0000d000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 580 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff4359a000" }, { "name": "ModuleName", "value": "LINKINFO.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 581 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff43596000" }, { "name": "ModuleName", "value": "LINKINFO.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 582 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff43596000" }, { "name": "ModuleName", "value": "LINKINFO.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 583 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff43596000" }, { "name": "ModuleName", "value": "LINKINFO.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 584 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff43596000" }, { "name": "ModuleName", "value": "LINKINFO.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 585 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff43596000" }, { "name": "ModuleName", "value": "LINKINFO.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 586 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000320" } ], "repeated": 0, "id": 587 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000031c" } ], "repeated": 0, "id": 588 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff43596000" }, { "name": "ModuleName", "value": "LINKINFO.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 589 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\LINKINFO" }, { "name": "DllBase", "value": "0x7fff43590000" } ], "repeated": 0, "id": 590 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\linkinfo" }, { "name": "BaseAddress", "value": "0x7fff43590000" }, { "name": "InitRoutine", "value": "0x7fff43591df0" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 591 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff59306000" }, { "name": "ModuleName", "value": "SHELL32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 592 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff59306000" }, { "name": "ModuleName", "value": "SHELL32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 593 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 594 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 595 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 596 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" } ], "repeated": 0, "id": 597 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 598 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 599 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" } ], "repeated": 1, "id": 600 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 601 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 602 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 603 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" } ], "repeated": 0, "id": 604 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 605 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 606 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" } ], "repeated": 1, "id": 607 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 608 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 609 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 610 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" } ], "repeated": 0, "id": 611 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 612 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 613 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" } ], "repeated": 1, "id": 614 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 615 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 616 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 617 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" } ], "repeated": 0, "id": 618 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 619 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 620 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" } ], "repeated": 1, "id": 621 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 622 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 623 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 624 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" } ], "repeated": 0, "id": 625 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 626 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 627 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" } ], "repeated": 1, "id": 628 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 629 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 630 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 631 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" } ], "repeated": 0, "id": 632 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 633 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 634 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" } ], "repeated": 1, "id": 635 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 636 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 637 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 638 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" } ], "repeated": 0, "id": 639 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 640 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 641 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" } ], "repeated": 1, "id": 642 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 643 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 644 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 645 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" } ], "repeated": 0, "id": 646 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 647 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 648 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" } ], "repeated": 1, "id": 649 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 650 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 651 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 652 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" } ], "repeated": 0, "id": 653 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 654 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 655 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" } ], "repeated": 1, "id": 656 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 657 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 658 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 659 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" } ], "repeated": 0, "id": 660 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 661 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 662 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" } ], "repeated": 1, "id": 663 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 664 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 665 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 666 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" } ], "repeated": 0, "id": 667 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 668 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 669 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" } ], "repeated": 1, "id": 670 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 671 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 672 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 673 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" } ], "repeated": 0, "id": 674 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 675 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 676 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" } ], "repeated": 1, "id": 677 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 678 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 679 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 680 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" } ], "repeated": 0, "id": 681 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 682 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 683 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" } ], "repeated": 1, "id": 684 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 685 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 686 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 687 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" } ], "repeated": 0, "id": 688 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 689 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 690 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" } ], "repeated": 1, "id": 691 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 692 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 693 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 694 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" } ], "repeated": 0, "id": 695 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 696 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 697 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" } ], "repeated": 1, "id": 698 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 699 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 700 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 701 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" } ], "repeated": 0, "id": 702 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 703 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 704 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" } ], "repeated": 1, "id": 705 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 706 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 707 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 708 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" } ], "repeated": 0, "id": 709 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 710 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 711 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" } ], "repeated": 1, "id": 712 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 713 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 714 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 715 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" } ], "repeated": 0, "id": 716 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 717 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 718 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" } ], "repeated": 1, "id": 719 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 720 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 721 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 722 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" } ], "repeated": 0, "id": 723 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 724 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 725 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" } ], "repeated": 1, "id": 726 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 727 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 728 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 729 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" } ], "repeated": 0, "id": 730 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 731 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 732 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" } ], "repeated": 1, "id": 733 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 734 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 735 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 736 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" } ], "repeated": 0, "id": 737 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 738 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 739 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" } ], "repeated": 1, "id": 740 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57a6b000" }, { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 741 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57a6b000" }, { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 742 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x0000031c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 743 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000031c" }, { "name": "SubKey", "value": "{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}" }, { "name": "Handle", "value": "0x00000320" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}" } ], "repeated": 0, "id": 744 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000031c" } ], "repeated": 0, "id": 745 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000320" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Category" } ], "repeated": 0, "id": 746 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000320" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "System" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Name" } ], "repeated": 0, "id": 747 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000320" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\ParentFolder" } ], "repeated": 0, "id": 748 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000320" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Description" } ], "repeated": 0, "id": 749 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000320" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\RelativePath" } ], "repeated": 0, "id": 750 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000320" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\ParsingName" } ], "repeated": 0, "id": 751 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000320" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\InfoTip" } ], "repeated": 0, "id": 752 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000320" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\LocalizedName" } ], "repeated": 0, "id": 753 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000320" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Icon" } ], "repeated": 0, "id": 754 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000320" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Security" } ], "repeated": 0, "id": 755 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000320" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\StreamResource" } ], "repeated": 0, "id": 756 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000320" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\StreamResourceType" } ], "repeated": 0, "id": 757 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000320" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\LocalRedirectOnly" } ], "repeated": 0, "id": 758 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000320" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Roamable" } ], "repeated": 0, "id": 759 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000320" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\PreCreate" } ], "repeated": 0, "id": 760 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000320" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Stream" } ], "repeated": 0, "id": 761 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000320" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\PublishExpandedPath" } ], "repeated": 0, "id": 762 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000320" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\DefinitionFlags" } ], "repeated": 0, "id": 763 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000320" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Attributes" } ], "repeated": 0, "id": 764 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000320" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\FolderTypeID" } ], "repeated": 0, "id": 765 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000320" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\InitFolderHandler" } ], "repeated": 0, "id": 766 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000320" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x0000031c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\PropertyBag" } ], "repeated": 0, "id": 767 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000320" } ], "repeated": 0, "id": 768 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000320" } ], "repeated": 0, "id": 769 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 770 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\x00\\xbc\\xec\\x11l\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 771 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000320" } ], "repeated": 0, "id": 772 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "filesystem", "api": "GetVolumeNameForVolumeMountPointW", "status": true, "return": "0x00000001", "arguments": [ { "name": "VolumeMountPoint", "value": "C:\\" }, { "name": "VolumeName", "value": "\\\\?\\Volume{528c102f-0000-0000-0000-300300000000}\\" } ], "repeated": 0, "id": 773 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "Handle", "value": "0x00000320" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 774 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000320" }, { "name": "SubKey", "value": "{528c102f-0000-0000-0000-300300000000}\\" }, { "name": "Handle", "value": "0x00000318" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\" } ], "repeated": 0, "id": 775 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000320" } ], "repeated": 0, "id": 776 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "Data" }, { "name": "Data", "value": "\\xd6\r\\x00\\x00\r\\xf0\\xad\\xbaA\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x06\\xe7\\x03\\xff\\x00\\x00\\x00\\x16\\x00\\x00\\x00t6L\\xb3\\x1f\\x00\\x00\\x00\\x04@\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\\\x00\\\\x00?\\x00\\\\x00S\\x00T\\x00O\\x00R\\x00A\\x00G\\x00E\\x00#\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00#\\x00{\\x00e\\x003\\x002\\x00a\\x009\\x004\\x004\\x002\\x00-\\x005\\x00a\\x00f\\x002\\x00-\\x001\\x001\\x00f\\x001\\x00-\\x00a\\x00e\\x002\\x00c\\x00-\\x008\\x000\\x006\\x00e\\x006\\x00f\\x006\\x00e\\x006\\x009\\x006\\x003\\x00}\\x00#\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x003\\x003\\x000\\x000\\x000\\x000\\x000\\x00#\\x00{\\x005\\x003\\x00f\\x005\\x006\\x003\\x000\\x00d\\x00-\\x00b\\x006\\x00b\\x00f\\x00-\\x001\\x001\\x00d\\x000\\x00-\\x009\\x004\\x00f\\x002\\x00-\\x000\\x000\\x00a\\x000\\x00c\\x009\\x001\\x00e\\x00f\\x00b\\x008\\x00b\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Data" } ], "repeated": 0, "id": 777 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" } ], "repeated": 0, "id": 778 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "Handle", "value": "0x00000318" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 779 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000318" }, { "name": "SubKey", "value": "{528c102f-0000-0000-0000-300300000000}\\" }, { "name": "Handle", "value": "0x00000320" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\" } ], "repeated": 0, "id": 780 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" } ], "repeated": 0, "id": 781 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000320" }, { "name": "ValueName", "value": "Generation" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation" } ], "repeated": 0, "id": 782 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000320" } ], "repeated": 0, "id": 783 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000320" } ], "repeated": 0, "id": 784 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xc0u=\\xc0\\xf5\\x01\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 785 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000320" } ], "repeated": 0, "id": 786 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "Handle", "value": "0x00000320" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 787 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000320" }, { "name": "SubKey", "value": "{528c102f-0000-0000-0000-300300000000}\\" }, { "name": "Handle", "value": "0x00000318" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\" } ], "repeated": 0, "id": 788 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000320" } ], "repeated": 0, "id": 789 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "Generation" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation" } ], "repeated": 0, "id": 790 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" } ], "repeated": 0, "id": 791 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Policies\\Microsoft\\Windows\\Explorer" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\Explorer" } ], "repeated": 0, "id": 792 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "11272", "caller": "0x7fff59fc507d", "parentcaller": "0x7fff59fc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 793 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "11272", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7fff59fa2b30" }, { "name": "Parameter", "value": "0x1f5c0390b50" } ], "repeated": 0, "id": 794 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Policies\\Microsoft\\Windows\\Explorer" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\Explorer" } ], "repeated": 0, "id": 795 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "11272", "caller": "0x7fff5a00e53f", "parentcaller": "0x7fff59f6faf7", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "93" }, { "name": "ProcessInformation", "value": "\\x7f7\\x9e}" } ], "repeated": 0, "id": 796 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "11272", "caller": "0x7fff59f65157", "parentcaller": "0x7fff59f643ea", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000324" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "CFGMGR32.dll" } ], "repeated": 0, "id": 797 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "11272", "caller": "0x7fff59f5fee4", "parentcaller": "0x7fff59f5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5779b000" }, { "name": "ModuleName", "value": "CFGMGR32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 798 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "11272", "caller": "0x7fff59f5ffb5", "parentcaller": "0x7fff59f5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57789000" }, { "name": "ModuleName", "value": "CFGMGR32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 799 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "11272", "caller": "0x7fff59f5ffed", "parentcaller": "0x7fff59f5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57789000" }, { "name": "ModuleName", "value": "CFGMGR32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 800 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 801 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "11272", "caller": "0x7fff59f97bac", "parentcaller": "0x7fff59f8288a", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57788000" }, { "name": "ModuleName", "value": "CFGMGR32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00002000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 802 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "11272", "caller": "0x7fff59f97bac", "parentcaller": "0x7fff59f8288a", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\CFGMGR32" }, { "name": "DllBase", "value": "0x7fff57750000" } ], "repeated": 0, "id": 803 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "filesystem", "api": "NtQueryInformationFile", "status": false, "return": "0xffffffffc000000d", "pretty_return": "INVALID_PARAMETER", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\" }, { "name": "FileInformationClass", "value": "55", "pretty_value": "FileReplaceCompletionInformation" }, { "name": "FileInformation", "value": "" } ], "repeated": 0, "id": 804 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "filesystem", "api": "NtQueryDirectoryFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x006\\xean:\\xdd\\xac\\xd5\\x01W\\xec\\xc0/\\x04\\xef\\xdc\\x01\\xfc\\x07\\x87\\xc3\\xb8\\xee\\xdc\\x01\\xfc\\x07\\x87\\xc3\\xb8\\xee\\xdc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x0e\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'\\x06\\x00\\x00\\x00\\x00\\x01\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00" }, { "name": "FileName", "value": "C:\\Windows" }, { "name": "FileInformationClass", "value": "37", "pretty_value": "FileIdBothDirectoryInformation" } ], "repeated": 0, "id": 805 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" } ], "repeated": 0, "id": 806 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1f5c03d9000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 807 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 808 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "filesystem", "api": "NtQueryInformationFile", "status": false, "return": "0xffffffffc000000d", "pretty_return": "INVALID_PARAMETER", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\Windows" }, { "name": "FileInformationClass", "value": "55", "pretty_value": "FileReplaceCompletionInformation" }, { "name": "FileInformation", "value": "" } ], "repeated": 0, "id": 809 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "filesystem", "api": "NtQueryDirectoryFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x006\\xean:\\xdd\\xac\\xd5\\x01\\x98\\x12\\x8d5\\x07\\xef\\xdc\\x01U\\x15q5\\x07\\xef\\xdc\\x01U\\x15q5\\x07\\xef\\xdc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe3\\x0c\\x00\\x00\\x00\\x00\\x01\\x00S\\x00y\\x00s\\x00t\\x00e\\x00m\\x003\\x002\\x00" }, { "name": "FileName", "value": "C:\\Windows\\System32" }, { "name": "FileInformationClass", "value": "37", "pretty_value": "FileIdBothDirectoryInformation" } ], "repeated": 0, "id": 810 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" } ], "repeated": 0, "id": 811 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 812 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000000e8" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 813 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000000e8" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\KnownFolderSettings" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\KnownFolderSettings" } ], "repeated": 0, "id": 814 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 815 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000000e8" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 816 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000000e8" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\KnownFolderSettings" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\KnownFolderSettings" } ], "repeated": 0, "id": 817 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 818 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1f5c03da000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 819 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1f5c03db000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 820 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1f5c03dd000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 821 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1f5c03de000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 822 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "11272", "caller": "0x7fff59fbc2c7", "parentcaller": "0x7fff59fbc05a", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\cfgmgr32" }, { "name": "BaseAddress", "value": "0x7fff57750000" }, { "name": "InitRoutine", "value": "0x7fff57763750" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 823 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "11272", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 824 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "11272", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 825 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "76765B11-3F95-4AF2-AC9D-EA55D8994F1A" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000000-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 826 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5294f000" }, { "name": "ModuleName", "value": "PROPSYS.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 827 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5294f000" }, { "name": "ModuleName", "value": "PROPSYS.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 828 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff587d1000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 829 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff587d1000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 830 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 831 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f4" } ], "repeated": 0, "id": 832 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" } ], "repeated": 0, "id": 833 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" } ], "repeated": 0, "id": 834 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 835 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000000e8" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 836 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002f8" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000000e8" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 837 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 838 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "11272", "caller": "0x7fff57fc5921", "parentcaller": "0x7fff57751ed1", "category": "device", "api": "DeviceIoControl", "status": true, "return": "0x00000001", "arguments": [ { "name": "DeviceHandle", "value": "0x00000324" }, { "name": "IoControlCode", "value": "0x00470807" }, { "name": "InBuffer", "value": "(\\x00\\x00\\x00\\x00\\x00\\x01\\x00\rc\\xf5S\\xbf\\xb6\\xd0\\x11\\x94\\xf2\\x00\\xa0\\xc9\\x1e\\xfb\\x8b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00" }, { "name": "OutBuffer", "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xae\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\\\x00\\\\x00?\\x00\\\\x00S\\x00T\\x00O\\x00R\\x00A\\x00G\\x00E\\x00#\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00#\\x00{\\x00e\\x003\\x002\\x00a\\x009\\x004\\x004\\x002\\x00-\\x005\\x00a\\x00f\\x002\\x00-\\x001\\x001\\x00f\\x001\\x00-\\x00a\\x00e\\x002\\x00c\\x00-\\x008\\x000\\x006\\x00e\\x006\\x00f\\x006\\x00e\\x006\\x009\\x006\\x003\\x00}\\x00#\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x001\\x000\\x000\\x000\\x000\\x000\\x00#\\x00{\\x005\\x003\\x00f\\x005\\x006\\x003\\x000\\x00d\\x00-\\x00b\\x006\\x00b\\x00f\\x00-\\x001\\x001\\x00d\\x000\\x00-\\x009\\x004\\x00f\\x002\\x00-\\x000\\x000\\x00a\\x000\\x00c\\x009\\x001\\x00e\\x00f\\x00b\\x008\\x00b\\x00}\\x00\\x00\\x00\\\\x00\\\\x00?\\x00\\\\x00S\\x00T\\x00" } ], "repeated": 0, "id": 839 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 840 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "11272", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff55875fb2", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000328" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000032c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 841 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000000e8" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 842 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002f8" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000000e8" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 843 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "ValueName", "value": "MonitorRegistry" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\MonitorRegistry" } ], "repeated": 0, "id": 844 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" } ], "repeated": 0, "id": 845 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 846 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "11284", "caller": "0x7fff577b7861", "parentcaller": "0x7fff577b7530", "category": "device", "api": "NtDeviceIoControlFile", "status": false, "return": "0xffffffffc00700bb", "arguments": [ { "name": "FileHandle", "value": "0x00000054" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xebW\\x12l\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\xebW\\x12l\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 847 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002f8" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000000e8" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" } ], "repeated": 0, "id": 848 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 849 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" } ], "repeated": 0, "id": 850 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 851 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000000e8" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 852 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002f8" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000000e8" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" } ], "repeated": 0, "id": 853 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "ValueName", "value": "MonitorRegistry" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\MonitorRegistry" } ], "repeated": 0, "id": 854 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" } ], "repeated": 0, "id": 855 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "11284", "caller": "0x7fff577d4d82", "parentcaller": "0x7fff577d68df", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\STORAGE#Volume#{e32a9442-5af2-11f1-ae2c-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 856 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "11284", "caller": "0x7fff577d4dc6", "parentcaller": "0x7fff577d68df", "category": "device", "api": "DeviceIoControl", "status": true, "return": "0x00000001", "arguments": [ { "name": "DeviceHandle", "value": "0x00000330" }, { "name": "IoControlCode", "value": "0x004d0008", "pretty_value": "IOCTL_MOUNTDEV_QUERY_DEVICE_NAME" }, { "name": "InBuffer", "value": "" }, { "name": "OutBuffer", "value": ".\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x001\\x00" } ], "repeated": 0, "id": 857 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "11284", "caller": "0x7fff577d4dd4", "parentcaller": "0x7fff577d68df", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000330" } ], "repeated": 0, "id": 858 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "11284", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d4f8e", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\MountPointManager" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 859 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" }, { "name": "Handle", "value": "0x000002f8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" } ], "repeated": 0, "id": 860 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "11284", "caller": "0x7fff577d6785", "parentcaller": "0x7fff577d4fe3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000330" } ], "repeated": 0, "id": 861 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002f8" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 862 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "11272", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5587601a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000328" } ], "repeated": 0, "id": 863 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "11272", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5589286f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" } ], "repeated": 0, "id": 864 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" } ], "repeated": 0, "id": 865 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5294f000" }, { "name": "ModuleName", "value": "PROPSYS.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 866 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "11272", "caller": "0x7fff5588f616", "parentcaller": "0x7fff5588bf43", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "Handle", "value": "0x0000032c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 867 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\KindMap" }, { "name": "Handle", "value": "0x000002f8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\KindMap" } ], "repeated": 0, "id": 868 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "11272", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000328" }, { "name": "ValueName", "value": "Data" }, { "name": "Data", "value": "\\xd6\r\\x00\\x00\r\\xf0\\xad\\xba\\x01\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x06\\xe7\\x03\\xff\\x00\\x00\\x00\\x16\\x00\\x00\\x00R\\xbd\\xbb\\x88\\x1e\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\\\x00\\\\x00?\\x00\\\\x00S\\x00T\\x00O\\x00R\\x00A\\x00G\\x00E\\x00#\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00#\\x00{\\x00e\\x003\\x002\\x00a\\x009\\x004\\x004\\x002\\x00-\\x005\\x00a\\x00f\\x002\\x00-\\x001\\x001\\x00f\\x001\\x00-\\x00a\\x00e\\x002\\x00c\\x00-\\x008\\x000\\x006\\x00e\\x006\\x00f\\x006\\x00e\\x006\\x009\\x006\\x003\\x00}\\x00#\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x001\\x000\\x000\\x000\\x000\\x000\\x00#\\x00{\\x005\\x003\\x00f\\x005\\x006\\x003\\x000\\x00d\\x00-\\x00b\\x006\\x00b\\x00f\\x00-\\x001\\x001\\x00d\\x000\\x00-\\x009\\x004\\x00f\\x002\\x00-\\x000\\x000\\x00a\\x000\\x00c\\x009\\x001\\x00e\\x00f\\x00b\\x008\\x00b\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-100000000000}\\Data" } ], "repeated": 0, "id": 869 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "11272", "caller": "0x7fff5588bfeb", "parentcaller": "0x7fff558759ad", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000328" } ], "repeated": 0, "id": 870 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "ValueName", "value": ".lnk" }, { "name": "Data", "value": "link" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\KindMap\\.lnk" } ], "repeated": 0, "id": 871 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" } ], "repeated": 0, "id": 872 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "11272", "caller": "0x7fff5588f616", "parentcaller": "0x7fff5588bf43", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "Handle", "value": "0x00000328" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 873 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": ".lnk" }, { "name": "Handle", "value": "0x000002fa" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\.lnk" } ], "repeated": 0, "id": 874 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "11272", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "Generation" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-100000000000}\\Generation" } ], "repeated": 0, "id": 875 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "11272", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" } ], "repeated": 0, "id": 876 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002fa" }, { "name": "ValueName", "value": "Content Type" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.lnk\\Content Type" } ], "repeated": 0, "id": 877 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002fa" } ], "repeated": 0, "id": 878 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "11284", "caller": "0x7fff558aa151", "parentcaller": "0x7fff558927a5", "category": "filesystem", "api": "GetVolumeNameForVolumeMountPointW", "status": true, "return": "0x00000001", "arguments": [ { "name": "VolumeMountPoint", "value": "\\\\?\\STORAGE#Volume#{e32a9442-5af2-11f1-ae2c-806e6f6e6963}#0000000003300000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\" }, { "name": "VolumeName", "value": "\\\\?\\Volume{528c102f-0000-0000-0000-300300000000}\\" } ], "repeated": 0, "id": 879 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "11272", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5587601a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" } ], "repeated": 0, "id": 880 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000002f8" } ], "repeated": 0, "id": 881 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "18" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 882 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "11272", "caller": "0x7fff5588f616", "parentcaller": "0x7fff5588bf43", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "Handle", "value": "0x0000032c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 883 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": ".lnk" }, { "name": "Handle", "value": "0x000002fa" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\.lnk" } ], "repeated": 0, "id": 884 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "11272", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000330" }, { "name": "ValueName", "value": "Data" }, { "name": "Data", "value": "\\xd6\r\\x00\\x00\r\\xf0\\xad\\xbaA\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x06\\xe7\\x03\\xff\\x00\\x00\\x00\\x16\\x00\\x00\\x00t6L\\xb3\\x1f\\x00\\x00\\x00\\x04@\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\\\x00\\\\x00?\\x00\\\\x00S\\x00T\\x00O\\x00R\\x00A\\x00G\\x00E\\x00#\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00#\\x00{\\x00e\\x003\\x002\\x00a\\x009\\x004\\x004\\x002\\x00-\\x005\\x00a\\x00f\\x002\\x00-\\x001\\x001\\x00f\\x001\\x00-\\x00a\\x00e\\x002\\x00c\\x00-\\x008\\x000\\x006\\x00e\\x006\\x00f\\x006\\x00e\\x006\\x009\\x006\\x003\\x00}\\x00#\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x003\\x003\\x000\\x000\\x000\\x000\\x000\\x00#\\x00{\\x005\\x003\\x00f\\x005\\x006\\x003\\x000\\x00d\\x00-\\x00b\\x006\\x00b\\x00f\\x00-\\x001\\x001\\x00d\\x000\\x00-\\x009\\x004\\x00f\\x002\\x00-\\x000\\x000\\x00a\\x000\\x00c\\x009\\x001\\x00e\\x00f\\x00b\\x008\\x00b\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Data" } ], "repeated": 0, "id": 885 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "11272", "caller": "0x7fff5588bfeb", "parentcaller": "0x7fff558759ad", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000330" } ], "repeated": 0, "id": 886 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002fa" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "lnkfile" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.lnk\\(Default)" } ], "repeated": 0, "id": 887 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "11272", "caller": "0x7fff5588f616", "parentcaller": "0x7fff5588bf43", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "Handle", "value": "0x00000330" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 888 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "lnkfile" }, { "name": "Handle", "value": "0x000002f6" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\lnkfile" } ], "repeated": 0, "id": 889 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002f6" }, { "name": "KeyInformation", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\lnkfile" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 890 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "11272", "caller": "0x7fff5588bfa7", "parentcaller": "0x7fff55875a2d", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000330" } ], "repeated": 0, "id": 891 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002f6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 1, "id": 892 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "11272", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "Generation" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation" } ], "repeated": 0, "id": 893 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "11272", "caller": "0x7fff5588bfeb", "parentcaller": "0x7fff55875a2d", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" } ], "repeated": 0, "id": 894 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "11272", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff55875fb2", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000032c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000330" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 895 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "11272", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff55875ffc", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 896 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "11272", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff55875ffc", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "Milliseconds", "value": "1000" } ], "repeated": 0, "id": 897 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000002f6" }, { "name": "SubKey", "value": "" }, { "name": "Handle", "value": "0x0000031a" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\lnkfile\\" } ], "repeated": 0, "id": 898 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "11272", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5587601a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" } ], "repeated": 0, "id": 899 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7fff55852456", "parentcaller": "0x7fff5585298d", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f6" } ], "repeated": 0, "id": 900 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "11272", "caller": "0x7fff5588f616", "parentcaller": "0x7fff5588bf43", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "Handle", "value": "0x0000032c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 901 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000031a" }, { "name": "SubKey", "value": "ShellEx\\IconHandler" }, { "name": "Handle", "value": "0x000002f6" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\lnkfile\\ShellEx\\IconHandler" } ], "repeated": 0, "id": 902 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "11272", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000334" }, { "name": "ValueName", "value": "Data" }, { "name": "Data", "value": "\\xd6\r\\x00\\x00\r\\xf0\\xad\\xba\\x01\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x06\\xe7\\x03\\xff\\x00\\x00\\x00\\x16\\x00\\x00\\x00\\x9d\\x7f\\xd7`\\x1e\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\\\x00\\\\x00?\\x00\\\\x00S\\x00T\\x00O\\x00R\\x00A\\x00G\\x00E\\x00#\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00#\\x00{\\x00e\\x003\\x002\\x00a\\x009\\x004\\x004\\x002\\x00-\\x005\\x00a\\x00f\\x002\\x00-\\x001\\x001\\x00f\\x001\\x00-\\x00a\\x00e\\x002\\x00c\\x00-\\x008\\x000\\x006\\x00e\\x006\\x00f\\x006\\x00e\\x006\\x009\\x006\\x003\\x00}\\x00#\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x00E\\x00D\\x00D\\x00C\\x000\\x000\\x000\\x000\\x000\\x00#\\x00{\\x005\\x003\\x00f\\x005\\x006\\x003\\x000\\x00d\\x00-\\x00b\\x006\\x00b\\x00f\\x00-\\x001\\x001\\x00d\\x000\\x00-\\x009\\x004\\x00f\\x002\\x00-\\x000\\x000\\x00a\\x000\\x00c\\x009\\x001\\x00e\\x00f\\x00b\\x008\\x00b\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-c0dd0e000000}\\Data" } ], "repeated": 0, "id": 903 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f6" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\lnkfile\\shellex\\IconHandler\\(Default)" } ], "repeated": 0, "id": 904 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f6" } ], "repeated": 0, "id": 905 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "11272", "caller": "0x7fff5588bf7f", "parentcaller": "0x7fff55875a2d", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000334" }, { "name": "SubKey", "value": "{528c102f-0000-0000-0000-c0dd0e000000}\\" }, { "name": "Handle", "value": "0x0000032c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-c0dd0e000000}\\" } ], "repeated": 0, "id": 906 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000031a" }, { "name": "ValueName", "value": "DocObject" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\lnkfile\\DocObject" } ], "repeated": 0, "id": 907 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "11272", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "Generation" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-c0dd0e000000}\\Generation" } ], "repeated": 0, "id": 908 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x0000031a" }, { "name": "SubKey", "value": "DocObject" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\lnkfile\\DocObject" } ], "repeated": 0, "id": 909 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "11272", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\MountPointManager" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 910 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "11272", "caller": "0x7fff577ef54e", "parentcaller": "0x7fff5587620d", "category": "device", "api": "DeviceIoControl", "status": true, "return": "0x00000001", "arguments": [ { "name": "DeviceHandle", "value": "0x0000032c" }, { "name": "IoControlCode", "value": "0x006d0034", "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATHS" }, { "name": "InBuffer", "value": "`\\x00\\\\x00?\\x00?\\x00\\\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00{\\x005\\x002\\x008\\x00c\\x001\\x000\\x002\\x00f\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x001\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "OutBuffer", "value": "\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 911 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "11272", "caller": "0x7fff577d6785", "parentcaller": "0x7fff577ef55e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" } ], "repeated": 0, "id": 912 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "SystemFileAssociations\\.lnk" }, { "name": "Handle", "value": "0x000002f6" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\SystemFileAssociations\\.lnk" } ], "repeated": 0, "id": 913 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "11272", "caller": "0x7fff577ef54e", "parentcaller": "0x7fff5587626d", "category": "device", "api": "DeviceIoControl", "status": true, "return": "0x00000001", "arguments": [ { "name": "DeviceHandle", "value": "0x0000032c" }, { "name": "IoControlCode", "value": "0x006d0034", "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATHS" }, { "name": "InBuffer", "value": "`\\x00\\\\x00?\\x00?\\x00\\\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00{\\x005\\x002\\x008\\x00c\\x001\\x000\\x002\\x00f\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x001\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "OutBuffer", "value": "\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 914 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "11272", "caller": "0x7fff577d6785", "parentcaller": "0x7fff577ef55e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" } ], "repeated": 0, "id": 915 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "11272", "caller": "0x7fff577ef54e", "parentcaller": "0x7fff5587620d", "category": "device", "api": "DeviceIoControl", "status": false, "return": "0x00000000", "arguments": [ { "name": "DeviceHandle", "value": "0x0000032c" }, { "name": "IoControlCode", "value": "0x006d0034", "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATHS" }, { "name": "InBuffer", "value": "`\\x00\\\\x00?\\x00?\\x00\\\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00{\\x005\\x002\\x008\\x00c\\x001\\x000\\x002\\x00f\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x003\\x000\\x000\\x003\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "OutBuffer", "value": "\\x08\\x00\\x00\\x00" } ], "repeated": 0, "id": 916 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "11272", "caller": "0x7fff577ef6dd", "parentcaller": "0x7fff5587620d", "category": "device", "api": "DeviceIoControl", "status": true, "return": "0x00000001", "arguments": [ { "name": "DeviceHandle", "value": "0x0000032c" }, { "name": "IoControlCode", "value": "0x006d0034", "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATHS" }, { "name": "InBuffer", "value": "`\\x00\\\\x00?\\x00?\\x00\\\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00{\\x005\\x002\\x008\\x00c\\x001\\x000\\x002\\x00f\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x003\\x000\\x000\\x003\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "OutBuffer", "value": "\\x08\\x00\\x00\\x00C\\x00:\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 917 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "11272", "caller": "0x7fff577d6785", "parentcaller": "0x7fff577ef55e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" } ], "repeated": 0, "id": 918 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000002f6" }, { "name": "SubKey", "value": "DocObject" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\SystemFileAssociations\\.lnk\\DocObject" } ], "repeated": 0, "id": 919 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "11272", "caller": "0x7fff577d6785", "parentcaller": "0x7fff577ef55e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" } ], "repeated": 0, "id": 920 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "11272", "caller": "0x7fff5781026b", "parentcaller": "0x7fff557c956d", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000032c" } ], "repeated": 0, "id": 921 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "11272", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff557ca4ff", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xc0\\xee=\\xc0\\xf5\\x01\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 922 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "11272", "caller": "0x7fff577d6785", "parentcaller": "0x7fff557c9591", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" } ], "repeated": 0, "id": 923 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e86000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 924 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "11272", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\MountPointManager" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 925 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000031a" }, { "name": "ValueName", "value": "BrowseInPlace" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\lnkfile\\BrowseInPlace" } ], "repeated": 0, "id": 926 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "11272", "caller": "0x7fff577ef54e", "parentcaller": "0x7fff5587626d", "category": "device", "api": "DeviceIoControl", "status": true, "return": "0x00000001", "arguments": [ { "name": "DeviceHandle", "value": "0x0000032c" }, { "name": "IoControlCode", "value": "0x006d0034", "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATHS" }, { "name": "InBuffer", "value": "`\\x00\\\\x00?\\x00?\\x00\\\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00{\\x005\\x002\\x008\\x00c\\x001\\x000\\x002\\x00f\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x00c\\x000\\x00d\\x00d\\x000\\x00e\\x000\\x000\\x000\\x000\\x000\\x000\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "OutBuffer", "value": "\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 927 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "11272", "caller": "0x7fff577d6785", "parentcaller": "0x7fff577ef55e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" } ], "repeated": 0, "id": 928 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "11284", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5589286f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000330" } ], "repeated": 0, "id": 929 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x0000031a" }, { "name": "SubKey", "value": "BrowseInPlace" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\lnkfile\\BrowseInPlace" } ], "repeated": 0, "id": 930 }, { "timestamp": "2026-05-29 01:05:17,508", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002f6" }, { "name": "ValueName", "value": "BrowseInPlace" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\SystemFileAssociations\\.lnk\\BrowseInPlace" } ], "repeated": 0, "id": 931 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000002f6" }, { "name": "SubKey", "value": "BrowseInPlace" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\SystemFileAssociations\\.lnk\\BrowseInPlace" } ], "repeated": 0, "id": 932 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002fa" }, { "name": "ValueName", "value": "Content Type" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.lnk\\Content Type" } ], "repeated": 0, "id": 933 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000031a" }, { "name": "SubKey", "value": "Clsid" }, { "name": "Handle", "value": "0x00000322" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\lnkfile\\Clsid" } ], "repeated": 0, "id": 934 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000322" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{00021401-0000-0000-C000-000000000046}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\lnkfile\\CLSID\\(Default)" } ], "repeated": 0, "id": 935 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000322" } ], "repeated": 0, "id": 936 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "CLSID\\{00021401-0000-0000-C000-000000000046}\\Implemented Categories\\{00021490-0000-0000-C000-000000000046}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\CLSID\\{00021401-0000-0000-C000-000000000046}\\Implemented Categories\\{00021490-0000-0000-C000-000000000046}" } ], "repeated": 0, "id": 937 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000031a" }, { "name": "ValueName", "value": "IsShortcut" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\lnkfile\\IsShortcut" } ], "repeated": 0, "id": 938 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000031a" }, { "name": "ValueName", "value": "AlwaysShowExt" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\lnkfile\\AlwaysShowExt" } ], "repeated": 0, "id": 939 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002f6" }, { "name": "ValueName", "value": "AlwaysShowExt" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\SystemFileAssociations\\.lnk\\AlwaysShowExt" } ], "repeated": 0, "id": 940 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000031a" }, { "name": "ValueName", "value": "NeverShowExt" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\lnkfile\\NeverShowExt" } ], "repeated": 0, "id": 941 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002fa" } ], "repeated": 0, "id": 942 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000031a" } ], "repeated": 0, "id": 943 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f6" } ], "repeated": 0, "id": 944 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff44c39000" }, { "name": "ModuleName", "value": "appresolver.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 945 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff44c39000" }, { "name": "ModuleName", "value": "appresolver.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 946 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlRegisterFeatureConfigurationChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59f593b0" } ], "repeated": 0, "id": 947 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "NtQueryWnfStateData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fefc40" } ], "repeated": 0, "id": 948 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlSubscribeWnfStateChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59f92460" } ], "repeated": 0, "id": 949 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlQueryFeatureConfiguration" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59facbd0" } ], "repeated": 0, "id": 950 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fb3410" } ], "repeated": 0, "id": 951 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x000002f4" }, { "name": "MutexName", "value": "Local\\SM0:11260:304:WilStaging_02" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 952 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 953 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 954 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 955 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 956 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 957 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" } ], "repeated": 0, "id": 958 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" } ], "repeated": 0, "id": 959 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f4" } ], "repeated": 0, "id": 960 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f4" } ], "repeated": 0, "id": 961 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000318" } ], "repeated": 0, "id": 962 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 963 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\x10\\xc8\\xec\\x11l\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 964 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000002f8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 965 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000002f8" }, { "name": "SubKey", "value": "{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}" }, { "name": "Handle", "value": "0x00000320" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}" } ], "repeated": 0, "id": 966 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" } ], "repeated": 0, "id": 967 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000320" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\\Category" } ], "repeated": 0, "id": 968 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000320" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "ProgramFilesX86" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\\Name" } ], "repeated": 0, "id": 969 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000320" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\\ParentFolder" } ], "repeated": 0, "id": 970 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000320" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\\Description" } ], "repeated": 0, "id": 971 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000320" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\\RelativePath" } ], "repeated": 0, "id": 972 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000320" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\\ParsingName" } ], "repeated": 0, "id": 973 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000320" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\\InfoTip" } ], "repeated": 0, "id": 974 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000320" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "Data", "value": "@%SystemRoot%\\system32\\shell32.dll,-21817" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\\LocalizedName" } ], "repeated": 0, "id": 975 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000320" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\\Icon" } ], "repeated": 0, "id": 976 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000320" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\\Security" } ], "repeated": 0, "id": 977 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000320" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\\StreamResource" } ], "repeated": 0, "id": 978 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000320" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\\StreamResourceType" } ], "repeated": 0, "id": 979 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000320" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\\LocalRedirectOnly" } ], "repeated": 0, "id": 980 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000320" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\\Roamable" } ], "repeated": 0, "id": 981 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000320" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\\PreCreate" } ], "repeated": 0, "id": 982 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000320" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\\Stream" } ], "repeated": 0, "id": 983 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000320" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\\PublishExpandedPath" } ], "repeated": 0, "id": 984 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000320" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\\DefinitionFlags" } ], "repeated": 0, "id": 985 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000320" }, { "name": "ValueName", "value": "Attributes" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\\Attributes" } ], "repeated": 0, "id": 986 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000320" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\\FolderTypeID" } ], "repeated": 0, "id": 987 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000320" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\\InitFolderHandler" } ], "repeated": 0, "id": 988 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000320" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000338" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\\PropertyBag" } ], "repeated": 0, "id": 989 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000320" } ], "repeated": 0, "id": 990 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion" }, { "name": "Handle", "value": "0x00000320" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion" } ], "repeated": 0, "id": 991 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000320" }, { "name": "ValueName", "value": "ProgramFilesDir (x86)" }, { "name": "Data", "value": "C:\\Program Files (x86)" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ProgramFilesDir (x86)" } ], "repeated": 0, "id": 992 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000320" } ], "repeated": 0, "id": 993 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" } ], "repeated": 0, "id": 994 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000318" } ], "repeated": 0, "id": 995 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 996 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\x10\\xc8\\xec\\x11l\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 997 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x00000320" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 998 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000320" }, { "name": "SubKey", "value": "{6D809377-6AF0-444B-8957-A3773F02200E}" }, { "name": "Handle", "value": "0x0000033c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{6D809377-6AF0-444B-8957-A3773F02200E}" } ], "repeated": 0, "id": 999 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000320" } ], "repeated": 0, "id": 1000 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000033c" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{6D809377-6AF0-444b-8957-A3773F02200E}\\Category" } ], "repeated": 0, "id": 1001 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000033c" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "ProgramFilesX64" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{6D809377-6AF0-444b-8957-A3773F02200E}\\Name" } ], "repeated": 0, "id": 1002 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000033c" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{6D809377-6AF0-444b-8957-A3773F02200E}\\ParentFolder" } ], "repeated": 0, "id": 1003 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000033c" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{6D809377-6AF0-444b-8957-A3773F02200E}\\Description" } ], "repeated": 0, "id": 1004 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000033c" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{6D809377-6AF0-444b-8957-A3773F02200E}\\RelativePath" } ], "repeated": 0, "id": 1005 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000033c" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{6D809377-6AF0-444b-8957-A3773F02200E}\\ParsingName" } ], "repeated": 0, "id": 1006 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000033c" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{6D809377-6AF0-444b-8957-A3773F02200E}\\InfoTip" } ], "repeated": 0, "id": 1007 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000033c" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{6D809377-6AF0-444b-8957-A3773F02200E}\\LocalizedName" } ], "repeated": 0, "id": 1008 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000033c" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{6D809377-6AF0-444b-8957-A3773F02200E}\\Icon" } ], "repeated": 0, "id": 1009 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000033c" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{6D809377-6AF0-444b-8957-A3773F02200E}\\Security" } ], "repeated": 0, "id": 1010 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000033c" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{6D809377-6AF0-444b-8957-A3773F02200E}\\StreamResource" } ], "repeated": 0, "id": 1011 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000033c" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{6D809377-6AF0-444b-8957-A3773F02200E}\\StreamResourceType" } ], "repeated": 0, "id": 1012 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000033c" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{6D809377-6AF0-444b-8957-A3773F02200E}\\LocalRedirectOnly" } ], "repeated": 0, "id": 1013 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000033c" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{6D809377-6AF0-444b-8957-A3773F02200E}\\Roamable" } ], "repeated": 0, "id": 1014 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000033c" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{6D809377-6AF0-444b-8957-A3773F02200E}\\PreCreate" } ], "repeated": 0, "id": 1015 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000033c" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{6D809377-6AF0-444b-8957-A3773F02200E}\\Stream" } ], "repeated": 0, "id": 1016 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000033c" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{6D809377-6AF0-444b-8957-A3773F02200E}\\PublishExpandedPath" } ], "repeated": 0, "id": 1017 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000033c" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{6D809377-6AF0-444b-8957-A3773F02200E}\\DefinitionFlags" } ], "repeated": 0, "id": 1018 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000033c" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{6D809377-6AF0-444b-8957-A3773F02200E}\\Attributes" } ], "repeated": 0, "id": 1019 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000033c" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{6D809377-6AF0-444b-8957-A3773F02200E}\\FolderTypeID" } ], "repeated": 0, "id": 1020 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000033c" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{6D809377-6AF0-444b-8957-A3773F02200E}\\InitFolderHandler" } ], "repeated": 0, "id": 1021 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x0000033c" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{6D809377-6AF0-444b-8957-A3773F02200E}\\PropertyBag" } ], "repeated": 0, "id": 1022 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000033c" } ], "repeated": 0, "id": 1023 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion" }, { "name": "Handle", "value": "0x0000033c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion" } ], "repeated": 0, "id": 1024 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000033c" }, { "name": "ValueName", "value": "ProgramFilesDir" }, { "name": "Data", "value": "C:\\Program Files" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ProgramFilesDir" } ], "repeated": 0, "id": 1025 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000033c" } ], "repeated": 0, "id": 1026 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" } ], "repeated": 0, "id": 1027 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000318" } ], "repeated": 0, "id": 1028 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1029 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\x10\\xc8\\xec\\x11l\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1030 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x0000033c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 1031 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000033c" }, { "name": "SubKey", "value": "{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}" }, { "name": "Handle", "value": "0x00000320" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}" } ], "repeated": 0, "id": 1032 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000033c" } ], "repeated": 0, "id": 1033 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000320" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\Category" } ], "repeated": 0, "id": 1034 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000320" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "SystemX86" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\Name" } ], "repeated": 0, "id": 1035 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000320" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\ParentFolder" } ], "repeated": 0, "id": 1036 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000320" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\Description" } ], "repeated": 0, "id": 1037 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000320" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\RelativePath" } ], "repeated": 0, "id": 1038 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000320" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\ParsingName" } ], "repeated": 0, "id": 1039 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000320" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\InfoTip" } ], "repeated": 0, "id": 1040 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000320" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\LocalizedName" } ], "repeated": 0, "id": 1041 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000320" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\Icon" } ], "repeated": 0, "id": 1042 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000320" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\Security" } ], "repeated": 0, "id": 1043 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000320" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\StreamResource" } ], "repeated": 0, "id": 1044 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000320" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\StreamResourceType" } ], "repeated": 0, "id": 1045 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000320" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\LocalRedirectOnly" } ], "repeated": 0, "id": 1046 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000320" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\Roamable" } ], "repeated": 0, "id": 1047 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000320" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\PreCreate" } ], "repeated": 0, "id": 1048 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000320" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\Stream" } ], "repeated": 0, "id": 1049 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000320" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\PublishExpandedPath" } ], "repeated": 0, "id": 1050 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000320" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\DefinitionFlags" } ], "repeated": 0, "id": 1051 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000320" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\Attributes" } ], "repeated": 0, "id": 1052 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000320" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\FolderTypeID" } ], "repeated": 0, "id": 1053 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000320" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\InitFolderHandler" } ], "repeated": 0, "id": 1054 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000320" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x0000033c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\PropertyBag" } ], "repeated": 0, "id": 1055 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000320" } ], "repeated": 0, "id": 1056 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" } ], "repeated": 0, "id": 1057 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "1F486A52-3CB1-48FD-8F50-B8DC300D9F9D" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "ECF31D61-E474-453C-BEE7-DE68E441C6D0" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1058 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0xfffffffc" } ], "repeated": 1, "id": 1059 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "Local\\C:*Users*admin*AppData*Local*Microsoft*Windows*Caches*cversions.3" } ], "repeated": 0, "id": 1060 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000318" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "Local\\C:*Users*admin*AppData*Local*Microsoft*Windows*Caches*cversions.3.ro" } ], "repeated": 0, "id": 1061 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000318" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1f5c3740000" }, { "name": "SectionOffset", "value": "0x6c11ecde30" }, { "name": "ViewSize", "value": "0x00004000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1062 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000320" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "Local\\C:*Users*admin*AppData*Local*Microsoft*Windows*Caches*{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000017.db" } ], "repeated": 0, "id": 1063 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000320" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1f5c3750000" }, { "name": "SectionOffset", "value": "0x6c11eced90" }, { "name": "ViewSize", "value": "0x00014000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1064 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetUserDefaultLCID", "status": true, "return": "0x00000c09", "arguments": [ { "name": "SystemDefaultLangID", "value": "0x00000c09" }, { "name": "LanguageName", "value": "English (Australia)" } ], "repeated": 0, "id": 1065 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xf0\\xe9\\xec\\x11l\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf5\\x01\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x009\\xc0\\xf5\\x01\\x00\\x00\\xe9\\xea\\xec\\x11l\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1066 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002f8" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 1067 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000002f8" }, { "name": "SubKey", "value": "" }, { "name": "Handle", "value": "0x00000330" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\" } ], "repeated": 0, "id": 1068 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000330" }, { "name": "SubKey", "value": "Control Panel\\International\\User Profile" }, { "name": "Handle", "value": "0x0000032c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Control Panel\\International\\User Profile" } ], "repeated": 0, "id": 1069 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" } ], "repeated": 0, "id": 1070 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "Languages" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Control Panel\\International\\User Profile\\Languages" } ], "repeated": 0, "id": 1071 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "Languages" }, { "name": "Data", "value": "\\x00\\x00" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Control Panel\\International\\User Profile\\Languages" } ], "repeated": 0, "id": 1072 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff4c578000" }, { "name": "ModuleName", "value": "Bcp47Langs.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1073 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff4c578000" }, { "name": "ModuleName", "value": "Bcp47Langs.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1074 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" } ], "repeated": 0, "id": 1075 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000330" } ], "repeated": 0, "id": 1076 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x10\\xe6\\xec\\x11l\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf5\\x01\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00F\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00j\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1077 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000330" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 1078 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000032c" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000330" }, { "name": "ObjectAttributesName", "value": "Control Panel\\International\\Geo" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Control Panel\\International\\Geo" } ], "repeated": 0, "id": 1079 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000330" } ], "repeated": 0, "id": 1080 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000032c" }, { "name": "ValueName", "value": "Nation" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "12" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Control Panel\\International\\Geo\\Nation" } ], "repeated": 0, "id": 1081 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" } ], "repeated": 0, "id": 1082 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 1083 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000340" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "11260" } ], "repeated": 0, "id": 1084 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000340" } ], "repeated": 0, "id": 1085 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000320" } ], "repeated": 0, "id": 1086 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1f5c3750000" }, { "name": "RegionSize", "value": "0x00014000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 1087 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0xfffffffc" } ], "repeated": 0, "id": 1088 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" } ], "repeated": 0, "id": 1089 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1f5c3740000" }, { "name": "RegionSize", "value": "0x00004000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 1090 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000318" } ], "repeated": 0, "id": 1091 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1092 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "p\\xd0\\xec\\x11l\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1093 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x00000320" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 1094 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000320" }, { "name": "SubKey", "value": "{AE50C081-EBD2-438A-8655-8A092E34987A}" }, { "name": "Handle", "value": "0x00000340" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}" } ], "repeated": 0, "id": 1095 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000320" } ], "repeated": 0, "id": 1096 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000340" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Category" } ], "repeated": 0, "id": 1097 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000340" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "Recent" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Name" } ], "repeated": 0, "id": 1098 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000340" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "Data", "value": "{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\ParentFolder" } ], "repeated": 0, "id": 1099 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000340" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Description" } ], "repeated": 0, "id": 1100 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000340" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "Microsoft\\Windows\\Recent" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\RelativePath" } ], "repeated": 0, "id": 1101 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000340" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\ParsingName" } ], "repeated": 0, "id": 1102 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000340" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "Data", "value": "@shell32,dll,-12692" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\InfoTip" } ], "repeated": 0, "id": 1103 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000340" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "Data", "value": "@%SystemRoot%\\system32\\shell32.dll,-21797" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\LocalizedName" } ], "repeated": 0, "id": 1104 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000340" }, { "name": "ValueName", "value": "Icon" }, { "name": "Data", "value": "%SystemRoot%\\system32\\imageres.dll,-117" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Icon" } ], "repeated": 0, "id": 1105 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000340" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Security" } ], "repeated": 0, "id": 1106 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000340" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\StreamResource" } ], "repeated": 0, "id": 1107 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000340" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\StreamResourceType" } ], "repeated": 0, "id": 1108 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000340" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\LocalRedirectOnly" } ], "repeated": 0, "id": 1109 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000340" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Roamable" } ], "repeated": 0, "id": 1110 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000340" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\PreCreate" } ], "repeated": 0, "id": 1111 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000340" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Stream" } ], "repeated": 0, "id": 1112 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000340" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\PublishExpandedPath" } ], "repeated": 0, "id": 1113 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000340" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\DefinitionFlags" } ], "repeated": 0, "id": 1114 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000340" }, { "name": "ValueName", "value": "Attributes" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Attributes" } ], "repeated": 0, "id": 1115 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000340" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\FolderTypeID" } ], "repeated": 0, "id": 1116 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000340" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\InitFolderHandler" } ], "repeated": 0, "id": 1117 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000340" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\PropertyBag" } ], "repeated": 0, "id": 1118 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000340" } ], "repeated": 0, "id": 1119 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000002e4" }, { "name": "SubKey", "value": "SessionInfo\\1" }, { "name": "Handle", "value": "0x00000340" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1" } ], "repeated": 0, "id": 1120 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000340" }, { "name": "SubKey", "value": "KnownFolders" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1\\KnownFolders" } ], "repeated": 0, "id": 1121 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000340" } ], "repeated": 0, "id": 1122 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "0\\xcc\\xec\\x11l\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x80@\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1123 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000340" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 1124 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000340" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" }, { "name": "Handle", "value": "0x000002e8" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" } ], "repeated": 0, "id": 1125 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000340" } ], "repeated": 0, "id": 1126 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "Recent" }, { "name": "Data", "value": "%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Recent" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Recent" } ], "repeated": 0, "id": 1127 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" } ], "repeated": 0, "id": 1128 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 1129 }, { "timestamp": "2026-05-29 01:05:17,524", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "filesystem", "api": "CreateDirectoryW", "status": false, "return": "0x00000000", "arguments": [ { "name": "DirectoryName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations" } ], "repeated": 0, "id": 1130 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "MutexName", "value": "" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 1131 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1132 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 1133 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1134 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1135 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 1136 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms" }, { "name": "Buffer", "value": "\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x14\\x02\\x00\\x00\\x00\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00FL\\x00\\x00\\x00\\x01\\x14\\x02\\x00\\x00\\x00\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00F\\xc3 \\xa0\\x00 \\x00\\x00\\x00\\\\xbd\\xd6\\x9c\\xb6\\xee\\xdc\\x01D*\\x07[\\x05\\xef\\xdc\\x01z\\xe4:{\\xde\\xac\\xd5\\x01\\xeb\t\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb6\\x03:\\x00\\x1fDG\\x1a\\x03Yr?\\xa7D\\x89\\xc5U\\x95\\xfek0\\xee&\\x00\\x01\\x00&\\x00\\xef\\xbe\\x10\\x00\\x00\\x00\\xf4a\\xd0\\x9c\\xb6\\xee\\xdc\\x01qU\\x1e\\x1f\\x05\\xef\\xdc\\x01\\x06R\\x07[\\x05\\xef\\xdc\\x01\\x14\\x00\\x82\\x00t\\x00\\x1c\\x00CFSF\\x16\\x001\\x00\\x00\\x00\\x00\\x00\\xbc\\\\x8a{\\x12\\x00AppData\\x00\\x00\\x00t\\x1aY^\\x96\\xdf\\xd3H\\x8dg\\x173\\xbc\\xee(\\xba\\xc5\\xcd\\xfa\\xdf\\x9fgVA\\x89G\\xc5\\xc7k\\xc0\\xb6\\x7f@\\x00\t\\x00\\x04\\x00\\xef\\xbe\\xbc\\\\x8a{\\xbd\\t\\x05.\\x00" }, { "name": "Length", "value": "4096" } ], "repeated": 0, "id": 1137 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1138 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1139 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 1, "id": 1140 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 1141 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1142 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1143 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 1144 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1145 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1146 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 1, "id": 1147 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 1148 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1149 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1150 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 1151 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1152 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1153 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 1, "id": 1154 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 1155 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1156 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1157 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 1158 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1159 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1160 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 1, "id": 1161 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 1162 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1163 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1164 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 1165 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1166 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1167 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 1, "id": 1168 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 1169 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1170 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1171 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 1172 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1173 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1174 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 1, "id": 1175 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\windows.storage.dll" }, { "name": "BaseAddress", "value": "0x7fff55710000" } ], "repeated": 0, "id": 1176 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00021401-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "000214F9-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "lnkfile" } ], "repeated": 0, "id": 1177 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 1178 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1179 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1180 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 1181 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1182 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1183 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 1, "id": 1184 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 1185 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1186 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1187 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 1188 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1189 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1190 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 1, "id": 1191 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 1192 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1193 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1194 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 1195 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1196 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1197 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 1, "id": 1198 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 1199 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1200 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1201 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 1202 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1203 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1204 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 1, "id": 1205 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 1206 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1207 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1208 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 1209 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms" }, { "name": "FileInformationClass", "value": "4", "pretty_value": "FileBasicInformation" }, { "name": "FileInformation", "value": "\\xbe7\\xc0\\xa1\\xb7\\xee\\xdc\\x01`A\\xac6\\x07\\xef\\xdc\\x01\\xfa\\xe9\\x08[\\x05\\xef\\xdc\\x01\\xe6\\x12\n[\\x05\\xef\\xdc\\x01 \\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1210 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00 \\x00\\x00\\x00\\x00\\x00\\x00A\\x15\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1211 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1212 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1213 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 1, "id": 1214 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 1215 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1216 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1217 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 1218 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1219 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1220 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 1, "id": 1221 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 1222 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1223 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1224 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 1225 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1226 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1227 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 1, "id": 1228 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 1229 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1230 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1231 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 1232 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1233 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1234 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 1, "id": 1235 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 1236 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1237 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1238 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 1239 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1240 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1241 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 1, "id": 1242 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 1243 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1244 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1245 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 1246 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1247 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1248 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 1, "id": 1249 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 1250 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1251 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1252 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 1253 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1254 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1255 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 1, "id": 1256 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 1257 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1258 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1259 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 1260 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1261 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1262 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 1, "id": 1263 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 1264 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1265 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1266 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 1267 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1268 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1269 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 1, "id": 1270 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 1271 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1272 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1273 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 1274 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1275 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1276 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 1, "id": 1277 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "CLSID\\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\\ShellFolder" }, { "name": "Handle", "value": "0x0000032e" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\CLSID\\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\\ShellFolder" } ], "repeated": 0, "id": 1278 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032e" }, { "name": "ValueName", "value": "Attributes" }, { "name": "Data", "value": "18446744073449767213" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{59031a47-3f72-44a7-89c5-5595fe6b30ee}\\ShellFolder\\Attributes" } ], "repeated": 0, "id": 1279 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032e" }, { "name": "ValueName", "value": "CallForAttributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{59031a47-3f72-44a7-89c5-5595fe6b30ee}\\ShellFolder\\CallForAttributes" } ], "repeated": 0, "id": 1280 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032e" }, { "name": "ValueName", "value": "RestrictedAttributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{59031a47-3f72-44a7-89c5-5595fe6b30ee}\\ShellFolder\\RestrictedAttributes" } ], "repeated": 0, "id": 1281 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032e" }, { "name": "ValueName", "value": "FolderValueFlags" }, { "name": "Data", "value": "5243433" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{59031a47-3f72-44a7-89c5-5595fe6b30ee}\\ShellFolder\\FolderValueFlags" } ], "repeated": 0, "id": 1282 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032e" } ], "repeated": 0, "id": 1283 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\CLSID\\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\\ShellFolder" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\CLSID\\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\\ShellFolder" } ], "repeated": 0, "id": 1284 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\CLSID\\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\\ShellFolder" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\CLSID\\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\\ShellFolder" } ], "repeated": 0, "id": 1285 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum" } ], "repeated": 0, "id": 1286 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum" }, { "name": "Handle", "value": "0x0000032c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum" } ], "repeated": 0, "id": 1287 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "{59031A47-3F72-44A7-89C5-5595FE6B30EE}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum\\{59031A47-3F72-44A7-89C5-5595FE6B30EE}" } ], "repeated": 0, "id": 1288 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" } ], "repeated": 0, "id": 1289 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 1290 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000000e8" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1291 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000330" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000000e8" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UsersFiles\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UsersFiles\\NameSpace" } ], "repeated": 0, "id": 1292 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000330" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UsersFiles\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 1293 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000330" } ], "repeated": 0, "id": 1294 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 1295 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000000e8" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1296 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000330" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000000e8" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UsersFiles\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UsersFiles\\NameSpace" } ], "repeated": 0, "id": 1297 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000330" }, { "name": "ValueName", "value": "MonitorRegistry" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UsersFiles\\NameSpace\\MonitorRegistry" } ], "repeated": 0, "id": 1298 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000330" } ], "repeated": 0, "id": 1299 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 1300 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000000e8" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1301 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000330" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000000e8" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UsersFiles\\NameSpace\\DelegateFolders" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UsersFiles\\NameSpace\\DelegateFolders" } ], "repeated": 0, "id": 1302 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000330" }, { "name": "ValueName", "value": "StorageDelegateSuppressionPolicy" }, { "name": "Data", "value": "{92803FB4-7706-4035-ACD7-F63E069D3697}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UsersFiles\\NameSpace\\DelegateFolders\\StorageDelegateSuppressionPolicy" } ], "repeated": 0, "id": 1303 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000330" } ], "repeated": 0, "id": 1304 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "Handle", "value": "0x00000330" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 1305 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000330" }, { "name": "ValueName", "value": "PreventItemCreationInUsersFilesFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\PreventItemCreationInUsersFilesFolder" } ], "repeated": 0, "id": 1306 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000330" } ], "repeated": 0, "id": 1307 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 1308 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 1309 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000000e8" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1310 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000330" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000000e8" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UsersFiles\\NameSpace\\DelegateFolders" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UsersFiles\\NameSpace\\DelegateFolders" } ], "repeated": 0, "id": 1311 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000330" }, { "name": "ValueName", "value": "StorageDelegate" }, { "name": "Data", "value": "{DFFACDC5-679F-4156-8947-C5C76BC0B67F}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UsersFiles\\NameSpace\\DelegateFolders\\StorageDelegate" } ], "repeated": 0, "id": 1312 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000330" } ], "repeated": 0, "id": 1313 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance" }, { "name": "Handle", "value": "0x00000332" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance" } ], "repeated": 0, "id": 1314 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000332" }, { "name": "ValueName", "value": "CLSID" }, { "name": "Data", "value": "{0E5AAE11-A475-4c5b-AB00-C66DE400274E}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance\\CLSID" } ], "repeated": 0, "id": 1315 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000002f8" } ], "repeated": 0, "id": 1316 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "18" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 1317 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "20" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 1318 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" } ], "repeated": 0, "id": 1319 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Classes\\CLSID\\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\\InProcServer32" }, { "name": "Handle", "value": "0x000002f8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\\InProcServer32" } ], "repeated": 0, "id": 1320 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "%SystemRoot%\\system32\\Windows.Storage.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{0E5AAE11-A475-4c5b-AB00-C66DE400274E}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 1321 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "ValueName", "value": "LoadWithoutCOM" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{0E5AAE11-A475-4c5b-AB00-C66DE400274E}\\InProcServer32\\LoadWithoutCOM" } ], "repeated": 0, "id": 1322 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" } ], "repeated": 0, "id": 1323 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\Windows.Storage.dll" }, { "name": "BaseAddress", "value": "0x7fff55710000" } ], "repeated": 0, "id": 1324 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0E5AAE11-A475-4C5B-AB00-C66DE400274E" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1325 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000332" }, { "name": "SubKey", "value": "InitPropertyBag" }, { "name": "Handle", "value": "0x000002fa" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance\\InitPropertyBag" } ], "repeated": 0, "id": 1326 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff58b12000" }, { "name": "ModuleName", "value": "SHLWAPI.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1327 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff58b12000" }, { "name": "ModuleName", "value": "SHLWAPI.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1328 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002fa" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance\\InitPropertyBag\\Attributes" } ], "repeated": 0, "id": 1329 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002fa" }, { "name": "ValueName", "value": "Attributes" }, { "name": "Data", "value": "17" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance\\InitPropertyBag\\Attributes" } ], "repeated": 0, "id": 1330 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002fa" }, { "name": "ValueName", "value": "DescriptionID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance\\InitPropertyBag\\DescriptionID" } ], "repeated": 0, "id": 1331 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002fa" }, { "name": "ValueName", "value": "HelpTopic" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance\\InitPropertyBag\\HelpTopic" } ], "repeated": 0, "id": 1332 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002fa" }, { "name": "ValueName", "value": "AllowChildAliasRegistration" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance\\InitPropertyBag\\AllowChildAliasRegistration" } ], "repeated": 0, "id": 1333 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002fa" }, { "name": "ValueName", "value": "RecursiveSearch" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance\\InitPropertyBag\\RecursiveSearch" } ], "repeated": 0, "id": 1334 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002fa" }, { "name": "ValueName", "value": "TargetKnownFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance\\InitPropertyBag\\TargetKnownFolder" } ], "repeated": 0, "id": 1335 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002fa" }, { "name": "ValueName", "value": "TargetKnownFolder" }, { "name": "Data", "value": "{5E6C858F-0E22-4760-9AFE-EA3317B67173}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance\\InitPropertyBag\\TargetKnownFolder" } ], "repeated": 0, "id": 1336 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance" } ], "repeated": 0, "id": 1337 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance" }, { "name": "Handle", "value": "0x00000320" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance" } ], "repeated": 0, "id": 1338 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000320" }, { "name": "SubKey", "value": "" }, { "name": "Handle", "value": "0x00000344" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance\\" } ], "repeated": 0, "id": 1339 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000320" } ], "repeated": 0, "id": 1340 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000344" }, { "name": "SubKey", "value": "" }, { "name": "Handle", "value": "0x00000320" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\Instance\\" } ], "repeated": 0, "id": 1341 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002fa" } ], "repeated": 0, "id": 1342 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" } ], "repeated": 0, "id": 1343 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000332" } ], "repeated": 0, "id": 1344 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000330" } ], "repeated": 0, "id": 1345 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1346 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "0\\xb8\\xec\\x11l\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1347 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x00000344" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 1348 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000344" }, { "name": "SubKey", "value": "{5E6C858F-0E22-4760-9AFE-EA3317B67173}" }, { "name": "Handle", "value": "0x000002f8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}" } ], "repeated": 0, "id": 1349 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" } ], "repeated": 0, "id": 1350 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\Category" } ], "repeated": 0, "id": 1351 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "Profile" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\Name" } ], "repeated": 0, "id": 1352 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\ParentFolder" } ], "repeated": 0, "id": 1353 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\Description" } ], "repeated": 0, "id": 1354 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\RelativePath" } ], "repeated": 0, "id": 1355 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\ParsingName" } ], "repeated": 0, "id": 1356 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\InfoTip" } ], "repeated": 0, "id": 1357 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\LocalizedName" } ], "repeated": 0, "id": 1358 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\Icon" } ], "repeated": 0, "id": 1359 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\Security" } ], "repeated": 0, "id": 1360 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\StreamResource" } ], "repeated": 0, "id": 1361 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\StreamResourceType" } ], "repeated": 0, "id": 1362 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\LocalRedirectOnly" } ], "repeated": 0, "id": 1363 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\Roamable" } ], "repeated": 0, "id": 1364 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\PreCreate" } ], "repeated": 0, "id": 1365 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\Stream" } ], "repeated": 0, "id": 1366 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\PublishExpandedPath" } ], "repeated": 0, "id": 1367 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\DefinitionFlags" } ], "repeated": 0, "id": 1368 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\Attributes" } ], "repeated": 0, "id": 1369 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\FolderTypeID" } ], "repeated": 0, "id": 1370 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\InitFolderHandler" } ], "repeated": 0, "id": 1371 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000002f8" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\PropertyBag" } ], "repeated": 0, "id": 1372 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" } ], "repeated": 0, "id": 1373 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000002f8" } ], "repeated": 0, "id": 1374 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x00\\xc7=\\xc0\\xf5\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1375 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1376 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1377 }, { "timestamp": "2026-05-29 01:05:17,540", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "93" }, { "name": "ProcessInformation", "value": "\\x7f7\\x9e}" } ], "repeated": 0, "id": 1378 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "profapi.dll" } ], "repeated": 0, "id": 1379 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\profapi.dll" } ], "repeated": 0, "id": 1380 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000344" }, { "name": "DesiredAccess", "value": "0x00100021", "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\profapi.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1381 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000348" }, { "name": "DesiredAccess", "value": "0x0000000d", "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x00000344" }, { "name": "FileName", "value": "C:\\Windows\\System32\\profapi.dll" } ], "repeated": 0, "id": 1382 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000348" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57560000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00025000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1383 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57582000" }, { "name": "ModuleName", "value": "profapi.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1384 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57577000" }, { "name": "ModuleName", "value": "profapi.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1385 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57577000" }, { "name": "ModuleName", "value": "profapi.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1386 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57577000" }, { "name": "ModuleName", "value": "profapi.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1387 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57577000" }, { "name": "ModuleName", "value": "profapi.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1388 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57577000" }, { "name": "ModuleName", "value": "profapi.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1389 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000348" } ], "repeated": 0, "id": 1390 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" } ], "repeated": 0, "id": 1391 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57577000" }, { "name": "ModuleName", "value": "profapi.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1392 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\profapi" }, { "name": "DllBase", "value": "0x7fff57560000" } ], "repeated": 0, "id": 1393 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\profapi" }, { "name": "BaseAddress", "value": "0x7fff57560000" }, { "name": "InitRoutine", "value": "0x7fff575690e0" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 1394 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e86000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1395 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e86000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1396 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "Handle", "value": "0x0000034c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 1397 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000034c" }, { "name": "ValueName", "value": "ProfileImagePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath" } ], "repeated": 0, "id": 1398 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000034c" }, { "name": "ValueName", "value": "ProfileImagePath" }, { "name": "Data", "value": "C:\\Users\\admin" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath" } ], "repeated": 0, "id": 1399 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000034c" } ], "repeated": 0, "id": 1400 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" } ], "repeated": 0, "id": 1401 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000330" } ], "repeated": 0, "id": 1402 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000330" } ], "repeated": 0, "id": 1403 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1404 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "P\\xa2\\xec\\x11l\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1405 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000002f8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 1406 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000002f8" }, { "name": "SubKey", "value": "{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}" }, { "name": "Handle", "value": "0x0000034c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}" } ], "repeated": 0, "id": 1407 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" } ], "repeated": 0, "id": 1408 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000034c" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Category" } ], "repeated": 0, "id": 1409 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000034c" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "Start Menu" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Name" } ], "repeated": 0, "id": 1410 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000034c" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "Data", "value": "{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\ParentFolder" } ], "repeated": 0, "id": 1411 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000034c" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Description" } ], "repeated": 0, "id": 1412 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000034c" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "Microsoft\\Windows\\Start Menu" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\RelativePath" } ], "repeated": 0, "id": 1413 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000034c" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\ParsingName" } ], "repeated": 0, "id": 1414 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000034c" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\InfoTip" } ], "repeated": 0, "id": 1415 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000034c" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "Data", "value": "@%SystemRoot%\\system32\\shell32.dll,-21786" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\LocalizedName" } ], "repeated": 0, "id": 1416 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000034c" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Icon" } ], "repeated": 0, "id": 1417 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000034c" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Security" } ], "repeated": 0, "id": 1418 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000034c" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\StreamResource" } ], "repeated": 0, "id": 1419 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000034c" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\StreamResourceType" } ], "repeated": 0, "id": 1420 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000034c" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\LocalRedirectOnly" } ], "repeated": 0, "id": 1421 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000034c" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Roamable" } ], "repeated": 0, "id": 1422 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000034c" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\PreCreate" } ], "repeated": 0, "id": 1423 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000034c" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Stream" } ], "repeated": 0, "id": 1424 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000034c" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\PublishExpandedPath" } ], "repeated": 0, "id": 1425 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000034c" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\DefinitionFlags" } ], "repeated": 0, "id": 1426 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000034c" }, { "name": "ValueName", "value": "Attributes" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Attributes" } ], "repeated": 0, "id": 1427 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000034c" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\FolderTypeID" } ], "repeated": 0, "id": 1428 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000034c" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\InitFolderHandler" } ], "repeated": 0, "id": 1429 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x0000034c" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\PropertyBag" } ], "repeated": 0, "id": 1430 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000034c" } ], "repeated": 0, "id": 1431 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000002e4" }, { "name": "SubKey", "value": "SessionInfo\\1" }, { "name": "Handle", "value": "0x0000034c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1" } ], "repeated": 0, "id": 1432 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x0000034c" }, { "name": "SubKey", "value": "KnownFolders" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1\\KnownFolders" } ], "repeated": 0, "id": 1433 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000034c" } ], "repeated": 0, "id": 1434 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x10\\x9e\\xec\\x11l\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x80L\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1435 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000034c" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 1436 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000034c" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" }, { "name": "Handle", "value": "0x000002f8" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" } ], "repeated": 0, "id": 1437 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000034c" } ], "repeated": 0, "id": 1438 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "ValueName", "value": "Start Menu" }, { "name": "Data", "value": "%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Start Menu" } ], "repeated": 0, "id": 1439 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000330" } ], "repeated": 0, "id": 1440 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" } ], "repeated": 0, "id": 1441 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000002f8" } ], "repeated": 0, "id": 1442 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1443 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "P\\xa2\\xec\\x11l\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1444 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x00000330" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 1445 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000330" }, { "name": "SubKey", "value": "{A4115719-D62E-491D-AA7C-E74B8BE3B067}" }, { "name": "Handle", "value": "0x0000034c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}" } ], "repeated": 0, "id": 1446 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000330" } ], "repeated": 0, "id": 1447 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000034c" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "3" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Category" } ], "repeated": 0, "id": 1448 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000034c" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "Common Start Menu" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Name" } ], "repeated": 0, "id": 1449 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000034c" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "Data", "value": "{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\ParentFolder" } ], "repeated": 0, "id": 1450 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000034c" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Description" } ], "repeated": 0, "id": 1451 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000034c" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "Microsoft\\Windows\\Start Menu" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\RelativePath" } ], "repeated": 0, "id": 1452 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000034c" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\ParsingName" } ], "repeated": 0, "id": 1453 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000034c" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\InfoTip" } ], "repeated": 0, "id": 1454 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000034c" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "Data", "value": "@%SystemRoot%\\system32\\shell32.dll,-21786" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\LocalizedName" } ], "repeated": 0, "id": 1455 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000034c" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Icon" } ], "repeated": 0, "id": 1456 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000034c" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Security" } ], "repeated": 0, "id": 1457 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000034c" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\StreamResource" } ], "repeated": 0, "id": 1458 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000034c" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\StreamResourceType" } ], "repeated": 0, "id": 1459 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000034c" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\LocalRedirectOnly" } ], "repeated": 0, "id": 1460 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000034c" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Roamable" } ], "repeated": 0, "id": 1461 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000034c" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\PreCreate" } ], "repeated": 0, "id": 1462 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000034c" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Stream" } ], "repeated": 0, "id": 1463 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000034c" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\PublishExpandedPath" } ], "repeated": 0, "id": 1464 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000034c" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\DefinitionFlags" } ], "repeated": 0, "id": 1465 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000034c" }, { "name": "ValueName", "value": "Attributes" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Attributes" } ], "repeated": 0, "id": 1466 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000034c" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\FolderTypeID" } ], "repeated": 0, "id": 1467 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000034c" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\InitFolderHandler" } ], "repeated": 0, "id": 1468 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x0000034c" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\PropertyBag" } ], "repeated": 0, "id": 1469 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000034c" } ], "repeated": 0, "id": 1470 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000002e4" }, { "name": "SubKey", "value": "SessionInfo\\1" }, { "name": "Handle", "value": "0x00000350" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1" } ], "repeated": 0, "id": 1471 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000350" }, { "name": "SubKey", "value": "KnownFolders" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1\\KnownFolders" } ], "repeated": 0, "id": 1472 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000350" } ], "repeated": 0, "id": 1473 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" }, { "name": "Handle", "value": "0x00000350" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" } ], "repeated": 0, "id": 1474 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000350" }, { "name": "ValueName", "value": "Common Start Menu" }, { "name": "Data", "value": "%ProgramData%\\Microsoft\\Windows\\Start Menu" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Common Start Menu" } ], "repeated": 0, "id": 1475 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" } ], "repeated": 0, "id": 1476 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000350" } ], "repeated": 0, "id": 1477 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000350" } ], "repeated": 0, "id": 1478 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1479 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "P\\xa2\\xec\\x11l\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1480 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000002f8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 1481 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000002f8" }, { "name": "SubKey", "value": "{F38BF404-1D43-42F2-9305-67DE0B28FC23}" }, { "name": "Handle", "value": "0x00000354" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}" } ], "repeated": 0, "id": 1482 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" } ], "repeated": 0, "id": 1483 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000354" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Category" } ], "repeated": 0, "id": 1484 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000354" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "Windows" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Name" } ], "repeated": 0, "id": 1485 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000354" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\ParentFolder" } ], "repeated": 0, "id": 1486 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000354" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Description" } ], "repeated": 0, "id": 1487 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000354" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\RelativePath" } ], "repeated": 0, "id": 1488 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000354" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\ParsingName" } ], "repeated": 0, "id": 1489 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000354" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\InfoTip" } ], "repeated": 0, "id": 1490 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000354" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\LocalizedName" } ], "repeated": 0, "id": 1491 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000354" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Icon" } ], "repeated": 0, "id": 1492 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000354" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Security" } ], "repeated": 0, "id": 1493 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000354" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\StreamResource" } ], "repeated": 0, "id": 1494 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000354" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\StreamResourceType" } ], "repeated": 0, "id": 1495 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000354" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\LocalRedirectOnly" } ], "repeated": 0, "id": 1496 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000354" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Roamable" } ], "repeated": 0, "id": 1497 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000354" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\PreCreate" } ], "repeated": 0, "id": 1498 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000354" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Stream" } ], "repeated": 0, "id": 1499 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000354" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\PublishExpandedPath" } ], "repeated": 0, "id": 1500 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000354" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\DefinitionFlags" } ], "repeated": 0, "id": 1501 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000354" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Attributes" } ], "repeated": 0, "id": 1502 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000354" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\FolderTypeID" } ], "repeated": 0, "id": 1503 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000354" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\InitFolderHandler" } ], "repeated": 0, "id": 1504 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000354" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x000002f8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\PropertyBag" } ], "repeated": 0, "id": 1505 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000354" } ], "repeated": 0, "id": 1506 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000350" } ], "repeated": 0, "id": 1507 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000350" } ], "repeated": 0, "id": 1508 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1509 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "P\\xa2\\xec\\x11l\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1510 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x00000354" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 1511 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000354" }, { "name": "SubKey", "value": "{FDD39AD0-238F-46AF-ADB4-6C85480369C7}" }, { "name": "Handle", "value": "0x00000358" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}" } ], "repeated": 0, "id": 1512 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000354" } ], "repeated": 0, "id": 1513 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000358" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Category" } ], "repeated": 0, "id": 1514 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000358" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "Personal" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Name" } ], "repeated": 0, "id": 1515 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000358" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\ParentFolder" } ], "repeated": 0, "id": 1516 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000358" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Description" } ], "repeated": 0, "id": 1517 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000358" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "Documents" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\RelativePath" } ], "repeated": 0, "id": 1518 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000358" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "Data", "value": "shell:::{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\::{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\ParsingName" } ], "repeated": 0, "id": 1519 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000358" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\InfoTip" } ], "repeated": 0, "id": 1520 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000358" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "Data", "value": "@%SystemRoot%\\system32\\windows.storage.dll,-21770" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\LocalizedName" } ], "repeated": 0, "id": 1521 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000358" }, { "name": "ValueName", "value": "Icon" }, { "name": "Data", "value": "%SystemRoot%\\system32\\imageres.dll,-112" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Icon" } ], "repeated": 0, "id": 1522 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000358" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Security" } ], "repeated": 0, "id": 1523 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000358" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\StreamResource" } ], "repeated": 0, "id": 1524 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000358" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\StreamResourceType" } ], "repeated": 0, "id": 1525 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000358" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\LocalRedirectOnly" } ], "repeated": 0, "id": 1526 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000358" }, { "name": "ValueName", "value": "Roamable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Roamable" } ], "repeated": 0, "id": 1527 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000358" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\PreCreate" } ], "repeated": 0, "id": 1528 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000358" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Stream" } ], "repeated": 0, "id": 1529 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000358" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\PublishExpandedPath" } ], "repeated": 0, "id": 1530 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000358" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\DefinitionFlags" } ], "repeated": 0, "id": 1531 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000358" }, { "name": "ValueName", "value": "Attributes" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Attributes" } ], "repeated": 0, "id": 1532 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000358" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\FolderTypeID" } ], "repeated": 0, "id": 1533 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000358" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\InitFolderHandler" } ], "repeated": 0, "id": 1534 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000358" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x0000034c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\PropertyBag" } ], "repeated": 0, "id": 1535 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000358" } ], "repeated": 0, "id": 1536 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000002e4" }, { "name": "SubKey", "value": "SessionInfo\\1" }, { "name": "Handle", "value": "0x00000358" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1" } ], "repeated": 0, "id": 1537 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000358" }, { "name": "SubKey", "value": "KnownFolders" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1\\KnownFolders" } ], "repeated": 0, "id": 1538 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000358" } ], "repeated": 0, "id": 1539 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x10\\x9e\\xec\\x11l\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x80X\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1540 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000358" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 1541 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000358" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" }, { "name": "Handle", "value": "0x00000330" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" } ], "repeated": 0, "id": 1542 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000358" } ], "repeated": 0, "id": 1543 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000330" }, { "name": "ValueName", "value": "Personal" }, { "name": "Data", "value": "%USERPROFILE%\\Documents" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Personal" } ], "repeated": 0, "id": 1544 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000350" } ], "repeated": 0, "id": 1545 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000330" } ], "repeated": 0, "id": 1546 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000330" } ], "repeated": 0, "id": 1547 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1548 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "P\\xa2\\xec\\x11l\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1549 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x00000350" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 1550 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000350" }, { "name": "SubKey", "value": "{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}" }, { "name": "Handle", "value": "0x00000358" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}" } ], "repeated": 0, "id": 1551 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000350" } ], "repeated": 0, "id": 1552 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000358" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Category" } ], "repeated": 0, "id": 1553 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000358" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "Fonts" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Name" } ], "repeated": 0, "id": 1554 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000358" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "Data", "value": "{F38BF404-1D43-42F2-9305-67DE0B28FC23}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\ParentFolder" } ], "repeated": 0, "id": 1555 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000358" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Description" } ], "repeated": 0, "id": 1556 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000358" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\RelativePath" } ], "repeated": 0, "id": 1557 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000358" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\ParsingName" } ], "repeated": 0, "id": 1558 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000358" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\InfoTip" } ], "repeated": 0, "id": 1559 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000358" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\LocalizedName" } ], "repeated": 0, "id": 1560 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000358" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Icon" } ], "repeated": 0, "id": 1561 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000358" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Security" } ], "repeated": 0, "id": 1562 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000358" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\StreamResource" } ], "repeated": 0, "id": 1563 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000358" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\StreamResourceType" } ], "repeated": 0, "id": 1564 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000358" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\LocalRedirectOnly" } ], "repeated": 0, "id": 1565 }, { "timestamp": "2026-05-29 01:05:17,555", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000358" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Roamable" } ], "repeated": 0, "id": 1566 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000358" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\PreCreate" } ], "repeated": 0, "id": 1567 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000358" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Stream" } ], "repeated": 0, "id": 1568 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000358" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\PublishExpandedPath" } ], "repeated": 0, "id": 1569 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000358" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\DefinitionFlags" } ], "repeated": 0, "id": 1570 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000358" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Attributes" } ], "repeated": 0, "id": 1571 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000358" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\FolderTypeID" } ], "repeated": 0, "id": 1572 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000358" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\InitFolderHandler" } ], "repeated": 0, "id": 1573 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000358" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000350" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\PropertyBag" } ], "repeated": 0, "id": 1574 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000358" } ], "repeated": 0, "id": 1575 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000330" } ], "repeated": 0, "id": 1576 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000323-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000146-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1577 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff587d1000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1578 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff587d1000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1579 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1580 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlRegisterFeatureConfigurationChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59f593b0" } ], "repeated": 0, "id": 1581 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "NtQueryWnfStateData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fefc40" } ], "repeated": 0, "id": 1582 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlSubscribeWnfStateChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59f92460" } ], "repeated": 0, "id": 1583 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlQueryFeatureConfiguration" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59facbd0" } ], "repeated": 0, "id": 1584 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "164" } ], "repeated": 0, "id": 1585 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000344" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx" } ], "repeated": 0, "id": 1586 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000344" }, { "name": "ValueName", "value": "AllowDevelopmentWithoutDevLicense" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx\\AllowDevelopmentWithoutDevLicense" } ], "repeated": 0, "id": 1587 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" } ], "repeated": 0, "id": 1588 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000344" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock" } ], "repeated": 0, "id": 1589 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000344" }, { "name": "ValueName", "value": "AllowDevelopmentWithoutDevLicense" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock\\AllowDevelopmentWithoutDevLicense" } ], "repeated": 0, "id": 1590 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" } ], "repeated": 0, "id": 1591 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 1592 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlRegisterFeatureConfigurationChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59f593b0" } ], "repeated": 0, "id": 1593 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "NtQueryWnfStateData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fefc40" } ], "repeated": 0, "id": 1594 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlSubscribeWnfStateChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59f92460" } ], "repeated": 0, "id": 1595 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDisownModuleHeapAllocation" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fcfa30" } ], "repeated": 0, "id": 1596 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlQueryFeatureConfiguration" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59facbd0" } ], "repeated": 0, "id": 1597 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1f5c03e7000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1598 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1f5c03e9000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1599 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\OLE\\AppCompat" }, { "name": "Handle", "value": "0x0000032c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\OLE\\AppCompat" } ], "repeated": 0, "id": 1600 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "RaiseActivationAuthenticationLevel" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\AppCompat\\RaiseActivationAuthenticationLevel" } ], "repeated": 0, "id": 1601 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" } ], "repeated": 0, "id": 1602 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000266" }, { "name": "SubKey", "value": "AppID\\powershell.exe" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\AppID\\powershell.exe" } ], "repeated": 1, "id": 1603 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\OLE\\AppCompat" }, { "name": "Handle", "value": "0x00000344" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\OLE\\AppCompat" } ], "repeated": 0, "id": 1604 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "ValueName", "value": "RaiseDefaultAuthnLevel" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\AppCompat\\RaiseDefaultAuthnLevel" } ], "repeated": 0, "id": 1605 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" } ], "repeated": 0, "id": 1606 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\OLE" }, { "name": "Handle", "value": "0x00000344" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OLE" } ], "repeated": 0, "id": 1607 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "ValueName", "value": "DefaultAccessPermission" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\DefaultAccessPermission" } ], "repeated": 0, "id": 1608 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000330" } ], "repeated": 0, "id": 1609 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1610 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": " \\x8b=\\xc0\\xf5\\x01\\x00\\x00`\\x00\\x00\\x00d\\x00o\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00" } ], "repeated": 0, "id": 1611 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000330" } ], "repeated": 0, "id": 1612 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "LdrGetDllHandle", "status": false, "return": "0xffffffffc0000135", "pretty_return": "DLL_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\system32\\rpcss.dll" }, { "name": "ModuleHandle", "value": "0x00002100" } ], "repeated": 0, "id": 1613 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" } ], "repeated": 0, "id": 1614 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1f5c03eb000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1615 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff587d1000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1616 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff587d1000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1617 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1618 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000328" } ], "repeated": 0, "id": 1619 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff587d1000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1620 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff587d1000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1621 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1622 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtOpenEvent", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "Handle", "value": "0x00002bfc" }, { "name": "EventName", "value": "MSFT.VSA.COM.DISABLE.11260" } ], "repeated": 0, "id": 1623 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtOpenEvent", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "Handle", "value": "0x00000000" }, { "name": "EventName", "value": "MSFT.VSA.IEC.STATUS.6c736db0" } ], "repeated": 0, "id": 1624 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1f5c03ee000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1625 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000266" }, { "name": "SubKey", "value": "Interface\\{00000134-0000-0000-C000-000000000046}" }, { "name": "Handle", "value": "0x00000332" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{00000134-0000-0000-C000-000000000046}" } ], "repeated": 0, "id": 1626 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000332" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x0000035a" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{00000134-0000-0000-C000-000000000046}\\ProxyStubClsid32" } ], "repeated": 0, "id": 1627 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000035a" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{00000320-0000-0000-C000-000000000046}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{00000134-0000-0000-C000-000000000046}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 1628 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000035a" } ], "repeated": 0, "id": 1629 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000332" } ], "repeated": 0, "id": 1630 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1631 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000330" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 1632 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000358" } ], "repeated": 0, "id": 1633 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "S<\n\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1634 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\x18\\x9d<\\xc0\\xf5\\x01\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00y\\x00s\\x00t\\x00e\\x00m\\x003\\x002\\x00\\\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00S\\x00t\\x00o\\x00r\\x00a\\x00g\\x00e\\x00.\\x00d\\x00l\\x00" } ], "repeated": 0, "id": 1635 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xe0\\xa3<\\xc0\\xf5\\x01\\x00\\x00`\\x00\\x00\\x00\\xadU?\\xac\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\xeb\\x1c\\xc9\\x11\\x9f\\xe8\\x08\\x00+\\x10H`\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xa6<\\xc0\\xf5\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1636 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1637 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xc8w<\\xc0\\xf5\\x01\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 1638 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1639 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xd8\\xa9<\\xc0\\xf5\\x01\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 1640 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x81\\x1a\\xff\\x7f\\x00\\x00\\xebPY\\x1a\\xff\\x7f\\x00\\x00w\\x91p\\x021p\\x00\\x00(N}\\x1a\\xff\\x7f\\x00\\x00\\x80\\xc0\\xec\\x11l\\x00\\x00\\x00x\\xc0\\xec\\x11l\\x00\\x00\\x00H\\xc0\\xec\\x11l\\x00\\x00\\x00h\\xc0\\xec\\x11" } ], "repeated": 0, "id": 1641 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xa9<\\xc0\\xf5\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8Z\\x1a\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00h\\xbe\\xec\\x11l\\x00\\x00\\x00X\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2}\\x1a" } ], "repeated": 0, "id": 1642 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "S<\n\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1643 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\xd8\\x9d<\\xc0\\xf5\\x01\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1644 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "@\\xaa<\\xc0\\xf5\\x01\\x00\\x00`\\x00\\x00\\x000\\x004\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00E\\x00A\\x00-\\x001\\x000\\x006\\x009\\x00-\\x00A\\x002\\x00D\\x008\\x00-\\x000\\x008\\x000\\x000\\x002\\x00B\\x003\\x000\\x003\\x000\\x009\\x00D\\x00}\\x00\\x00\\x00l\\x00" } ], "repeated": 0, "id": 1645 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1646 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "Hy<\\xc0\\xf5\\x01\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 1647 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1648 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xf8\\xaa<\\xc0\\xf5\\x01\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 1649 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x81\\x1a\\xff\\x7f\\x00\\x00\\xebPY\\x1a\\xff\\x7f\\x00\\x00\\x17\\x9dp\\x021p\\x00\\x00(N}\\x1a\\xff\\x7f\\x00\\x00\\xe0\\xbc\\xec\\x11l\\x00\\x00\\x00\\xd8\\xbc\\xec\\x11l\\x00\\x00\\x00\\xa8\\xbc\\xec\\x11l\\x00\\x00\\x00\\xc8\\xbc\\xec\\x11" } ], "repeated": 0, "id": 1650 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xaa<\\xc0\\xf5\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8Z\\x1a\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xc8\\xba\\xec\\x11l\\x00\\x00\\x00X\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2}\\x1a" } ], "repeated": 0, "id": 1651 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000330" } ], "repeated": 0, "id": 1652 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000358" } ], "repeated": 0, "id": 1653 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "misc", "api": "GetSystemInfo", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1654 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7fff584a0000" } ], "repeated": 0, "id": 1655 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "threading", "api": "NtCreateThreadEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x0000032c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartAddress", "value": "0x7fff58542d30" }, { "name": "Parameter", "value": "0x1f5c03e4b70" }, { "name": "CreateFlags", "value": "0x00000001" }, { "name": "ThreadId", "value": "11320" }, { "name": "ProcessId", "value": "11260" }, { "name": "Module", "value": "combase.dll" } ], "repeated": 0, "id": 1656 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x0000032c", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x7fff58542d30" }, { "name": "Parameter", "value": "0x1f5c03e4b70" }, { "name": "CreationFlags", "value": "0x00000000" }, { "name": "ThreadId", "value": "11320" }, { "name": "ProcessId", "value": "11260" } ], "repeated": 0, "id": 1657 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" } ], "repeated": 0, "id": 1658 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1659 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x0000032c" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 1660 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000035c" } ], "repeated": 0, "id": 1661 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "11320", "caller": "0x7fff577b7861", "parentcaller": "0x7fff577b7530", "category": "device", "api": "NtDeviceIoControlFile", "status": false, "return": "0xffffffffc00700bb", "arguments": [ { "name": "FileHandle", "value": "0x00000054" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\xee_\\x12l\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc8\\xee_\\x12l\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 1662 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "S<\n\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1663 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\xd8\\xa9<\\xc0\\xf5\\x01\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05" } ], "repeated": 0, "id": 1664 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\x80\\xa0<\\xc0\\xf5\\x01\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x00\\x00\t\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xc6=\\xc0\\xf5\\x01\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1665 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1666 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xe8r<\\xc0\\xf5\\x01\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 1667 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "11320", "caller": "0x7fff59fc507d", "parentcaller": "0x7fff59fc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1668 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1669 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "11320", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7fff58542d30" }, { "name": "Parameter", "value": "0x1f5c03e4b70" } ], "repeated": 0, "id": 1670 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "11320", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1f5c03f2000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1671 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "8\\xaa<\\xc0\\xf5\\x01\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 1672 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x81\\x1a\\xff\\x7f\\x00\\x00\\xebPY\\x1a\\xff\\x7f\\x00\\x00\\xa7\\x92p\\x021p\\x00\\x00(N}\\x1a\\xff\\x7f\\x00\\x00P\\xc4\\xec\\x11l\\x00\\x00\\x00H\\xc4\\xec\\x11l\\x00\\x00\\x00\\x18\\xc4\\xec\\x11l\\x00\\x00\\x008\\xc4\\xec\\x11" } ], "repeated": 0, "id": 1673 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xaa<\\xc0\\xf5\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8Z\\x1a\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x008\\xc2\\xec\\x11l\\x00\\x00\\x00\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2}\\x1a" } ], "repeated": 0, "id": 1674 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "S<\n\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1675 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\xf8\\xaa<\\xc0\\xf5\\x01\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05" } ], "repeated": 0, "id": 1676 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": " \\x9d<\\xc0\\xf5\\x01\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00t\\x00e\\x00m\\x003\\x002\\x00\\\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00S\\x00t\\x00o\\x00r\\x00a\\x00g\\x00e\\x00.\\x00d\\x00l\\x00l\\x00\\x00\\x00l\\x00\\x00\\x00" } ], "repeated": 0, "id": 1677 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1678 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xa8v<\\xc0\\xf5\\x01\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 1679 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1680 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xd8\\x9d<\\xc0\\xf5\\x01\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 1681 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x81\\x1a\\xff\\x7f\\x00\\x00\\xebPY\\x1a\\xff\\x7f\\x00\\x00G\\x91p\\x021p\\x00\\x00(N}\\x1a\\xff\\x7f\\x00\\x00\\xb0\\xc0\\xec\\x11l\\x00\\x00\\x00\\xa8\\xc0\\xec\\x11l\\x00\\x00\\x00x\\xc0\\xec\\x11l\\x00\\x00\\x00\\x98\\xc0\\xec\\x11" } ], "repeated": 0, "id": 1682 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\x9d<\\xc0\\xf5\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8Z\\x1a\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x98\\xbe\\xec\\x11l\\x00\\x00\\x00\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2}\\x1a" } ], "repeated": 0, "id": 1683 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" } ], "repeated": 0, "id": 1684 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000035c" } ], "repeated": 0, "id": 1685 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1686 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x0000035c" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 1687 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000032c" } ], "repeated": 0, "id": 1688 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "S<\n\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1689 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\x18\\x9d<\\xc0\\xf5\\x01\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x000\\x00\\x00t\\x00e\\x00m\\x003\\x002\\x00\\\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00S\\x00t\\x00o\\x00r\\x00a\\x00g\\x00e\\x00.\\x00d\\x00l\\x00" } ], "repeated": 0, "id": 1690 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xe0\\xa9<\\xc0\\xf5\\x01\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1691 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1692 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xb8r<\\xc0\\xf5\\x01\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 1693 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1694 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "8\\xaa<\\xc0\\xf5\\x01\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 1695 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x81\\x1a\\xff\\x7f\\x00\\x00\\xebPY\\x1a\\xff\\x7f\\x00\\x00\\xa7\\x92p\\x021p\\x00\\x00(N}\\x1a\\xff\\x7f\\x00\\x00P\\xc4\\xec\\x11l\\x00\\x00\\x00H\\xc4\\xec\\x11l\\x00\\x00\\x00\\x18\\xc4\\xec\\x11l\\x00\\x00\\x008\\xc4\\xec\\x11" } ], "repeated": 0, "id": 1696 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xaa<\\xc0\\xf5\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8Z\\x1a\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x008\\xc2\\xec\\x11l\\x00\\x00\\x00,\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2}\\x1a" } ], "repeated": 0, "id": 1697 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "S<\n\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1698 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\xf8\\xaa<\\xc0\\xf5\\x01\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05" } ], "repeated": 0, "id": 1699 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xe0\\x9d<\\xc0\\xf5\\x01\\x00\\x00`\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1700 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1701 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "(u<\\xc0\\xf5\\x01\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 1702 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1703 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "x\\xa0<\\xc0\\xf5\\x01\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 1704 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x81\\x1a\\xff\\x7f\\x00\\x00\\xebPY\\x1a\\xff\\x7f\\x00\\x00G\\x91p\\x021p\\x00\\x00(N}\\x1a\\xff\\x7f\\x00\\x00\\xb0\\xc0\\xec\\x11l\\x00\\x00\\x00\\xa8\\xc0\\xec\\x11l\\x00\\x00\\x00x\\xc0\\xec\\x11l\\x00\\x00\\x00\\x98\\xc0\\xec\\x11" } ], "repeated": 0, "id": 1705 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xa0<\\xc0\\xf5\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8Z\\x1a\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x98\\xbe\\xec\\x11l\\x00\\x00\\x00,\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2}\\x1a" } ], "repeated": 0, "id": 1706 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000035c" } ], "repeated": 0, "id": 1707 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" } ], "repeated": 0, "id": 1708 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1709 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x0000032c" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 1710 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000035c" } ], "repeated": 0, "id": 1711 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "S<\n\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1712 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\xd8\\xa9<\\xc0\\xf5\\x01\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05" } ], "repeated": 0, "id": 1713 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\x80\\xa0<\\xc0\\xf5\\x01\\x00\\x00`\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1714 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1715 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xa8v<\\xc0\\xf5\\x01\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 1716 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1717 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "8\\xaa<\\xc0\\xf5\\x01\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 1718 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x81\\x1a\\xff\\x7f\\x00\\x00\\xebPY\\x1a\\xff\\x7f\\x00\\x00\\xa7\\x92p\\x021p\\x00\\x00(N}\\x1a\\xff\\x7f\\x00\\x00P\\xc4\\xec\\x11l\\x00\\x00\\x00H\\xc4\\xec\\x11l\\x00\\x00\\x00\\x18\\xc4\\xec\\x11l\\x00\\x00\\x008\\xc4\\xec\\x11" } ], "repeated": 0, "id": 1719 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xaa<\\xc0\\xf5\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8Z\\x1a\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x008\\xc2\\xec\\x11l\\x00\\x00\\x00\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2}\\x1a" } ], "repeated": 0, "id": 1720 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "S<\n\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1721 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\xf8\\xaa<\\xc0\\xf5\\x01\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05" } ], "repeated": 0, "id": 1722 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": " \\x9d<\\xc0\\xf5\\x01\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00t\\x00e\\x00m\\x003\\x002\\x00\\\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00S\\x00t\\x00o\\x00r\\x00a\\x00g\\x00e\\x00.\\x00d\\x00l\\x00l\\x00\\x00\\x00l\\x00\\x00\\x00" } ], "repeated": 0, "id": 1723 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1724 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "Hv<\\xc0\\xf5\\x01\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 1725 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1726 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xd8\\x9d<\\xc0\\xf5\\x01\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 1727 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x81\\x1a\\xff\\x7f\\x00\\x00\\xebPY\\x1a\\xff\\x7f\\x00\\x00G\\x91p\\x021p\\x00\\x00(N}\\x1a\\xff\\x7f\\x00\\x00\\xb0\\xc0\\xec\\x11l\\x00\\x00\\x00\\xa8\\xc0\\xec\\x11l\\x00\\x00\\x00x\\xc0\\xec\\x11l\\x00\\x00\\x00\\x98\\xc0\\xec\\x11" } ], "repeated": 0, "id": 1728 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\x9d<\\xc0\\xf5\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8Z\\x1a\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x98\\xbe\\xec\\x11l\\x00\\x00\\x00\\\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2}\\x1a" } ], "repeated": 0, "id": 1729 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" } ], "repeated": 0, "id": 1730 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000035c" } ], "repeated": 0, "id": 1731 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1732 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x0000035c" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 1733 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000032c" } ], "repeated": 0, "id": 1734 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "S<\n\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1735 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "x\\xa0<\\xc0\\xf5\\x01\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05" } ], "repeated": 0, "id": 1736 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xe0\\xa9<\\xc0\\xf5\\x01\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1737 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1738 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xe8x<\\xc0\\xf5\\x01\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 1739 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1740 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "8\\xaa<\\xc0\\xf5\\x01\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 1741 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x81\\x1a\\xff\\x7f\\x00\\x00\\xebPY\\x1a\\xff\\x7f\\x00\\x00\\xa7\\x92p\\x021p\\x00\\x00(N}\\x1a\\xff\\x7f\\x00\\x00P\\xc4\\xec\\x11l\\x00\\x00\\x00H\\xc4\\xec\\x11l\\x00\\x00\\x00\\x18\\xc4\\xec\\x11l\\x00\\x00\\x008\\xc4\\xec\\x11" } ], "repeated": 0, "id": 1742 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xaa<\\xc0\\xf5\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8Z\\x1a\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x008\\xc2\\xec\\x11l\\x00\\x00\\x00,\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2}\\x1a" } ], "repeated": 0, "id": 1743 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "S<\n\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1744 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\xf8\\xaa<\\xc0\\xf5\\x01\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05" } ], "repeated": 0, "id": 1745 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xe0\\xa0<\\xc0\\xf5\\x01\\x00\\x00`\\x00\\x00\\x00m\\x00R\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00y\\x00s\\x00t\\x00e\\x00m\\x003\\x002\\x00\\\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00S\\x00t\\x00o\\x00r\\x00a\\x00g\\x00e\\x00.\\x00d\\x00l\\x00l\\x00\\x00\\x00" } ], "repeated": 0, "id": 1746 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1747 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\x98t<\\xc0\\xf5\\x01\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 1748 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1749 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\x18\\x9d<\\xc0\\xf5\\x01\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 1750 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x81\\x1a\\xff\\x7f\\x00\\x00\\xebPY\\x1a\\xff\\x7f\\x00\\x00G\\x91p\\x021p\\x00\\x00(N}\\x1a\\xff\\x7f\\x00\\x00\\xb0\\xc0\\xec\\x11l\\x00\\x00\\x00\\xa8\\xc0\\xec\\x11l\\x00\\x00\\x00x\\xc0\\xec\\x11l\\x00\\x00\\x00\\x98\\xc0\\xec\\x11" } ], "repeated": 0, "id": 1751 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x9d<\\xc0\\xf5\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8Z\\x1a\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x98\\xbe\\xec\\x11l\\x00\\x00\\x00,\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2}\\x1a" } ], "repeated": 0, "id": 1752 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000035c" } ], "repeated": 0, "id": 1753 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" } ], "repeated": 0, "id": 1754 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1755 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "11284", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5978ef53", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000035c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1756 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "11284", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1f5c03f5000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1757 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1f5c03f7000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1758 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000370" } ], "repeated": 0, "id": 1759 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "18" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 1760 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "20" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 1761 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000370" } ], "repeated": 0, "id": 1762 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "Directory" }, { "name": "Handle", "value": "0x00000372" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\Directory" } ], "repeated": 0, "id": 1763 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000372" }, { "name": "KeyInformation", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\Directory" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1764 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000372" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 1, "id": 1765 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000372" }, { "name": "ObjectAttributesName", "value": "ShellEx\\PropertyHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\ShellEx\\PropertyHandler" } ], "repeated": 0, "id": 1766 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\Directory\\ShellEx\\PropertyHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\Directory\\ShellEx\\PropertyHandler" } ], "repeated": 0, "id": 1767 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "Folder" }, { "name": "Handle", "value": "0x00000376" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\Folder" } ], "repeated": 0, "id": 1768 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000376" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\Folder" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1769 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000376" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1770 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xd0\\xd6\\xec\\x11l\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00v\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00l\\x00\\x00\\x00\\xd0\\xd7\\xec\\x11l\\x00\\x00\\x00" } ], "repeated": 0, "id": 1771 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\Folder\\ShellEx\\PropertyHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Folder\\ShellEx\\PropertyHandler" } ], "repeated": 0, "id": 1772 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000376" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1773 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000376" }, { "name": "ObjectAttributesName", "value": "ShellEx\\PropertyHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\ShellEx\\PropertyHandler" } ], "repeated": 0, "id": 1774 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "AllFilesystemObjects" }, { "name": "Handle", "value": "0x0000037a" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\AllFilesystemObjects" } ], "repeated": 0, "id": 1775 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000037a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1776 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000037a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1777 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xd0\\xd6\\xec\\x11l\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00z\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00l\\x00\\x00\\x00\\xd0\\xd7\\xec\\x11l\\x00\\x00\\x00" } ], "repeated": 0, "id": 1778 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\AllFilesystemObjects\\ShellEx\\PropertyHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\AllFilesystemObjects\\ShellEx\\PropertyHandler" } ], "repeated": 0, "id": 1779 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000037a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1780 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000037a" }, { "name": "ObjectAttributesName", "value": "ShellEx\\PropertyHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\ShellEx\\PropertyHandler" } ], "repeated": 0, "id": 1781 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000372" } ], "repeated": 0, "id": 1782 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000376" } ], "repeated": 0, "id": 1783 }, { "timestamp": "2026-05-29 01:05:17,571", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000037a" } ], "repeated": 0, "id": 1784 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0340F119-A598-4ED9-B0AC-6F6A12D3E755" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "7F73BE3F-FB79-493C-A6C7-7EE14E245841" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1785 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1786 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 1787 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1788 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1789 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 1790 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1791 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1792 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 1, "id": 1793 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00021401-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "000214F9-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "lnkfile" } ], "repeated": 0, "id": 1794 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 1795 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1796 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1797 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 1798 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1799 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1800 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 1, "id": 1801 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 1802 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1803 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1804 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 1805 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1806 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1807 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 1, "id": 1808 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 1809 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1810 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1811 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 1812 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1813 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1814 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 1, "id": 1815 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 1816 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1817 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1818 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 1819 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1820 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1821 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 1, "id": 1822 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 1823 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1824 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1825 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 1826 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1827 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1828 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 1, "id": 1829 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 1830 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1831 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1832 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 1833 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1834 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1835 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 1, "id": 1836 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 1837 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1838 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1839 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 1840 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1841 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1842 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 1, "id": 1843 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 1844 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1845 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1846 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 1847 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1848 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1849 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 1, "id": 1850 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 1851 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1852 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1853 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 1854 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1855 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1856 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 1, "id": 1857 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 1858 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1859 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1860 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 1861 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1862 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1863 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 1, "id": 1864 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 1865 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1866 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1867 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 1868 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1869 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1870 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 1, "id": 1871 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 1872 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1873 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1874 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 1875 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1876 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1877 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 1, "id": 1878 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 1879 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1880 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1881 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 1882 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1883 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1884 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 1, "id": 1885 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 1886 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1887 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1888 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 1889 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1890 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1891 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 1, "id": 1892 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 1893 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1894 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1895 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 1896 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1897 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1898 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 1, "id": 1899 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 1900 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1901 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1902 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 1903 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1904 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1905 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 1, "id": 1906 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 1907 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1908 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1909 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 1910 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1911 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1912 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 1, "id": 1913 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00021401-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "000214F9-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "lnkfile" } ], "repeated": 0, "id": 1914 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 1915 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1916 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1917 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 1918 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1919 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1920 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 1, "id": 1921 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 1922 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1923 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1924 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 1925 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1926 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1927 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 1, "id": 1928 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 1929 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1930 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1931 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 1932 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1933 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1934 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 1, "id": 1935 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 1936 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1937 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1938 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 1939 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms" }, { "name": "Buffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\x00o\\x00w\\x00e\\x00r\\x00s\\x00h\\x00e\\x00l\\x00l\\x00_\\x00i\\x00s\\x00e\\x00.\\x00e\\x00x\\x00e\\x00\\x00\\x00\"\\x00\\x00\\x00l\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x1c\\x00\\x00\\x00-\\x00\\x00\\x00\\x00\\x00\\x00\\x00k\\x00\\x00\\x00\\x11\\x00\\x00\\x00\\x03\\x00\\x00\\x00t6L\\xb3\\x10\\x00\\x00\\x00\\x00C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell_ise.exe\\x00\\x00?\\x00%\\x00s\\x00y\\x00s\\x00t\\x00e\\x00m\\x00r\\x00o\\x00o\\x00t\\x00%\\x00\\\\x00s\\x00y\\x00s\\x00t\\x00e\\x00m\\x003\\x002\\x00\\\\x00w\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00p\\x00o\\x00w\\x00e\\x00r\\x00s\\x00h\\x00e\\x00l\\x00l\\x00\\\\x00v\\x001\\x00.\\x000\\x00\\\\x00p" }, { "name": "Length", "value": "1345" } ], "repeated": 0, "id": 1940 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1941 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1942 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 1, "id": 1943 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 1944 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1945 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1946 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 1947 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1948 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1949 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 1, "id": 1950 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 1951 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1952 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1953 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 1954 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1955 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1956 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 1, "id": 1957 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 1958 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1959 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1960 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 1961 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1962 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1963 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 1, "id": 1964 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 1965 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1966 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1967 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 1968 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1969 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1970 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 1, "id": 1971 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 1972 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1973 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1974 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 1975 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1976 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1977 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 1, "id": 1978 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 1979 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1980 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1981 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 1982 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1983 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1984 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 1, "id": 1985 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 1986 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1987 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1988 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 1989 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1990 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1991 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 1, "id": 1992 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 1993 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1994 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1995 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 1996 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1997 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1998 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 1, "id": 1999 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 2000 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2001 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2002 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 2003 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2004 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2005 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 1, "id": 2006 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 2007 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2008 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2009 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 2010 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2011 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2012 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 1, "id": 2013 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 2014 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2015 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2016 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 2017 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2018 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2019 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 1, "id": 2020 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 2021 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2022 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2023 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 2024 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2025 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2026 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 1, "id": 2027 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 2028 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2029 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2030 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 2031 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2032 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2033 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 1, "id": 2034 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 2035 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" } ], "repeated": 0, "id": 2036 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 2037 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 2038 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000340" } ], "repeated": 0, "id": 2039 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" } ], "repeated": 0, "id": 2040 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" } ], "repeated": 0, "id": 2041 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced" }, { "name": "Handle", "value": "0x00000374" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced" } ], "repeated": 0, "id": 2042 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "ValueName", "value": "Start_JumpListItems" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Start_JumpListItems" } ], "repeated": 0, "id": 2043 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" } ], "repeated": 0, "id": 2044 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced" }, { "name": "Handle", "value": "0x00000374" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced" } ], "repeated": 0, "id": 2045 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "ValueName", "value": "Start_JumpListItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Start_JumpListItems" } ], "repeated": 0, "id": 2046 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415ecea", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" } ], "repeated": 0, "id": 2047 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e727", "parentcaller": "0x7ff7e415ed0b", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00021401-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "000214F9-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "lnkfile" } ], "repeated": 0, "id": 2048 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" }, { "name": "MutexName", "value": "" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 2049 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000340" }, { "name": "DesiredAccess", "value": "0xc0100080", "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2050 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 2051 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2052 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2053 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" } ], "repeated": 0, "id": 2054 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000340" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk" }, { "name": "Buffer", "value": "L\\x00\\x00\\x00\\x01\\x14\\x02\\x00\\x00\\x00\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00F\\xdf\\x02\\x00\\x00 \\x00\\x00\\x00\\x9b\\xaf\\x96\\xb7\\xcdj\\xcd\\x01\\x9b\\xaf\\x96\\xb7\\xcdj\\xcd\\x01\\x80\\x1d\\x02\\xa8\\xddj\\xcd\\x01\\x00\\xf0\\x06\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf1\\x01\\x14\\x00\\x1fP\\xe0O\\xd0 \\xea:i\\x10\\xa2\\xd8\\x08\\x00+00\\x9d\\x19\\x00/C:\\\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00R\\x001\\x00\\x00\\x00\\x00\\x00\\xc7B\\x02\\xb00\\x00Windows\\x00<\\x00\\x08\\x00\\x04\\x00\\xef\\xbe\\xfa@\\xc0,\\xc7B\\x02\\xb0*\\x00\\x00\\x00\\x1f\\x10\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00\\x00\\x00\\x16\\x00V\\x001\\x00\\x00\\x00\\x00\\x00\\xc7B]\\x050\\x00System32\\x00\\x00>\\x00\\x08\\x00\\x04\\x00\\xef\\xbe\\xfa@\\xc1,\\xc7B]\\x05*\\x00\\x00\\x00\n\\x18\\x00\\x00\\x00\\x00\\x01" }, { "name": "Length", "value": "2539" } ], "repeated": 0, "id": 2055 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2056 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2057 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" } ], "repeated": 1, "id": 2058 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 2059 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2060 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2061 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" } ], "repeated": 0, "id": 2062 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2063 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2064 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" } ], "repeated": 1, "id": 2065 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 2066 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2067 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2068 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" } ], "repeated": 0, "id": 2069 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2070 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2071 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" } ], "repeated": 1, "id": 2072 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 2073 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2074 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2075 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" } ], "repeated": 0, "id": 2076 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2077 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2078 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" } ], "repeated": 1, "id": 2079 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2080 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000000e8" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2081 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002e8" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000000e8" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 2082 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 2083 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 2084 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2085 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000000e8" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2086 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002e8" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000000e8" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 2087 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "MonitorRegistry" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\MonitorRegistry" } ], "repeated": 0, "id": 2088 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 2089 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2090 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000000e8" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2091 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002e8" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000000e8" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" } ], "repeated": 0, "id": 2092 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 2093 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 2094 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2095 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000000e8" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2096 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002e8" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000000e8" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" } ], "repeated": 0, "id": 2097 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "MonitorRegistry" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\MonitorRegistry" } ], "repeated": 0, "id": 2098 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 2099 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 2100 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2101 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2102 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" } ], "repeated": 0, "id": 2103 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000340" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk" }, { "name": "FileInformationClass", "value": "4", "pretty_value": "FileBasicInformation" }, { "name": "FileInformation", "value": "\\\\xbd\\xd6\\x9c\\xb6\\xee\\xdc\\x01\\x94\\xee\\xb46\\x07\\xef\\xdc\\x01z\\xe4:{\\xde\\xac\\xd5\\x01\\xbe7\\xc0\\xa1\\xb7\\xee\\xdc\\x01 \\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2104 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000340" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xeb\t\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2105 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2106 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2107 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" } ], "repeated": 1, "id": 2108 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 2109 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2110 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2111 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" } ], "repeated": 0, "id": 2112 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2113 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2114 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" } ], "repeated": 1, "id": 2115 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 2116 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2117 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2118 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" } ], "repeated": 0, "id": 2119 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2120 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2121 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" } ], "repeated": 1, "id": 2122 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 2123 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2124 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2125 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" } ], "repeated": 0, "id": 2126 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2127 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2128 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" } ], "repeated": 1, "id": 2129 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 2130 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2131 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2132 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" } ], "repeated": 0, "id": 2133 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2134 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2135 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" } ], "repeated": 1, "id": 2136 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 2137 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2138 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2139 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" } ], "repeated": 0, "id": 2140 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2141 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2142 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" } ], "repeated": 1, "id": 2143 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 2144 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2145 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2146 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" } ], "repeated": 0, "id": 2147 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2148 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2149 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" } ], "repeated": 1, "id": 2150 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 2151 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2152 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2153 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" } ], "repeated": 0, "id": 2154 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2155 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2156 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" } ], "repeated": 1, "id": 2157 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 2158 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2159 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2160 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" } ], "repeated": 0, "id": 2161 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2162 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2163 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" } ], "repeated": 1, "id": 2164 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 2165 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2166 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2167 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" } ], "repeated": 0, "id": 2168 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2169 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2170 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" } ], "repeated": 1, "id": 2171 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 2172 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2173 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2174 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" } ], "repeated": 0, "id": 2175 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2176 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2177 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" } ], "repeated": 1, "id": 2178 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 2179 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2180 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2181 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" } ], "repeated": 0, "id": 2182 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2183 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2184 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" } ], "repeated": 1, "id": 2185 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 2186 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2187 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2188 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" } ], "repeated": 0, "id": 2189 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2190 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2191 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" } ], "repeated": 1, "id": 2192 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 2193 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2194 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2195 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" } ], "repeated": 0, "id": 2196 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2197 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2198 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" } ], "repeated": 1, "id": 2199 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 2200 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2201 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2202 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" } ], "repeated": 0, "id": 2203 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2204 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2205 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" } ], "repeated": 1, "id": 2206 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 2207 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2208 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2209 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" } ], "repeated": 0, "id": 2210 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2211 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2212 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" } ], "repeated": 1, "id": 2213 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 2214 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2215 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2216 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" } ], "repeated": 0, "id": 2217 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2218 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2219 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" } ], "repeated": 1, "id": 2220 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 2221 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2222 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2223 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" } ], "repeated": 0, "id": 2224 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2225 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2226 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" } ], "repeated": 1, "id": 2227 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 2228 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2229 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2230 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" } ], "repeated": 0, "id": 2231 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2232 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2233 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" } ], "repeated": 1, "id": 2234 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 2235 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2236 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2237 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" } ], "repeated": 0, "id": 2238 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2239 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2240 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" } ], "repeated": 1, "id": 2241 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 2242 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2243 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2244 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" } ], "repeated": 0, "id": 2245 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2246 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2247 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" } ], "repeated": 1, "id": 2248 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 2249 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2250 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2251 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" } ], "repeated": 0, "id": 2252 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2253 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2254 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" } ], "repeated": 1, "id": 2255 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 2256 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2257 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2258 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" } ], "repeated": 0, "id": 2259 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2260 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2261 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" } ], "repeated": 1, "id": 2262 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 2263 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2264 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2265 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" } ], "repeated": 0, "id": 2266 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2267 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2268 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" } ], "repeated": 1, "id": 2269 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2270 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1f5c03fb000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2271 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1f5c03fc000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2272 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 2273 }, { "timestamp": "2026-05-29 01:05:17,587", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000340" } ], "repeated": 0, "id": 2274 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" } ], "repeated": 0, "id": 2275 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" } ], "repeated": 0, "id": 2276 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2277 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000000e8" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2278 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000378" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000000e8" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 2279 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000378" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 2280 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" } ], "repeated": 0, "id": 2281 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2282 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000000e8" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2283 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000378" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000000e8" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 2284 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" }, { "name": "ValueName", "value": "MonitorRegistry" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\MonitorRegistry" } ], "repeated": 0, "id": 2285 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" } ], "repeated": 0, "id": 2286 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2287 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000000e8" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2288 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000378" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000000e8" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" } ], "repeated": 0, "id": 2289 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000378" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 2290 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" } ], "repeated": 0, "id": 2291 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2292 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000000e8" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2293 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000378" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000000e8" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" } ], "repeated": 0, "id": 2294 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000378" }, { "name": "ValueName", "value": "MonitorRegistry" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\MonitorRegistry" } ], "repeated": 0, "id": 2295 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415e775", "parentcaller": "0x7ff7e415ed0b", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" } ], "repeated": 0, "id": 2296 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415e7fc", "parentcaller": "0x7ff7e415ed0b", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "2D3468C1-36A7-43B6-AC24-D3F02FD9607A" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "5632B1A4-E38A-400A-928A-D4CD63230295" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2297 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415fd40", "parentcaller": "0x7ff7e415e825", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1f5c1c50000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 2298 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415fd40", "parentcaller": "0x7ff7e415e825", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000e0" } ], "repeated": 0, "id": 2299 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415fd40", "parentcaller": "0x7ff7e415e825", "category": "registry", "api": "NtOpenKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US" } ], "repeated": 0, "id": 2300 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415fd40", "parentcaller": "0x7ff7e415e825", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000000e0" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\en-US\\powershell.exe.mui" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 2301 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415fd40", "parentcaller": "0x7ff7e415e825", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000378" }, { "name": "DesiredAccess", "value": "0x000f0005", "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x000000e0" }, { "name": "FileName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\en-US\\powershell.exe.mui" } ], "repeated": 0, "id": 2302 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415fd40", "parentcaller": "0x7ff7e415e825", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000378" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1f5c1c50000" }, { "name": "SectionOffset", "value": "0x6c11ece940" }, { "name": "ViewSize", "value": "0x00003000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2303 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415fd40", "parentcaller": "0x7ff7e415e825", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" } ], "repeated": 0, "id": 2304 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415edbb", "parentcaller": "0x7ff7e415e863", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00021401-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "000214F9-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "lnkfile" } ], "repeated": 0, "id": 2305 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "Handle", "value": "0x0000037c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 2306 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000037c" }, { "name": "SubKey", "value": "{528c102f-0000-0000-0000-300300000000}\\" }, { "name": "Handle", "value": "0x00000340" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\" } ], "repeated": 0, "id": 2307 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000037c" } ], "repeated": 0, "id": 2308 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000340" }, { "name": "ValueName", "value": "Generation" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation" } ], "repeated": 0, "id": 2309 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000340" } ], "repeated": 0, "id": 2310 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000340" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2311 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtQueryInformationFile", "status": false, "return": "0xffffffffc000000d", "pretty_return": "INVALID_PARAMETER", "arguments": [ { "name": "FileHandle", "value": "0x00000340" }, { "name": "HandleName", "value": "C:\\" }, { "name": "FileInformationClass", "value": "55", "pretty_value": "FileReplaceCompletionInformation" }, { "name": "FileInformation", "value": "" } ], "repeated": 0, "id": 2312 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtQueryDirectoryFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000340" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x006\\xean:\\xdd\\xac\\xd5\\x01B\\xd8<0\\x04\\xef\\xdc\\x01\\x9d\\xa9\\xd1\\xc9\\xb8\\xee\\xdc\\x01\\x9d\\xa9\\xd1\\xc9\\xb8\\xee\\xdc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x11\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xee\\x05\\x00\\x00\\x00\\x00\\x01\\x00U\\x00s\\x00e\\x00r\\x00s\\x00" }, { "name": "FileName", "value": "C:\\Users" }, { "name": "FileInformationClass", "value": "37", "pretty_value": "FileIdBothDirectoryInformation" } ], "repeated": 0, "id": 2313 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000340" } ], "repeated": 0, "id": 2314 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "1F486A52-3CB1-48FD-8F50-B8DC300D9F9D" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "ECF31D61-E474-453C-BEE7-DE68E441C6D0" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2315 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0xfffffffc" } ], "repeated": 1, "id": 2316 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "Local\\C:*Users*admin*AppData*Local*Microsoft*Windows*Caches*cversions.1" } ], "repeated": 0, "id": 2317 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "Local\\C:*Users*admin*AppData*Local*Microsoft*Windows*Caches*cversions.1.ro" } ], "repeated": 0, "id": 2318 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0xfffffffc" } ], "repeated": 0, "id": 2319 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "CreateDirectoryW", "status": false, "return": "0x00000000", "arguments": [ { "name": "DirectoryName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Caches" } ], "repeated": 0, "id": 2320 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5294f000" }, { "name": "ModuleName", "value": "PROPSYS.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2321 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5294f000" }, { "name": "ModuleName", "value": "PROPSYS.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2322 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000340" } ], "repeated": 0, "id": 2323 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2324 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "@C>\\xc0\\xf5\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00" } ], "repeated": 0, "id": 2325 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000340" } ], "repeated": 0, "id": 2326 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000340" }, { "name": "DesiredAccess", "value": "0x00020000", "pretty_value": "READ_CONTROL" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Caches" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 2327 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000340" } ], "repeated": 0, "id": 2328 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000340" }, { "name": "DesiredAccess", "value": "0x00020000", "pretty_value": "READ_CONTROL" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Caches" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 2329 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000340" } ], "repeated": 0, "id": 2330 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x000f01ff" }, { "name": "TokenHandle", "value": "0x00000340" } ], "repeated": 0, "id": 2331 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "S<\n\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2332 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "x\\x9d<\\xc0\\xf5\\x01\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2333 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "`\\xa5<\\xc0\\xf5\\x01\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2334 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2335 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xf8w<\\xc0\\xf5\\x01\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 2336 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2337 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xd8\\xa4:\\xc0\\xf5\\x01\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 2338 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x81\\x1a\\xff\\x7f\\x00\\x00\\xebPY\\x1a\\xff\\x7f\\x00\\x007\\x84p\\x021p\\x00\\x00(N}\\x1a\\xff\\x7f\\x00\\x00\\xc0\\xb5\\xec\\x11l\\x00\\x00\\x00\\xb8\\xb5\\xec\\x11l\\x00\\x00\\x00\\x88\\xb5\\xec\\x11l\\x00\\x00\\x00\\xa8\\xb5\\xec\\x11" } ], "repeated": 0, "id": 2339 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xa4:\\xc0\\xf5\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8Z\\x1a\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xa8\\xb3\\xec\\x11l\\x00\\x00\\x00@\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2}\\x1a" } ], "repeated": 0, "id": 2340 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "S<\n\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2341 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\x18\\xa7:\\xc0\\xf5\\x01\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00y\\x00s\\x00t\\x00e\\x00m\\x003\\x002\\x00\\\\x00w\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00s\\x00t\\x00o\\x00r\\x00a\\x00g\\x00e\\x00.\\x00d\\x00l\\x00" } ], "repeated": 0, "id": 2342 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\x80\\x94?\\xc0\\xf5\\x01\\x00\\x00`\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\xff\\x7f\\x00\\x00\\xb84\\xccU\\xff\\x7f\\x00\\x00\\x984\\xccU\\xff\\x7f\\x00\\x00x4\\xccU\\xff\\x7f\\x00\\x00X4\\xccU\\xff\\x7f\\x00\\x0004\\xccU\\xff\\x7f\\x00\\x00\\xf83\\xccU\\xff\\x7f\\x00\\x00\\xd03\\xccU" } ], "repeated": 0, "id": 2343 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2344 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\x98t<\\xc0\\xf5\\x01\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 2345 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2346 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "8\\x89?\\xc0\\xf5\\x01\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 2347 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x81\\x1a\\xff\\x7f\\x00\\x00\\xebPY\\x1a\\xff\\x7f\\x00\\x00\\xd7\\x80p\\x021p\\x00\\x00(N}\\x1a\\xff\\x7f\\x00\\x00 \\xb2\\xec\\x11l\\x00\\x00\\x00\\x18\\xb2\\xec\\x11l\\x00\\x00\\x00\\xe8\\xb1\\xec\\x11l\\x00\\x00\\x00\\x08\\xb2\\xec\\x11" } ], "repeated": 0, "id": 2348 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x89?\\xc0\\xf5\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8Z\\x1a\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x08\\xb0\\xec\\x11l\\x00\\x00\\x00@\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2}\\x1a" } ], "repeated": 0, "id": 2349 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000340" } ], "repeated": 0, "id": 2350 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000340" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2351 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000037c" } ], "repeated": 0, "id": 2352 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2353 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "@L>\\xc0\\xf5\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00" } ], "repeated": 0, "id": 2354 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000037c" } ], "repeated": 0, "id": 2355 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000037c" }, { "name": "DesiredAccess", "value": "0x000f0005", "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ" }, { "name": "ObjectAttributes", "value": "Local\\C:*Users*admin*AppData*Local*Microsoft*Windows*Caches*cversions.1.ro" }, { "name": "FileHandle", "value": "0x00000340" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" } ], "repeated": 0, "id": 2356 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000340" } ], "repeated": 0, "id": 2357 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000037c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1f5c3740000" }, { "name": "SectionOffset", "value": "0x6c11ecb880" }, { "name": "ViewSize", "value": "0x00004000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2358 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "Local\\C:*Users*admin*AppData*Local*Microsoft*Windows*Caches*{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000006.db" } ], "repeated": 0, "id": 2359 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000340" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000006.db" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2360 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000340" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000006.db" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00`\\x01\\x00\\x00\\x00\\x00\\x00\\xd8X\\x01\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2361 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000002e8" } ], "repeated": 0, "id": 2362 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2363 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "@?>\\xc0\\xf5\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00" } ], "repeated": 0, "id": 2364 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 2365 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002e8" }, { "name": "DesiredAccess", "value": "0x000f0005", "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ" }, { "name": "ObjectAttributes", "value": "Local\\C:*Users*admin*AppData*Local*Microsoft*Windows*Caches*{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000006.db" }, { "name": "FileHandle", "value": "0x00000340" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000006.db" } ], "repeated": 0, "id": 2366 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000340" } ], "repeated": 0, "id": 2367 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002e8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1f5c3750000" }, { "name": "SectionOffset", "value": "0x6c11ecc7e0" }, { "name": "ViewSize", "value": "0x00016000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2368 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2369 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000340" }, { "name": "DesiredAccess", "value": "0x00000006" }, { "name": "ObjectAttributes", "value": "Global\\windows_shell_global_counters" } ], "repeated": 0, "id": 2370 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000340" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1f5c3770000" }, { "name": "SectionOffset", "value": "0x6c11ecc7f0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2371 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 2372 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0xfffffffc" } ], "repeated": 0, "id": 2373 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000037c" } ], "repeated": 0, "id": 2374 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1f5c3740000" }, { "name": "RegionSize", "value": "0x00004000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 2375 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x10\\x12l\\x00\\x00\\x00\\xfc+\\x00\\x00\\x00\\x00\\x00\\x00\\xe0%\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "9696" } ], "repeated": 0, "id": 2376 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "ReadProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6c12102281" }, { "name": "Size", "value": "0x00000001" }, { "name": "Buffer", "value": "\\x00" } ], "repeated": 0, "id": 2377 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6c12102281" }, { "name": "Buffer", "value": "\\x01" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2378 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000037c" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\desktop.ini" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2379 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000037c" }, { "name": "HandleName", "value": "C:\\Users\\desktop.ini" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\xb0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xae\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2380 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000037c" }, { "name": "HandleName", "value": "C:\\Users\\desktop.ini" }, { "name": "Buffer", "value": "\\xff\\xfe\r\\x00\n\\x00[\\x00.\\x00S\\x00h\\x00e\\x00l\\x00l\\x00C\\x00l\\x00a\\x00s\\x00s\\x00I\\x00n\\x00f\\x00o\\x00]\\x00\r\\x00\n\\x00L\\x00o\\x00c\\x00a\\x00l\\x00i\\x00z\\x00e\\x00d\\x00R\\x00e\\x00s\\x00o\\x00u\\x00r\\x00c\\x00e\\x00N\\x00a\\x00m\\x00e\\x00=\\x00@\\x00%\\x00S\\x00y\\x00s\\x00t\\x00e\\x00m\\x00R\\x00o\\x00o\\x00t\\x00%\\x00\\\\x00s\\x00y\\x00s\\x00t\\x00e\\x00m\\x003\\x002\\x00\\\\x00s\\x00h\\x00e\\x00l\\x00l\\x003\\x002\\x00.\\x00d\\x00l\\x00l\\x00,\\x00-\\x002\\x001\\x008\\x001\\x003\\x00\r\\x00\n\\x00" }, { "name": "Length", "value": "174" } ], "repeated": 0, "id": 2381 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000037c" }, { "name": "HandleName", "value": "C:\\Users\\desktop.ini" }, { "name": "FileInformationClass", "value": "4", "pretty_value": "FileBasicInformation" }, { "name": "FileInformation", "value": "-j\\xb5\\xc9\\xde\\xac\\xd5\\x01\\xa0\\x18\\xb76\\x07\\xef\\xdc\\x01\\xb8\\x818{\\xde\\xac\\xd5\\x01e\\x9e\\x95\\xc2\\xf8\\xee\\xdc\\x01&\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2382 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000037c" } ], "repeated": 0, "id": 2383 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2384 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x10\\x12l\\x00\\x00\\x00\\xfc+\\x00\\x00\\x00\\x00\\x00\\x00\\xe0%\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "9696" } ], "repeated": 0, "id": 2385 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "ReadProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6c12102281" }, { "name": "Size", "value": "0x00000001" }, { "name": "Buffer", "value": "\\x01" } ], "repeated": 0, "id": 2386 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6c12102281" }, { "name": "Buffer", "value": "\\x00" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2387 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2388 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000037c" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2389 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtQueryInformationFile", "status": false, "return": "0xffffffffc000000d", "pretty_return": "INVALID_PARAMETER", "arguments": [ { "name": "FileHandle", "value": "0x0000037c" }, { "name": "HandleName", "value": "C:\\Users" }, { "name": "FileInformationClass", "value": "55", "pretty_value": "FileReplaceCompletionInformation" }, { "name": "FileInformation", "value": "" } ], "repeated": 0, "id": 2390 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtQueryDirectoryFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000037c" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf4a\\xd0\\x9c\\xb6\\xee\\xdc\\x01\\xfa\\xea\\x96k\\x05\\xef\\xdc\\x01\\xfa\\xea\\x96k\\x05\\xef\\xdc\\x01\\xfa\\xea\\x96k\\x05\\xef\\xdc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x004\\x9a\\x01\\x00\\x00\\x00\\x04\\x00a\\x00d\\x00m\\x00i\\x00n\\x00" }, { "name": "FileName", "value": "C:\\Users\\admin" }, { "name": "FileInformationClass", "value": "37", "pretty_value": "FileIdBothDirectoryInformation" } ], "repeated": 0, "id": 2391 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000037c" } ], "repeated": 0, "id": 2392 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2393 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000037c" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2394 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtQueryInformationFile", "status": false, "return": "0xffffffffc000000d", "pretty_return": "INVALID_PARAMETER", "arguments": [ { "name": "FileHandle", "value": "0x0000037c" }, { "name": "HandleName", "value": "C:\\Users\\admin" }, { "name": "FileInformationClass", "value": "55", "pretty_value": "FileReplaceCompletionInformation" }, { "name": "FileInformation", "value": "" } ], "repeated": 0, "id": 2395 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtQueryDirectoryFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000037c" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00R \\xd6\\x9c\\xb6\\xee\\xdc\\x01B\\xd8<0\\x04\\xef\\xdc\\x01n\\xbc\\xe2\\x9c\\xb6\\xee\\xdc\\x01n\\xbc\\xe2\\x9c\\xb6\\xee\\xdc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x12\\x00\\x00\\x00\\x0e\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1c\\xa5\\x01\\x00\\x00\\x00\\x03\\x00A\\x00p\\x00p\\x00D\\x00a\\x00t\\x00a\\x00" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData" }, { "name": "FileInformationClass", "value": "37", "pretty_value": "FileIdBothDirectoryInformation" } ], "repeated": 0, "id": 2396 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000037c" } ], "repeated": 0, "id": 2397 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000037c" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2398 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtQueryInformationFile", "status": false, "return": "0xffffffffc000000d", "pretty_return": "INVALID_PARAMETER", "arguments": [ { "name": "FileHandle", "value": "0x0000037c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData" }, { "name": "FileInformationClass", "value": "55", "pretty_value": "FileReplaceCompletionInformation" }, { "name": "FileInformation", "value": "" } ], "repeated": 0, "id": 2399 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtQueryDirectoryFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000037c" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00R \\xd6\\x9c\\xb6\\xee\\xdc\\x01/\\xf7\\xbd:\\x04\\xef\\xdc\\x01F\\xcb\\xa1/\\x00\\xef\\xdc\\x01F\\xcb\\xa1/\\x00\\xef\\xdc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x0e\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xed\\xa5\\x01\\x00\\x00\\x00\\x03\\x00R\\x00o\\x00a\\x00m\\x00i\\x00n\\x00g\\x00" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming" }, { "name": "FileInformationClass", "value": "37", "pretty_value": "FileIdBothDirectoryInformation" } ], "repeated": 0, "id": 2400 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000037c" } ], "repeated": 0, "id": 2401 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1f5c03fd000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2402 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000037c" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2403 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtQueryInformationFile", "status": false, "return": "0xffffffffc000000d", "pretty_return": "INVALID_PARAMETER", "arguments": [ { "name": "FileHandle", "value": "0x0000037c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming" }, { "name": "FileInformationClass", "value": "55", "pretty_value": "FileReplaceCompletionInformation" }, { "name": "FileInformation", "value": "" } ], "repeated": 0, "id": 2404 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtQueryDirectoryFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000037c" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00R \\xd6\\x9c\\xb6\\xee\\xdc\\x01/\\xf7\\xbd:\\x04\\xef\\xdc\\x01\\xd0\\xe6\\x01\\x0c\\xb7\\xee\\xdc\\x01\\xd0\\xe6\\x01\\x0c\\xb7\\xee\\xdc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x12\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00M\\x00I\\x00C\\x00R\\x00O\\x00S\\x00~\\x001\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1a\\xa6\\x01\\x00\\x00\\x00\\x03\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft" }, { "name": "FileInformationClass", "value": "37", "pretty_value": "FileIdBothDirectoryInformation" } ], "repeated": 0, "id": 2405 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000037c" } ], "repeated": 0, "id": 2406 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2407 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtQueryFullAttributesFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\desktop.ini" } ], "repeated": 0, "id": 2408 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x10\\x12l\\x00\\x00\\x00\\xfc+\\x00\\x00\\x00\\x00\\x00\\x00\\xe0%\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "9696" } ], "repeated": 0, "id": 2409 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "ReadProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6c12102281" }, { "name": "Size", "value": "0x00000001" }, { "name": "Buffer", "value": "\\x00" } ], "repeated": 0, "id": 2410 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6c12102281" }, { "name": "Buffer", "value": "\\x01" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2411 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000001" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\desktop.ini" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2412 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2413 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x10\\x12l\\x00\\x00\\x00\\xfc+\\x00\\x00\\x00\\x00\\x00\\x00\\xe0%\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "9696" } ], "repeated": 0, "id": 2414 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "ReadProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6c12102281" }, { "name": "Size", "value": "0x00000001" }, { "name": "Buffer", "value": "\\x01" } ], "repeated": 0, "id": 2415 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6c12102281" }, { "name": "Buffer", "value": "\\x00" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2416 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2417 }, { "timestamp": "2026-05-29 01:05:17,602", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000037c" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2418 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtQueryInformationFile", "status": false, "return": "0xffffffffc000000d", "pretty_return": "INVALID_PARAMETER", "arguments": [ { "name": "FileHandle", "value": "0x0000037c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft" }, { "name": "FileInformationClass", "value": "55", "pretty_value": "FileReplaceCompletionInformation" }, { "name": "FileInformation", "value": "" } ], "repeated": 0, "id": 2419 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtQueryDirectoryFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000037c" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00R \\xd6\\x9c\\xb6\\xee\\xdc\\x01\\x89\\xd4E<\\x04\\xef\\xdc\\x01M\\xd6\\x12\\xc3\\xb7\\xee\\xdc\\x01M\\xd6\\x12\\xc3\\xb7\\xee\\xdc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x0e\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1d\\xa6\\x01\\x00\\x00\\x00\\x03\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows" }, { "name": "FileInformationClass", "value": "37", "pretty_value": "FileIdBothDirectoryInformation" } ], "repeated": 0, "id": 2420 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000037c" } ], "repeated": 0, "id": 2421 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2422 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1f5c03ff000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2423 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000037c" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2424 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtQueryInformationFile", "status": false, "return": "0xffffffffc000000d", "pretty_return": "INVALID_PARAMETER", "arguments": [ { "name": "FileHandle", "value": "0x0000037c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows" }, { "name": "FileInformationClass", "value": "55", "pretty_value": "FileReplaceCompletionInformation" }, { "name": "FileInformation", "value": "" } ], "repeated": 0, "id": 2425 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtQueryDirectoryFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000037c" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00R \\xd6\\x9c\\xb6\\xee\\xdc\\x01X\\x14\\xc0Y\\x04\\xef\\xdc\\x01\\xefa\\xed\\xaf\\xb6\\xee\\xdc\\x01\\xefa\\xed\\xaf\\xb6\\xee\\xdc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x11\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00S\\x00T\\x00A\\x00R\\x00T\\x00M\\x00~\\x001\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00#\\xa6\\x01\\x00\\x00\\x00\\x02\\x00S\\x00t\\x00a\\x00r\\x00t\\x00 \\x00M\\x00e\\x00n\\x00u\\x00" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu" }, { "name": "FileInformationClass", "value": "37", "pretty_value": "FileIdBothDirectoryInformation" } ], "repeated": 0, "id": 2426 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000037c" } ], "repeated": 0, "id": 2427 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x10\\x12l\\x00\\x00\\x00\\xfc+\\x00\\x00\\x00\\x00\\x00\\x00\\xe0%\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "9696" } ], "repeated": 0, "id": 2428 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "ReadProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6c12102281" }, { "name": "Size", "value": "0x00000001" }, { "name": "Buffer", "value": "\\x00" } ], "repeated": 0, "id": 2429 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6c12102281" }, { "name": "Buffer", "value": "\\x01" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2430 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000037c" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2431 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000037c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\xb0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xae\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2432 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000037c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini" }, { "name": "Buffer", "value": "\\xff\\xfe\r\\x00\n\\x00[\\x00.\\x00S\\x00h\\x00e\\x00l\\x00l\\x00C\\x00l\\x00a\\x00s\\x00s\\x00I\\x00n\\x00f\\x00o\\x00]\\x00\r\\x00\n\\x00L\\x00o\\x00c\\x00a\\x00l\\x00i\\x00z\\x00e\\x00d\\x00R\\x00e\\x00s\\x00o\\x00u\\x00r\\x00c\\x00e\\x00N\\x00a\\x00m\\x00e\\x00=\\x00@\\x00%\\x00S\\x00y\\x00s\\x00t\\x00e\\x00m\\x00R\\x00o\\x00o\\x00t\\x00%\\x00\\\\x00s\\x00y\\x00s\\x00t\\x00e\\x00m\\x003\\x002\\x00\\\\x00s\\x00h\\x00e\\x00l\\x00l\\x003\\x002\\x00.\\x00d\\x00l\\x00l\\x00,\\x00-\\x002\\x001\\x007\\x008\\x006\\x00\r\\x00\n\\x00" }, { "name": "Length", "value": "174" } ], "repeated": 0, "id": 2433 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000037c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini" }, { "name": "FileInformationClass", "value": "4", "pretty_value": "FileBasicInformation" }, { "name": "FileInformation", "value": "\\xefa\\xed\\xaf\\xb6\\xee\\xdc\\x01rG\\xb86\\x07\\xef\\xdc\\x01\\xefa\\xed\\xaf\\xb6\\xee\\xdc\\x01\\xefa\\xed\\xaf\\xb6\\xee\\xdc\\x01\\x06\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2434 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000037c" } ], "repeated": 0, "id": 2435 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2436 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x10\\x12l\\x00\\x00\\x00\\xfc+\\x00\\x00\\x00\\x00\\x00\\x00\\xe0%\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "9696" } ], "repeated": 0, "id": 2437 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "ReadProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6c12102281" }, { "name": "Size", "value": "0x00000001" }, { "name": "Buffer", "value": "\\x01" } ], "repeated": 0, "id": 2438 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6c12102281" }, { "name": "Buffer", "value": "\\x00" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2439 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2440 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000037c" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2441 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtQueryInformationFile", "status": false, "return": "0xffffffffc000000d", "pretty_return": "INVALID_PARAMETER", "arguments": [ { "name": "FileHandle", "value": "0x0000037c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu" }, { "name": "FileInformationClass", "value": "55", "pretty_value": "FileReplaceCompletionInformation" }, { "name": "FileInformation", "value": "" } ], "repeated": 0, "id": 2442 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtQueryDirectoryFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000037c" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00R \\xd6\\x9c\\xb6\\xee\\xdc\\x01\\xe3\\xb3\\x8eZ\\x04\\xef\\xdc\\x01\\xfe\\x1a10\\x00\\xef\\xdc\\x01\\xfe\\x1a10\\x00\\xef\\xdc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x11\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00$\\xa6\\x01\\x00\\x00\\x00\\x02\\x00P\\x00r\\x00o\\x00g\\x00r\\x00a\\x00m\\x00s\\x00" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs" }, { "name": "FileInformationClass", "value": "37", "pretty_value": "FileIdBothDirectoryInformation" } ], "repeated": 0, "id": 2443 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000037c" } ], "repeated": 0, "id": 2444 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x10\\x12l\\x00\\x00\\x00\\xfc+\\x00\\x00\\x00\\x00\\x00\\x00\\xe0%\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "9696" } ], "repeated": 0, "id": 2445 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "ReadProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6c12102281" }, { "name": "Size", "value": "0x00000001" }, { "name": "Buffer", "value": "\\x00" } ], "repeated": 0, "id": 2446 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6c12102281" }, { "name": "Buffer", "value": "\\x01" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2447 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000037c" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2448 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000037c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x08\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2449 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000037c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini" }, { "name": "Buffer", "value": "\\xff\\xfe\r\\x00\n\\x00[\\x00L\\x00o\\x00c\\x00a\\x00l\\x00i\\x00z\\x00e\\x00d\\x00F\\x00i\\x00l\\x00e\\x00N\\x00a\\x00m\\x00e\\x00s\\x00]\\x00\r\\x00\n\\x00O\\x00n\\x00e\\x00D\\x00r\\x00i\\x00v\\x00e\\x00.\\x00l\\x00n\\x00k\\x00=\\x00O\\x00n\\x00e\\x00D\\x00r\\x00i\\x00v\\x00e\\x00\r\\x00\n\\x00[\\x00.\\x00S\\x00h\\x00e\\x00l\\x00l\\x00C\\x00l\\x00a\\x00s\\x00s\\x00I\\x00n\\x00f\\x00o\\x00]\\x00\r\\x00\n\\x00L\\x00o\\x00c\\x00a\\x00l\\x00i\\x00z\\x00e\\x00d\\x00R\\x00e\\x00s\\x00o\\x00u\\x00r\\x00c\\x00e\\x00N\\x00a\\x00m\\x00e\\x00=\\x00@\\x00%\\x00S\\x00y\\x00s\\x00t\\x00e\\x00m\\x00R\\x00o\\x00o\\x00t\\x00%\\x00\\\\x00s\\x00y\\x00s\\x00t\\x00e\\x00m\\x003\\x002\\x00\\\\x00s\\x00h\\x00e\\x00l\\x00l\\x003\\x002\\x00.\\x00d\\x00l\\x00l\\x00,\\x00-\\x002\\x001\\x007\\x00" }, { "name": "Length", "value": "264" } ], "repeated": 0, "id": 2450 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000037c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini" }, { "name": "FileInformationClass", "value": "4", "pretty_value": "FileBasicInformation" }, { "name": "FileInformation", "value": "\\\\xbd\\xd6\\x9c\\xb6\\xee\\xdc\\x01\\xc3\\x93\\xb86\\x07\\xef\\xdc\\x01\\xefa\\xed\\xaf\\xb6\\xee\\xdc\\x01\\xefa\\xed\\xaf\\xb6\\xee\\xdc\\x01\\x06\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2451 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000037c" } ], "repeated": 0, "id": 2452 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2453 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x10\\x12l\\x00\\x00\\x00\\xfc+\\x00\\x00\\x00\\x00\\x00\\x00\\xe0%\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "9696" } ], "repeated": 0, "id": 2454 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "ReadProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6c12102281" }, { "name": "Size", "value": "0x00000001" }, { "name": "Buffer", "value": "\\x01" } ], "repeated": 0, "id": 2455 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6c12102281" }, { "name": "Buffer", "value": "\\x00" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2456 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2457 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1f5c0400000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2458 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000037c" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2459 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtQueryInformationFile", "status": false, "return": "0xffffffffc000000d", "pretty_return": "INVALID_PARAMETER", "arguments": [ { "name": "FileHandle", "value": "0x0000037c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs" }, { "name": "FileInformationClass", "value": "55", "pretty_value": "FileReplaceCompletionInformation" }, { "name": "FileInformation", "value": "" } ], "repeated": 0, "id": 2460 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtQueryDirectoryFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000037c" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00R \\xd6\\x9c\\xb6\\xee\\xdc\\x01\\xcb\\xca\\xd5\\x8a\\x04\\xef\\xdc\\x01\\x9c\\x05\\x96\\x0b\\xe1\\xac\\xd5\\x01\\x0f\\x87\\xdb\\x9c\\xb6\\xee\\xdc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00$\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00W\\x00I\\x00N\\x00D\\x00O\\x00W\\x00~\\x001\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00%\\xa6\\x01\\x00\\x00\\x00\\x02\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00 \\x00P\\x00o\\x00w\\x00e\\x00r\\x00S\\x00h\\x00e\\x00l\\x00l\\x00" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell" }, { "name": "FileInformationClass", "value": "37", "pretty_value": "FileIdBothDirectoryInformation" } ], "repeated": 0, "id": 2461 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000037c" } ], "repeated": 0, "id": 2462 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2463 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1f5c0401000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2464 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1f5c0402000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2465 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000037c" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2466 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtQueryInformationFile", "status": false, "return": "0xffffffffc000000d", "pretty_return": "INVALID_PARAMETER", "arguments": [ { "name": "FileHandle", "value": "0x0000037c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell" }, { "name": "FileInformationClass", "value": "55", "pretty_value": "FileReplaceCompletionInformation" }, { "name": "FileInformation", "value": "" } ], "repeated": 0, "id": 2467 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtQueryDirectoryFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000037c" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\\\xbd\\xd6\\x9c\\xb6\\xee\\xdc\\x01\\x1f1\\xd9Y\\x05\\xef\\xdc\\x01z\\xe4:{\\xde\\xac\\xd5\\x01\\xbe7\\xc0\\xa1\\xb7\\xee\\xdc\\x01\\xeb\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00 \\x00\\x00\\x00,\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00W\\x00I\\x00N\\x00D\\x00O\\x00W\\x00~\\x001\\x00.\\x00L\\x00N\\x00K\\x00\\x00\\x00E\\xa6\\x01\\x00\\x00\\x00\\x02\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00 \\x00P\\x00o\\x00w\\x00e\\x00r\\x00S\\x00h\\x00e\\x00l\\x00l\\x00.\\x00l\\x00n\\x00k\\x00" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk" }, { "name": "FileInformationClass", "value": "37", "pretty_value": "FileIdBothDirectoryInformation" } ], "repeated": 0, "id": 2468 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000037c" } ], "repeated": 0, "id": 2469 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1f5c0342000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2470 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x0000037c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 2471 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000037c" }, { "name": "SubKey", "value": "{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}" }, { "name": "Handle", "value": "0x00000370" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}" } ], "repeated": 0, "id": 2472 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000037c" } ], "repeated": 0, "id": 2473 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000370" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\\Category" } ], "repeated": 0, "id": 2474 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000370" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "Desktop" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\\Name" } ], "repeated": 0, "id": 2475 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000370" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\\ParentFolder" } ], "repeated": 0, "id": 2476 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000370" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\\Description" } ], "repeated": 0, "id": 2477 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000370" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "Desktop" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\\RelativePath" } ], "repeated": 0, "id": 2478 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000370" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\\ParsingName" } ], "repeated": 0, "id": 2479 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000370" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\\InfoTip" } ], "repeated": 0, "id": 2480 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000370" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "Data", "value": "@%SystemRoot%\\system32\\shell32.dll,-21769" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\\LocalizedName" } ], "repeated": 0, "id": 2481 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000370" }, { "name": "ValueName", "value": "Icon" }, { "name": "Data", "value": "%SystemRoot%\\system32\\imageres.dll,-183" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\\Icon" } ], "repeated": 0, "id": 2482 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000370" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\\Security" } ], "repeated": 0, "id": 2483 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000370" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\\StreamResource" } ], "repeated": 0, "id": 2484 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000370" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\\StreamResourceType" } ], "repeated": 0, "id": 2485 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000370" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\\LocalRedirectOnly" } ], "repeated": 0, "id": 2486 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000370" }, { "name": "ValueName", "value": "Roamable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\\Roamable" } ], "repeated": 0, "id": 2487 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000370" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\\PreCreate" } ], "repeated": 0, "id": 2488 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000370" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\\Stream" } ], "repeated": 0, "id": 2489 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000370" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\\PublishExpandedPath" } ], "repeated": 0, "id": 2490 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000370" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\\DefinitionFlags" } ], "repeated": 0, "id": 2491 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000370" }, { "name": "ValueName", "value": "Attributes" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\\Attributes" } ], "repeated": 0, "id": 2492 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000370" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\\FolderTypeID" } ], "repeated": 0, "id": 2493 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000370" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\\InitFolderHandler" } ], "repeated": 0, "id": 2494 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000370" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x0000037c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\\PropertyBag" } ], "repeated": 0, "id": 2495 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000370" } ], "repeated": 0, "id": 2496 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000370" } ], "repeated": 0, "id": 2497 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2498 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": " \\xb6\\xec\\x11l\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2499 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000002e4" }, { "name": "SubKey", "value": "SessionInfo\\1" }, { "name": "Handle", "value": "0x00000380" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1" } ], "repeated": 0, "id": 2500 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000380" }, { "name": "SubKey", "value": "KnownFolders" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1\\KnownFolders" } ], "repeated": 0, "id": 2501 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000380" } ], "repeated": 0, "id": 2502 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xe0\\xb1\\xec\\x11l\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x80\\x80\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2503 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000380" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 2504 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000380" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" }, { "name": "Handle", "value": "0x00000384" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" } ], "repeated": 0, "id": 2505 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000380" } ], "repeated": 0, "id": 2506 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000384" }, { "name": "ValueName", "value": "Desktop" }, { "name": "Data", "value": "%USERPROFILE%\\Desktop" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Desktop" } ], "repeated": 0, "id": 2507 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000370" } ], "repeated": 0, "id": 2508 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000384" } ], "repeated": 0, "id": 2509 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x10\\x12l\\x00\\x00\\x00\\xfc+\\x00\\x00\\x00\\x00\\x00\\x00\\xe0%\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "9696" } ], "repeated": 0, "id": 2510 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "ReadProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6c12102281" }, { "name": "Size", "value": "0x00000001" }, { "name": "Buffer", "value": "\\x00" } ], "repeated": 0, "id": 2511 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6c12102281" }, { "name": "Buffer", "value": "\\x01" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2512 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000388" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Desktop\\desktop.ini" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2513 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000388" }, { "name": "HandleName", "value": "C:\\Users\\admin\\Desktop\\desktop.ini" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": " \\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x1a\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2514 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000388" }, { "name": "HandleName", "value": "C:\\Users\\admin\\Desktop\\desktop.ini" }, { "name": "Buffer", "value": "\\xff\\xfe\r\\x00\n\\x00[\\x00.\\x00S\\x00h\\x00e\\x00l\\x00l\\x00C\\x00l\\x00a\\x00s\\x00s\\x00I\\x00n\\x00f\\x00o\\x00]\\x00\r\\x00\n\\x00L\\x00o\\x00c\\x00a\\x00l\\x00i\\x00z\\x00e\\x00d\\x00R\\x00e\\x00s\\x00o\\x00u\\x00r\\x00c\\x00e\\x00N\\x00a\\x00m\\x00e\\x00=\\x00@\\x00%\\x00S\\x00y\\x00s\\x00t\\x00e\\x00m\\x00R\\x00o\\x00o\\x00t\\x00%\\x00\\\\x00s\\x00y\\x00s\\x00t\\x00e\\x00m\\x003\\x002\\x00\\\\x00s\\x00h\\x00e\\x00l\\x00l\\x003\\x002\\x00.\\x00d\\x00l\\x00l\\x00,\\x00-\\x002\\x001\\x007\\x006\\x009\\x00\r\\x00\n\\x00I\\x00c\\x00o\\x00n\\x00R\\x00e\\x00s\\x00o\\x00u\\x00r\\x00c\\x00e\\x00=\\x00%\\x00S\\x00y\\x00s\\x00t\\x00e\\x00m\\x00R\\x00o\\x00o\\x00t\\x00%\\x00\\\\x00s\\x00y\\x00s\\x00t\\x00e\\x00m\\x003\\x002\\x00\\\\x00i\\x00m\\x00a\\x00g\\x00e\\x00r\\x00" }, { "name": "Length", "value": "282" } ], "repeated": 0, "id": 2515 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000388" }, { "name": "HandleName", "value": "C:\\Users\\admin\\Desktop\\desktop.ini" }, { "name": "FileInformationClass", "value": "4", "pretty_value": "FileBasicInformation" }, { "name": "FileInformation", "value": "\\xd2\\xfe\\xea\\xaf\\xb6\\xee\\xdc\\x01\\xc7\\xa8\\xb96\\x07\\xef\\xdc\\x01\\xd2\\xfe\\xea\\xaf\\xb6\\xee\\xdc\\x01\\xd2\\xfe\\xea\\xaf\\xb6\\xee\\xdc\\x01&\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2516 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000388" } ], "repeated": 0, "id": 2517 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2518 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x10\\x12l\\x00\\x00\\x00\\xfc+\\x00\\x00\\x00\\x00\\x00\\x00\\xe0%\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "9696" } ], "repeated": 0, "id": 2519 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "ReadProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6c12102281" }, { "name": "Size", "value": "0x00000001" }, { "name": "Buffer", "value": "\\x01" } ], "repeated": 0, "id": 2520 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6c12102281" }, { "name": "Buffer", "value": "\\x00" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2521 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2522 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x00000388" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 2523 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000388" }, { "name": "SubKey", "value": "{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}" }, { "name": "Handle", "value": "0x0000038c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}" } ], "repeated": 0, "id": 2524 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000388" } ], "repeated": 0, "id": 2525 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000038c" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\\Category" } ], "repeated": 0, "id": 2526 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000038c" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "Libraries" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\\Name" } ], "repeated": 0, "id": 2527 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000038c" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "Data", "value": "{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\\ParentFolder" } ], "repeated": 0, "id": 2528 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000038c" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\\Description" } ], "repeated": 0, "id": 2529 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000038c" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "Microsoft\\Windows\\Libraries" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\\RelativePath" } ], "repeated": 0, "id": 2530 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000038c" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\\ParsingName" } ], "repeated": 0, "id": 2531 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000038c" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\\InfoTip" } ], "repeated": 0, "id": 2532 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000038c" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\\LocalizedName" } ], "repeated": 0, "id": 2533 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000038c" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\\Icon" } ], "repeated": 0, "id": 2534 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000038c" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\\Security" } ], "repeated": 0, "id": 2535 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000038c" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\\StreamResource" } ], "repeated": 0, "id": 2536 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000038c" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\\StreamResourceType" } ], "repeated": 0, "id": 2537 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000038c" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\\LocalRedirectOnly" } ], "repeated": 0, "id": 2538 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000038c" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\\Roamable" } ], "repeated": 0, "id": 2539 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000038c" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\\PreCreate" } ], "repeated": 0, "id": 2540 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000038c" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\\Stream" } ], "repeated": 0, "id": 2541 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000038c" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\\PublishExpandedPath" } ], "repeated": 0, "id": 2542 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000038c" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\\DefinitionFlags" } ], "repeated": 0, "id": 2543 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000038c" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\\Attributes" } ], "repeated": 0, "id": 2544 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000038c" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\\FolderTypeID" } ], "repeated": 0, "id": 2545 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000038c" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\\InitFolderHandler" } ], "repeated": 0, "id": 2546 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x0000038c" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\\PropertyBag" } ], "repeated": 0, "id": 2547 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000038c" } ], "repeated": 0, "id": 2548 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000038c" } ], "repeated": 0, "id": 2549 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2550 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": " \\xb6\\xec\\x11l\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2551 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000002e4" }, { "name": "SubKey", "value": "SessionInfo\\1" }, { "name": "Handle", "value": "0x00000388" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1" } ], "repeated": 0, "id": 2552 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000388" }, { "name": "SubKey", "value": "KnownFolders" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1\\KnownFolders" } ], "repeated": 0, "id": 2553 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000388" } ], "repeated": 0, "id": 2554 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xe0\\xb1\\xec\\x11l\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x80\\x88\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2555 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000388" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 2556 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000388" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" }, { "name": "Handle", "value": "0x00000390" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" } ], "repeated": 0, "id": 2557 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000388" } ], "repeated": 0, "id": 2558 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000390" }, { "name": "ValueName", "value": "{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}" } ], "repeated": 0, "id": 2559 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x00000388" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 2560 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000388" }, { "name": "SubKey", "value": "{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}" }, { "name": "Handle", "value": "0x00000394" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}" } ], "repeated": 0, "id": 2561 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000388" } ], "repeated": 0, "id": 2562 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000394" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\Category" } ], "repeated": 0, "id": 2563 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000394" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "AppData" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\Name" } ], "repeated": 0, "id": 2564 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000394" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\ParentFolder" } ], "repeated": 0, "id": 2565 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000394" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\Description" } ], "repeated": 0, "id": 2566 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000394" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "AppData\\Roaming" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\RelativePath" } ], "repeated": 0, "id": 2567 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000394" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\ParsingName" } ], "repeated": 0, "id": 2568 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000394" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\InfoTip" } ], "repeated": 0, "id": 2569 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000394" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\LocalizedName" } ], "repeated": 0, "id": 2570 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000394" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\Icon" } ], "repeated": 0, "id": 2571 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000394" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\Security" } ], "repeated": 0, "id": 2572 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000394" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\StreamResource" } ], "repeated": 0, "id": 2573 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000394" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\StreamResourceType" } ], "repeated": 0, "id": 2574 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000394" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\LocalRedirectOnly" } ], "repeated": 0, "id": 2575 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000394" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\Roamable" } ], "repeated": 0, "id": 2576 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000394" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\PreCreate" } ], "repeated": 0, "id": 2577 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000394" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\Stream" } ], "repeated": 0, "id": 2578 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000394" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\PublishExpandedPath" } ], "repeated": 0, "id": 2579 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000394" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\DefinitionFlags" } ], "repeated": 0, "id": 2580 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000394" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\Attributes" } ], "repeated": 0, "id": 2581 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000394" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\FolderTypeID" } ], "repeated": 0, "id": 2582 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000394" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\InitFolderHandler" } ], "repeated": 0, "id": 2583 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000394" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\PropertyBag" } ], "repeated": 0, "id": 2584 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000394" } ], "repeated": 0, "id": 2585 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000002e4" }, { "name": "SubKey", "value": "SessionInfo\\1" }, { "name": "Handle", "value": "0x00000394" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1" } ], "repeated": 0, "id": 2586 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000394" }, { "name": "SubKey", "value": "KnownFolders" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1\\KnownFolders" } ], "repeated": 0, "id": 2587 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000394" } ], "repeated": 0, "id": 2588 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000390" }, { "name": "ValueName", "value": "AppData" }, { "name": "Data", "value": "%USERPROFILE%\\AppData\\Roaming" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\AppData" } ], "repeated": 0, "id": 2589 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000038c" } ], "repeated": 0, "id": 2590 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000390" } ], "repeated": 0, "id": 2591 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2592 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x00000390" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 2593 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000390" }, { "name": "SubKey", "value": "{F42EE2D3-909F-4907-8871-4C22FC0BF756}" }, { "name": "Handle", "value": "0x0000038c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F42EE2D3-909F-4907-8871-4C22FC0BF756}" } ], "repeated": 0, "id": 2594 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000390" } ], "repeated": 0, "id": 2595 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000038c" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{f42ee2d3-909f-4907-8871-4c22fc0bf756}\\Category" } ], "repeated": 0, "id": 2596 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000038c" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "Local Documents" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{f42ee2d3-909f-4907-8871-4c22fc0bf756}\\Name" } ], "repeated": 0, "id": 2597 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000038c" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{f42ee2d3-909f-4907-8871-4c22fc0bf756}\\ParentFolder" } ], "repeated": 0, "id": 2598 }, { "timestamp": "2026-05-29 01:05:17,618", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000038c" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{f42ee2d3-909f-4907-8871-4c22fc0bf756}\\Description" } ], "repeated": 0, "id": 2599 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000038c" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "Documents" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{f42ee2d3-909f-4907-8871-4c22fc0bf756}\\RelativePath" } ], "repeated": 0, "id": 2600 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000038c" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "Data", "value": "shell:::{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\::{d3162b92-9365-467a-956b-92703aca08af}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{f42ee2d3-909f-4907-8871-4c22fc0bf756}\\ParsingName" } ], "repeated": 0, "id": 2601 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000038c" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{f42ee2d3-909f-4907-8871-4c22fc0bf756}\\InfoTip" } ], "repeated": 0, "id": 2602 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000038c" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "Data", "value": "@%SystemRoot%\\system32\\shell32.dll,-21770" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{f42ee2d3-909f-4907-8871-4c22fc0bf756}\\LocalizedName" } ], "repeated": 0, "id": 2603 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000038c" }, { "name": "ValueName", "value": "Icon" }, { "name": "Data", "value": "%SystemRoot%\\system32\\imageres.dll,-112" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{f42ee2d3-909f-4907-8871-4c22fc0bf756}\\Icon" } ], "repeated": 0, "id": 2604 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000038c" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{f42ee2d3-909f-4907-8871-4c22fc0bf756}\\Security" } ], "repeated": 0, "id": 2605 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000038c" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{f42ee2d3-909f-4907-8871-4c22fc0bf756}\\StreamResource" } ], "repeated": 0, "id": 2606 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000038c" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{f42ee2d3-909f-4907-8871-4c22fc0bf756}\\StreamResourceType" } ], "repeated": 0, "id": 2607 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000038c" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{f42ee2d3-909f-4907-8871-4c22fc0bf756}\\LocalRedirectOnly" } ], "repeated": 0, "id": 2608 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000038c" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{f42ee2d3-909f-4907-8871-4c22fc0bf756}\\Roamable" } ], "repeated": 0, "id": 2609 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000038c" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{f42ee2d3-909f-4907-8871-4c22fc0bf756}\\PreCreate" } ], "repeated": 0, "id": 2610 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000038c" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{f42ee2d3-909f-4907-8871-4c22fc0bf756}\\Stream" } ], "repeated": 0, "id": 2611 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000038c" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{f42ee2d3-909f-4907-8871-4c22fc0bf756}\\PublishExpandedPath" } ], "repeated": 0, "id": 2612 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000038c" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{f42ee2d3-909f-4907-8871-4c22fc0bf756}\\DefinitionFlags" } ], "repeated": 0, "id": 2613 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000038c" }, { "name": "ValueName", "value": "Attributes" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{f42ee2d3-909f-4907-8871-4c22fc0bf756}\\Attributes" } ], "repeated": 0, "id": 2614 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000038c" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{f42ee2d3-909f-4907-8871-4c22fc0bf756}\\FolderTypeID" } ], "repeated": 0, "id": 2615 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000038c" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{f42ee2d3-909f-4907-8871-4c22fc0bf756}\\InitFolderHandler" } ], "repeated": 0, "id": 2616 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000038c" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000390" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{f42ee2d3-909f-4907-8871-4c22fc0bf756}\\PropertyBag" } ], "repeated": 0, "id": 2617 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000038c" } ], "repeated": 0, "id": 2618 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000038c" } ], "repeated": 0, "id": 2619 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2620 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": " \\xb6\\xec\\x11l\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2621 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000002e4" }, { "name": "SubKey", "value": "SessionInfo\\1" }, { "name": "Handle", "value": "0x00000394" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1" } ], "repeated": 0, "id": 2622 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000394" }, { "name": "SubKey", "value": "KnownFolders" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1\\KnownFolders" } ], "repeated": 0, "id": 2623 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000394" } ], "repeated": 0, "id": 2624 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xe0\\xb1\\xec\\x11l\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x80\\x94\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2625 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000394" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 2626 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000394" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" }, { "name": "Handle", "value": "0x00000388" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" } ], "repeated": 0, "id": 2627 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000394" } ], "repeated": 0, "id": 2628 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000388" }, { "name": "ValueName", "value": "{F42EE2D3-909F-4907-8871-4C22FC0BF756}" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\{F42EE2D3-909F-4907-8871-4C22FC0BF756}" } ], "repeated": 0, "id": 2629 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000394" } ], "repeated": 0, "id": 2630 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x10n?\\xc0\\xf5\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2631 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "Handle", "value": "0x00000398" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 2632 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "ProfileImagePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath" } ], "repeated": 0, "id": 2633 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "ProfileImagePath" }, { "name": "Data", "value": "C:\\Users\\admin" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath" } ], "repeated": 0, "id": 2634 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" } ], "repeated": 0, "id": 2635 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000394" } ], "repeated": 0, "id": 2636 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000038c" } ], "repeated": 0, "id": 2637 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000388" } ], "repeated": 0, "id": 2638 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x10\\x12l\\x00\\x00\\x00\\xfc+\\x00\\x00\\x00\\x00\\x00\\x00\\xe0%\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "9696" } ], "repeated": 0, "id": 2639 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "ReadProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6c12102281" }, { "name": "Size", "value": "0x00000001" }, { "name": "Buffer", "value": "\\x00" } ], "repeated": 0, "id": 2640 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6c12102281" }, { "name": "Buffer", "value": "\\x01" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2641 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000388" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Documents\\desktop.ini" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2642 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000388" }, { "name": "HandleName", "value": "C:\\Users\\admin\\Documents\\desktop.ini" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x98\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x92\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2643 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000388" }, { "name": "HandleName", "value": "C:\\Users\\admin\\Documents\\desktop.ini" }, { "name": "Buffer", "value": "\\xff\\xfe\r\\x00\n\\x00[\\x00.\\x00S\\x00h\\x00e\\x00l\\x00l\\x00C\\x00l\\x00a\\x00s\\x00s\\x00I\\x00n\\x00f\\x00o\\x00]\\x00\r\\x00\n\\x00L\\x00o\\x00c\\x00a\\x00l\\x00i\\x00z\\x00e\\x00d\\x00R\\x00e\\x00s\\x00o\\x00u\\x00r\\x00c\\x00e\\x00N\\x00a\\x00m\\x00e\\x00=\\x00@\\x00%\\x00S\\x00y\\x00s\\x00t\\x00e\\x00m\\x00R\\x00o\\x00o\\x00t\\x00%\\x00\\\\x00s\\x00y\\x00s\\x00t\\x00e\\x00m\\x003\\x002\\x00\\\\x00s\\x00h\\x00e\\x00l\\x00l\\x003\\x002\\x00.\\x00d\\x00l\\x00l\\x00,\\x00-\\x002\\x001\\x007\\x007\\x000\\x00\r\\x00\n\\x00I\\x00c\\x00o\\x00n\\x00R\\x00e\\x00s\\x00o\\x00u\\x00r\\x00c\\x00e\\x00=\\x00%\\x00S\\x00y\\x00s\\x00t\\x00e\\x00m\\x00R\\x00o\\x00o\\x00t\\x00%\\x00\\\\x00s\\x00y\\x00s\\x00t\\x00e\\x00m\\x003\\x002\\x00\\\\x00i\\x00m\\x00a\\x00g\\x00e\\x00r\\x00" }, { "name": "Length", "value": "402" } ], "repeated": 0, "id": 2644 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000388" }, { "name": "HandleName", "value": "C:\\Users\\admin\\Documents\\desktop.ini" }, { "name": "FileInformationClass", "value": "4", "pretty_value": "FileBasicInformation" }, { "name": "FileInformation", "value": "\\xefa\\xed\\xaf\\xb6\\xee\\xdc\\x01\\xc1\\xda\\xba6\\x07\\xef\\xdc\\x01\\x1e\\x8b\\xf4\\xaf\\xb6\\xee\\xdc\\x01\\x1e\\x8b\\xf4\\xaf\\xb6\\xee\\xdc\\x01&\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2645 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000388" } ], "repeated": 0, "id": 2646 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2647 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x10\\x12l\\x00\\x00\\x00\\xfc+\\x00\\x00\\x00\\x00\\x00\\x00\\xe0%\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "9696" } ], "repeated": 0, "id": 2648 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "ReadProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6c12102281" }, { "name": "Size", "value": "0x00000001" }, { "name": "Buffer", "value": "\\x01" } ], "repeated": 0, "id": 2649 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6c12102281" }, { "name": "Buffer", "value": "\\x00" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2650 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2651 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x00000388" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 2652 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000388" }, { "name": "SubKey", "value": "{A0C69A99-21C8-4671-8703-7934162FCF1D}" }, { "name": "Handle", "value": "0x00000380" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A0C69A99-21C8-4671-8703-7934162FCF1D}" } ], "repeated": 0, "id": 2653 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000388" } ], "repeated": 0, "id": 2654 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000380" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{a0c69a99-21c8-4671-8703-7934162fcf1d}\\Category" } ], "repeated": 0, "id": 2655 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000380" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "Local Music" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{a0c69a99-21c8-4671-8703-7934162fcf1d}\\Name" } ], "repeated": 0, "id": 2656 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000380" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{a0c69a99-21c8-4671-8703-7934162fcf1d}\\ParentFolder" } ], "repeated": 0, "id": 2657 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000380" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{a0c69a99-21c8-4671-8703-7934162fcf1d}\\Description" } ], "repeated": 0, "id": 2658 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000380" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "Music" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{a0c69a99-21c8-4671-8703-7934162fcf1d}\\RelativePath" } ], "repeated": 0, "id": 2659 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000380" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "Data", "value": "shell:::{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\::{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{a0c69a99-21c8-4671-8703-7934162fcf1d}\\ParsingName" } ], "repeated": 0, "id": 2660 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000380" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "Data", "value": "@%SystemRoot%\\system32\\shell32.dll,-12689" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{a0c69a99-21c8-4671-8703-7934162fcf1d}\\InfoTip" } ], "repeated": 0, "id": 2661 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000380" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "Data", "value": "@%SystemRoot%\\system32\\shell32.dll,-21790" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{a0c69a99-21c8-4671-8703-7934162fcf1d}\\LocalizedName" } ], "repeated": 0, "id": 2662 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000380" }, { "name": "ValueName", "value": "Icon" }, { "name": "Data", "value": "%SystemRoot%\\system32\\imageres.dll,-108" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{a0c69a99-21c8-4671-8703-7934162fcf1d}\\Icon" } ], "repeated": 0, "id": 2663 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000380" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{a0c69a99-21c8-4671-8703-7934162fcf1d}\\Security" } ], "repeated": 0, "id": 2664 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000380" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{a0c69a99-21c8-4671-8703-7934162fcf1d}\\StreamResource" } ], "repeated": 0, "id": 2665 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000380" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{a0c69a99-21c8-4671-8703-7934162fcf1d}\\StreamResourceType" } ], "repeated": 0, "id": 2666 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000380" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{a0c69a99-21c8-4671-8703-7934162fcf1d}\\LocalRedirectOnly" } ], "repeated": 0, "id": 2667 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000380" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{a0c69a99-21c8-4671-8703-7934162fcf1d}\\Roamable" } ], "repeated": 0, "id": 2668 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000380" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{a0c69a99-21c8-4671-8703-7934162fcf1d}\\PreCreate" } ], "repeated": 0, "id": 2669 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000380" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{a0c69a99-21c8-4671-8703-7934162fcf1d}\\Stream" } ], "repeated": 0, "id": 2670 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000380" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{a0c69a99-21c8-4671-8703-7934162fcf1d}\\PublishExpandedPath" } ], "repeated": 0, "id": 2671 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000380" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{a0c69a99-21c8-4671-8703-7934162fcf1d}\\DefinitionFlags" } ], "repeated": 0, "id": 2672 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000380" }, { "name": "ValueName", "value": "Attributes" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{a0c69a99-21c8-4671-8703-7934162fcf1d}\\Attributes" } ], "repeated": 0, "id": 2673 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000380" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{a0c69a99-21c8-4671-8703-7934162fcf1d}\\FolderTypeID" } ], "repeated": 0, "id": 2674 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000380" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{a0c69a99-21c8-4671-8703-7934162fcf1d}\\InitFolderHandler" } ], "repeated": 0, "id": 2675 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000380" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000388" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{a0c69a99-21c8-4671-8703-7934162fcf1d}\\PropertyBag" } ], "repeated": 0, "id": 2676 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000380" } ], "repeated": 0, "id": 2677 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000380" } ], "repeated": 0, "id": 2678 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2679 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": " \\xb6\\xec\\x11l\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2680 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000002e4" }, { "name": "SubKey", "value": "SessionInfo\\1" }, { "name": "Handle", "value": "0x0000038c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1" } ], "repeated": 0, "id": 2681 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x0000038c" }, { "name": "SubKey", "value": "KnownFolders" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1\\KnownFolders" } ], "repeated": 0, "id": 2682 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000038c" } ], "repeated": 0, "id": 2683 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xe0\\xb1\\xec\\x11l\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x80\\x8c\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2684 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000038c" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 2685 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000038c" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" }, { "name": "Handle", "value": "0x00000384" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" } ], "repeated": 0, "id": 2686 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000038c" } ], "repeated": 0, "id": 2687 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000384" }, { "name": "ValueName", "value": "{A0C69A99-21C8-4671-8703-7934162FCF1D}" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\{A0C69A99-21C8-4671-8703-7934162FCF1D}" } ], "repeated": 0, "id": 2688 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000038c" } ], "repeated": 0, "id": 2689 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "@z?\\xc0\\xf5\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2690 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "Handle", "value": "0x00000370" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 2691 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000370" }, { "name": "ValueName", "value": "ProfileImagePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath" } ], "repeated": 0, "id": 2692 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000370" }, { "name": "ValueName", "value": "ProfileImagePath" }, { "name": "Data", "value": "C:\\Users\\admin" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath" } ], "repeated": 0, "id": 2693 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000370" } ], "repeated": 0, "id": 2694 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000038c" } ], "repeated": 0, "id": 2695 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000380" } ], "repeated": 0, "id": 2696 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000384" } ], "repeated": 0, "id": 2697 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x10\\x12l\\x00\\x00\\x00\\xfc+\\x00\\x00\\x00\\x00\\x00\\x00\\xe0%\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "9696" } ], "repeated": 0, "id": 2698 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "ReadProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6c12102281" }, { "name": "Size", "value": "0x00000001" }, { "name": "Buffer", "value": "\\x00" } ], "repeated": 0, "id": 2699 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6c12102281" }, { "name": "Buffer", "value": "\\x01" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2700 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000394" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Music\\desktop.ini" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2701 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000394" }, { "name": "HandleName", "value": "C:\\Users\\admin\\Music\\desktop.ini" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\xf8\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2702 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000394" }, { "name": "HandleName", "value": "C:\\Users\\admin\\Music\\desktop.ini" }, { "name": "Buffer", "value": "\\xff\\xfe\r\\x00\n\\x00[\\x00.\\x00S\\x00h\\x00e\\x00l\\x00l\\x00C\\x00l\\x00a\\x00s\\x00s\\x00I\\x00n\\x00f\\x00o\\x00]\\x00\r\\x00\n\\x00L\\x00o\\x00c\\x00a\\x00l\\x00i\\x00z\\x00e\\x00d\\x00R\\x00e\\x00s\\x00o\\x00u\\x00r\\x00c\\x00e\\x00N\\x00a\\x00m\\x00e\\x00=\\x00@\\x00%\\x00S\\x00y\\x00s\\x00t\\x00e\\x00m\\x00R\\x00o\\x00o\\x00t\\x00%\\x00\\\\x00s\\x00y\\x00s\\x00t\\x00e\\x00m\\x003\\x002\\x00\\\\x00s\\x00h\\x00e\\x00l\\x00l\\x003\\x002\\x00.\\x00d\\x00l\\x00l\\x00,\\x00-\\x002\\x001\\x007\\x009\\x000\\x00\r\\x00\n\\x00I\\x00n\\x00f\\x00o\\x00T\\x00i\\x00p\\x00=\\x00@\\x00%\\x00S\\x00y\\x00s\\x00t\\x00e\\x00m\\x00R\\x00o\\x00o\\x00t\\x00%\\x00\\\\x00s\\x00y\\x00s\\x00t\\x00e\\x00m\\x003\\x002\\x00\\\\x00s\\x00h\\x00e\\x00l\\x00l\\x003\\x002\\x00.\\x00d\\x00l\\x00" }, { "name": "Length", "value": "504" } ], "repeated": 0, "id": 2703 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000394" }, { "name": "HandleName", "value": "C:\\Users\\admin\\Music\\desktop.ini" }, { "name": "FileInformationClass", "value": "4", "pretty_value": "FileBasicInformation" }, { "name": "FileInformation", "value": "\\xefa\\xed\\xaf\\xb6\\xee\\xdc\\x01\\xa5\\x9a\\xbb6\\x07\\xef\\xdc\\x01\\x97\\xc5\\xef\\xaf\\xb6\\xee\\xdc\\x01\\x97\\xc5\\xef\\xaf\\xb6\\xee\\xdc\\x01&\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2704 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000394" } ], "repeated": 0, "id": 2705 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2706 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x10\\x12l\\x00\\x00\\x00\\xfc+\\x00\\x00\\x00\\x00\\x00\\x00\\xe0%\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "9696" } ], "repeated": 0, "id": 2707 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "ReadProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6c12102281" }, { "name": "Size", "value": "0x00000001" }, { "name": "Buffer", "value": "\\x01" } ], "repeated": 0, "id": 2708 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6c12102281" }, { "name": "Buffer", "value": "\\x00" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2709 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2710 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x00000394" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 2711 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000394" }, { "name": "SubKey", "value": "{0DDD015D-B06C-45D5-8C4C-F59713854639}" }, { "name": "Handle", "value": "0x00000398" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0DDD015D-B06C-45D5-8C4C-F59713854639}" } ], "repeated": 0, "id": 2712 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000394" } ], "repeated": 0, "id": 2713 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0ddd015d-b06c-45d5-8c4c-f59713854639}\\Category" } ], "repeated": 0, "id": 2714 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "Local Pictures" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0ddd015d-b06c-45d5-8c4c-f59713854639}\\Name" } ], "repeated": 0, "id": 2715 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0ddd015d-b06c-45d5-8c4c-f59713854639}\\ParentFolder" } ], "repeated": 0, "id": 2716 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0ddd015d-b06c-45d5-8c4c-f59713854639}\\Description" } ], "repeated": 0, "id": 2717 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "Pictures" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0ddd015d-b06c-45d5-8c4c-f59713854639}\\RelativePath" } ], "repeated": 0, "id": 2718 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "Data", "value": "shell:::{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\::{24ad3ad4-a569-4530-98e1-ab02f9417aa8}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0ddd015d-b06c-45d5-8c4c-f59713854639}\\ParsingName" } ], "repeated": 0, "id": 2719 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "Data", "value": "@%SystemRoot%\\system32\\shell32.dll,-12688" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0ddd015d-b06c-45d5-8c4c-f59713854639}\\InfoTip" } ], "repeated": 0, "id": 2720 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "Data", "value": "@%SystemRoot%\\system32\\shell32.dll,-21779" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0ddd015d-b06c-45d5-8c4c-f59713854639}\\LocalizedName" } ], "repeated": 0, "id": 2721 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "Icon" }, { "name": "Data", "value": "%SystemRoot%\\system32\\imageres.dll,-113" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0ddd015d-b06c-45d5-8c4c-f59713854639}\\Icon" } ], "repeated": 0, "id": 2722 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0ddd015d-b06c-45d5-8c4c-f59713854639}\\Security" } ], "repeated": 0, "id": 2723 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0ddd015d-b06c-45d5-8c4c-f59713854639}\\StreamResource" } ], "repeated": 0, "id": 2724 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0ddd015d-b06c-45d5-8c4c-f59713854639}\\StreamResourceType" } ], "repeated": 0, "id": 2725 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0ddd015d-b06c-45d5-8c4c-f59713854639}\\LocalRedirectOnly" } ], "repeated": 0, "id": 2726 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0ddd015d-b06c-45d5-8c4c-f59713854639}\\Roamable" } ], "repeated": 0, "id": 2727 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0ddd015d-b06c-45d5-8c4c-f59713854639}\\PreCreate" } ], "repeated": 0, "id": 2728 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0ddd015d-b06c-45d5-8c4c-f59713854639}\\Stream" } ], "repeated": 0, "id": 2729 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0ddd015d-b06c-45d5-8c4c-f59713854639}\\PublishExpandedPath" } ], "repeated": 0, "id": 2730 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0ddd015d-b06c-45d5-8c4c-f59713854639}\\DefinitionFlags" } ], "repeated": 0, "id": 2731 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "Attributes" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0ddd015d-b06c-45d5-8c4c-f59713854639}\\Attributes" } ], "repeated": 0, "id": 2732 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0ddd015d-b06c-45d5-8c4c-f59713854639}\\FolderTypeID" } ], "repeated": 0, "id": 2733 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0ddd015d-b06c-45d5-8c4c-f59713854639}\\InitFolderHandler" } ], "repeated": 0, "id": 2734 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000398" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000384" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0ddd015d-b06c-45d5-8c4c-f59713854639}\\PropertyBag" } ], "repeated": 0, "id": 2735 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" } ], "repeated": 0, "id": 2736 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000398" } ], "repeated": 0, "id": 2737 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2738 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": " \\xb6\\xec\\x11l\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2739 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000002e4" }, { "name": "SubKey", "value": "SessionInfo\\1" }, { "name": "Handle", "value": "0x00000380" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1" } ], "repeated": 0, "id": 2740 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000380" }, { "name": "SubKey", "value": "KnownFolders" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1\\KnownFolders" } ], "repeated": 0, "id": 2741 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000380" } ], "repeated": 0, "id": 2742 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xe0\\xb1\\xec\\x11l\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x80\\x80\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2743 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000380" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 2744 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000380" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" }, { "name": "Handle", "value": "0x0000038c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" } ], "repeated": 0, "id": 2745 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000380" } ], "repeated": 0, "id": 2746 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000038c" }, { "name": "ValueName", "value": "{0DDD015D-B06C-45D5-8C4C-F59713854639}" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\{0DDD015D-B06C-45D5-8C4C-F59713854639}" } ], "repeated": 0, "id": 2747 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000380" } ], "repeated": 0, "id": 2748 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x90p?\\xc0\\xf5\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2749 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "Handle", "value": "0x00000370" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 2750 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000370" }, { "name": "ValueName", "value": "ProfileImagePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath" } ], "repeated": 0, "id": 2751 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000370" }, { "name": "ValueName", "value": "ProfileImagePath" }, { "name": "Data", "value": "C:\\Users\\admin" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath" } ], "repeated": 0, "id": 2752 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000370" } ], "repeated": 0, "id": 2753 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000380" } ], "repeated": 0, "id": 2754 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" } ], "repeated": 0, "id": 2755 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000038c" } ], "repeated": 0, "id": 2756 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x10\\x12l\\x00\\x00\\x00\\xfc+\\x00\\x00\\x00\\x00\\x00\\x00\\xe0%\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "9696" } ], "repeated": 0, "id": 2757 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "ReadProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6c12102281" }, { "name": "Size", "value": "0x00000001" }, { "name": "Buffer", "value": "\\x00" } ], "repeated": 0, "id": 2758 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6c12102281" }, { "name": "Buffer", "value": "\\x01" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2759 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000038c" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Pictures\\desktop.ini" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2760 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000038c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\Pictures\\desktop.ini" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\xf8\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2761 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000038c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\Pictures\\desktop.ini" }, { "name": "Buffer", "value": "\\xff\\xfe\r\\x00\n\\x00[\\x00.\\x00S\\x00h\\x00e\\x00l\\x00l\\x00C\\x00l\\x00a\\x00s\\x00s\\x00I\\x00n\\x00f\\x00o\\x00]\\x00\r\\x00\n\\x00L\\x00o\\x00c\\x00a\\x00l\\x00i\\x00z\\x00e\\x00d\\x00R\\x00e\\x00s\\x00o\\x00u\\x00r\\x00c\\x00e\\x00N\\x00a\\x00m\\x00e\\x00=\\x00@\\x00%\\x00S\\x00y\\x00s\\x00t\\x00e\\x00m\\x00R\\x00o\\x00o\\x00t\\x00%\\x00\\\\x00s\\x00y\\x00s\\x00t\\x00e\\x00m\\x003\\x002\\x00\\\\x00s\\x00h\\x00e\\x00l\\x00l\\x003\\x002\\x00.\\x00d\\x00l\\x00l\\x00,\\x00-\\x002\\x001\\x007\\x007\\x009\\x00\r\\x00\n\\x00I\\x00n\\x00f\\x00o\\x00T\\x00i\\x00p\\x00=\\x00@\\x00%\\x00S\\x00y\\x00s\\x00t\\x00e\\x00m\\x00R\\x00o\\x00o\\x00t\\x00%\\x00\\\\x00s\\x00y\\x00s\\x00t\\x00e\\x00m\\x003\\x002\\x00\\\\x00s\\x00h\\x00e\\x00l\\x00l\\x003\\x002\\x00.\\x00d\\x00l\\x00" }, { "name": "Length", "value": "504" } ], "repeated": 0, "id": 2762 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000038c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\Pictures\\desktop.ini" }, { "name": "FileInformationClass", "value": "4", "pretty_value": "FileBasicInformation" }, { "name": "FileInformation", "value": "\\xd2\\xfe\\xea\\xaf\\xb6\\xee\\xdc\\x01=p\\xbc6\\x07\\xef\\xdc\\x01\\xd2\\xfe\\xea\\xaf\\xb6\\xee\\xdc\\x01\\xd2\\xfe\\xea\\xaf\\xb6\\xee\\xdc\\x01&\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2763 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000038c" } ], "repeated": 0, "id": 2764 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2765 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x10\\x12l\\x00\\x00\\x00\\xfc+\\x00\\x00\\x00\\x00\\x00\\x00\\xe0%\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "9696" } ], "repeated": 0, "id": 2766 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "ReadProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6c12102281" }, { "name": "Size", "value": "0x00000001" }, { "name": "Buffer", "value": "\\x01" } ], "repeated": 0, "id": 2767 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6c12102281" }, { "name": "Buffer", "value": "\\x00" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2768 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2769 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x0000038c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 2770 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000038c" }, { "name": "SubKey", "value": "{35286A68-3C57-41A1-BBB1-0EAE73D76C95}" }, { "name": "Handle", "value": "0x00000398" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{35286A68-3C57-41A1-BBB1-0EAE73D76C95}" } ], "repeated": 0, "id": 2771 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000038c" } ], "repeated": 0, "id": 2772 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\\Category" } ], "repeated": 0, "id": 2773 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "Local Videos" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\\Name" } ], "repeated": 0, "id": 2774 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\\ParentFolder" } ], "repeated": 0, "id": 2775 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\\Description" } ], "repeated": 0, "id": 2776 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "Videos" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\\RelativePath" } ], "repeated": 0, "id": 2777 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "Data", "value": "shell:::{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\::{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\\ParsingName" } ], "repeated": 0, "id": 2778 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "Data", "value": "@%SystemRoot%\\system32\\shell32.dll,-12690" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\\InfoTip" } ], "repeated": 0, "id": 2779 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "Data", "value": "@%SystemRoot%\\system32\\shell32.dll,-21791" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\\LocalizedName" } ], "repeated": 0, "id": 2780 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "Icon" }, { "name": "Data", "value": "%SystemRoot%\\system32\\imageres.dll,-189" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\\Icon" } ], "repeated": 0, "id": 2781 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\\Security" } ], "repeated": 0, "id": 2782 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\\StreamResource" } ], "repeated": 0, "id": 2783 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\\StreamResourceType" } ], "repeated": 0, "id": 2784 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\\LocalRedirectOnly" } ], "repeated": 0, "id": 2785 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\\Roamable" } ], "repeated": 0, "id": 2786 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\\PreCreate" } ], "repeated": 0, "id": 2787 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\\Stream" } ], "repeated": 0, "id": 2788 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\\PublishExpandedPath" } ], "repeated": 0, "id": 2789 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\\DefinitionFlags" } ], "repeated": 0, "id": 2790 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "Attributes" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\\Attributes" } ], "repeated": 0, "id": 2791 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\\FolderTypeID" } ], "repeated": 0, "id": 2792 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\\InitFolderHandler" } ], "repeated": 0, "id": 2793 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000398" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x0000038c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\\PropertyBag" } ], "repeated": 0, "id": 2794 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" } ], "repeated": 0, "id": 2795 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000398" } ], "repeated": 0, "id": 2796 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2797 }, { "timestamp": "2026-05-29 01:05:17,633", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": " \\xb6\\xec\\x11l\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2798 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000002e4" }, { "name": "SubKey", "value": "SessionInfo\\1" }, { "name": "Handle", "value": "0x00000380" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1" } ], "repeated": 0, "id": 2799 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000380" }, { "name": "SubKey", "value": "KnownFolders" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1\\KnownFolders" } ], "repeated": 0, "id": 2800 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000380" } ], "repeated": 0, "id": 2801 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xe0\\xb1\\xec\\x11l\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x80\\x80\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2802 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000380" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 2803 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000380" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" }, { "name": "Handle", "value": "0x00000370" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" } ], "repeated": 0, "id": 2804 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000380" } ], "repeated": 0, "id": 2805 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000370" }, { "name": "ValueName", "value": "{35286A68-3C57-41A1-BBB1-0EAE73D76C95}" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\{35286A68-3C57-41A1-BBB1-0EAE73D76C95}" } ], "repeated": 0, "id": 2806 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000380" } ], "repeated": 0, "id": 2807 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "0\\xbf=\\xc0\\xf5\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2808 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "Handle", "value": "0x00000394" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 2809 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000394" }, { "name": "ValueName", "value": "ProfileImagePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath" } ], "repeated": 0, "id": 2810 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000394" }, { "name": "ValueName", "value": "ProfileImagePath" }, { "name": "Data", "value": "C:\\Users\\admin" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath" } ], "repeated": 0, "id": 2811 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000394" } ], "repeated": 0, "id": 2812 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000380" } ], "repeated": 0, "id": 2813 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" } ], "repeated": 0, "id": 2814 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000370" } ], "repeated": 0, "id": 2815 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x10\\x12l\\x00\\x00\\x00\\xfc+\\x00\\x00\\x00\\x00\\x00\\x00\\xe0%\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "9696" } ], "repeated": 0, "id": 2816 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "ReadProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6c12102281" }, { "name": "Size", "value": "0x00000001" }, { "name": "Buffer", "value": "\\x00" } ], "repeated": 0, "id": 2817 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6c12102281" }, { "name": "Buffer", "value": "\\x01" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2818 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000370" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Videos\\desktop.ini" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2819 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000370" }, { "name": "HandleName", "value": "C:\\Users\\admin\\Videos\\desktop.ini" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\xf8\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2820 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000370" }, { "name": "HandleName", "value": "C:\\Users\\admin\\Videos\\desktop.ini" }, { "name": "Buffer", "value": "\\xff\\xfe\r\\x00\n\\x00[\\x00.\\x00S\\x00h\\x00e\\x00l\\x00l\\x00C\\x00l\\x00a\\x00s\\x00s\\x00I\\x00n\\x00f\\x00o\\x00]\\x00\r\\x00\n\\x00L\\x00o\\x00c\\x00a\\x00l\\x00i\\x00z\\x00e\\x00d\\x00R\\x00e\\x00s\\x00o\\x00u\\x00r\\x00c\\x00e\\x00N\\x00a\\x00m\\x00e\\x00=\\x00@\\x00%\\x00S\\x00y\\x00s\\x00t\\x00e\\x00m\\x00R\\x00o\\x00o\\x00t\\x00%\\x00\\\\x00s\\x00y\\x00s\\x00t\\x00e\\x00m\\x003\\x002\\x00\\\\x00s\\x00h\\x00e\\x00l\\x00l\\x003\\x002\\x00.\\x00d\\x00l\\x00l\\x00,\\x00-\\x002\\x001\\x007\\x009\\x001\\x00\r\\x00\n\\x00I\\x00n\\x00f\\x00o\\x00T\\x00i\\x00p\\x00=\\x00@\\x00%\\x00S\\x00y\\x00s\\x00t\\x00e\\x00m\\x00R\\x00o\\x00o\\x00t\\x00%\\x00\\\\x00s\\x00y\\x00s\\x00t\\x00e\\x00m\\x003\\x002\\x00\\\\x00s\\x00h\\x00e\\x00l\\x00l\\x003\\x002\\x00.\\x00d\\x00l\\x00" }, { "name": "Length", "value": "504" } ], "repeated": 0, "id": 2821 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000370" }, { "name": "HandleName", "value": "C:\\Users\\admin\\Videos\\desktop.ini" }, { "name": "FileInformationClass", "value": "4", "pretty_value": "FileBasicInformation" }, { "name": "FileInformation", "value": "f8\\xe6\\xaf\\xb6\\xee\\xdc\\x01\\xd4\\x08\\xbd6\\x07\\xef\\xdc\\x01\\xd2\\xfe\\xea\\xaf\\xb6\\xee\\xdc\\x01\\xd2\\xfe\\xea\\xaf\\xb6\\xee\\xdc\\x01&\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2822 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000370" } ], "repeated": 0, "id": 2823 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2824 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x10\\x12l\\x00\\x00\\x00\\xfc+\\x00\\x00\\x00\\x00\\x00\\x00\\xe0%\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "9696" } ], "repeated": 0, "id": 2825 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "ReadProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6c12102281" }, { "name": "Size", "value": "0x00000001" }, { "name": "Buffer", "value": "\\x01" } ], "repeated": 0, "id": 2826 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6c12102281" }, { "name": "Buffer", "value": "\\x00" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2827 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2828 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x00000370" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 2829 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000370" }, { "name": "SubKey", "value": "{7D83EE9B-2244-4E70-B1F5-5393042AF1E4}" }, { "name": "Handle", "value": "0x00000398" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7D83EE9B-2244-4E70-B1F5-5393042AF1E4}" } ], "repeated": 0, "id": 2830 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000370" } ], "repeated": 0, "id": 2831 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7d83ee9b-2244-4e70-b1f5-5393042af1e4}\\Category" } ], "repeated": 0, "id": 2832 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "Local Downloads" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7d83ee9b-2244-4e70-b1f5-5393042af1e4}\\Name" } ], "repeated": 0, "id": 2833 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7d83ee9b-2244-4e70-b1f5-5393042af1e4}\\ParentFolder" } ], "repeated": 0, "id": 2834 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7d83ee9b-2244-4e70-b1f5-5393042af1e4}\\Description" } ], "repeated": 0, "id": 2835 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "Downloads" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7d83ee9b-2244-4e70-b1f5-5393042af1e4}\\RelativePath" } ], "repeated": 0, "id": 2836 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "Data", "value": "shell:::{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\::{088e3905-0323-4b02-9826-5d99428e115f}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7d83ee9b-2244-4e70-b1f5-5393042af1e4}\\ParsingName" } ], "repeated": 0, "id": 2837 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7d83ee9b-2244-4e70-b1f5-5393042af1e4}\\InfoTip" } ], "repeated": 0, "id": 2838 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "Data", "value": "@%SystemRoot%\\system32\\shell32.dll,-21798" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7d83ee9b-2244-4e70-b1f5-5393042af1e4}\\LocalizedName" } ], "repeated": 0, "id": 2839 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "Icon" }, { "name": "Data", "value": "%SystemRoot%\\system32\\imageres.dll,-184" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7d83ee9b-2244-4e70-b1f5-5393042af1e4}\\Icon" } ], "repeated": 0, "id": 2840 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7d83ee9b-2244-4e70-b1f5-5393042af1e4}\\Security" } ], "repeated": 0, "id": 2841 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7d83ee9b-2244-4e70-b1f5-5393042af1e4}\\StreamResource" } ], "repeated": 0, "id": 2842 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7d83ee9b-2244-4e70-b1f5-5393042af1e4}\\StreamResourceType" } ], "repeated": 0, "id": 2843 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7d83ee9b-2244-4e70-b1f5-5393042af1e4}\\LocalRedirectOnly" } ], "repeated": 0, "id": 2844 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7d83ee9b-2244-4e70-b1f5-5393042af1e4}\\Roamable" } ], "repeated": 0, "id": 2845 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7d83ee9b-2244-4e70-b1f5-5393042af1e4}\\PreCreate" } ], "repeated": 0, "id": 2846 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7d83ee9b-2244-4e70-b1f5-5393042af1e4}\\Stream" } ], "repeated": 0, "id": 2847 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7d83ee9b-2244-4e70-b1f5-5393042af1e4}\\PublishExpandedPath" } ], "repeated": 0, "id": 2848 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7d83ee9b-2244-4e70-b1f5-5393042af1e4}\\DefinitionFlags" } ], "repeated": 0, "id": 2849 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "Attributes" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7d83ee9b-2244-4e70-b1f5-5393042af1e4}\\Attributes" } ], "repeated": 0, "id": 2850 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7d83ee9b-2244-4e70-b1f5-5393042af1e4}\\FolderTypeID" } ], "repeated": 0, "id": 2851 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7d83ee9b-2244-4e70-b1f5-5393042af1e4}\\InitFolderHandler" } ], "repeated": 0, "id": 2852 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000398" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000370" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7d83ee9b-2244-4e70-b1f5-5393042af1e4}\\PropertyBag" } ], "repeated": 0, "id": 2853 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" } ], "repeated": 0, "id": 2854 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000398" } ], "repeated": 0, "id": 2855 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2856 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": " \\xb6\\xec\\x11l\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2857 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000002e4" }, { "name": "SubKey", "value": "SessionInfo\\1" }, { "name": "Handle", "value": "0x00000380" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1" } ], "repeated": 0, "id": 2858 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000380" }, { "name": "SubKey", "value": "KnownFolders" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1\\KnownFolders" } ], "repeated": 0, "id": 2859 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000380" } ], "repeated": 0, "id": 2860 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xe0\\xb1\\xec\\x11l\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x80\\x80\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2861 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000380" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 2862 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000380" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" }, { "name": "Handle", "value": "0x00000394" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" } ], "repeated": 0, "id": 2863 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000380" } ], "repeated": 0, "id": 2864 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000394" }, { "name": "ValueName", "value": "{7D83EE9B-2244-4E70-B1F5-5393042AF1E4}" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\{7D83EE9B-2244-4E70-B1F5-5393042AF1E4}" } ], "repeated": 0, "id": 2865 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000380" } ], "repeated": 0, "id": 2866 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x90p?\\xc0\\xf5\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2867 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "Handle", "value": "0x0000039c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 2868 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "ProfileImagePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath" } ], "repeated": 0, "id": 2869 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "ProfileImagePath" }, { "name": "Data", "value": "C:\\Users\\admin" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath" } ], "repeated": 0, "id": 2870 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000039c" } ], "repeated": 0, "id": 2871 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000380" } ], "repeated": 0, "id": 2872 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" } ], "repeated": 0, "id": 2873 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000394" } ], "repeated": 0, "id": 2874 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x10\\x12l\\x00\\x00\\x00\\xfc+\\x00\\x00\\x00\\x00\\x00\\x00\\xe0%\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "9696" } ], "repeated": 0, "id": 2875 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "ReadProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6c12102281" }, { "name": "Size", "value": "0x00000001" }, { "name": "Buffer", "value": "\\x00" } ], "repeated": 0, "id": 2876 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6c12102281" }, { "name": "Buffer", "value": "\\x01" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2877 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000394" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Downloads\\desktop.ini" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2878 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000394" }, { "name": "HandleName", "value": "C:\\Users\\admin\\Downloads\\desktop.ini" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": " \\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x1a\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2879 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000394" }, { "name": "HandleName", "value": "C:\\Users\\admin\\Downloads\\desktop.ini" }, { "name": "Buffer", "value": "\\xff\\xfe\r\\x00\n\\x00[\\x00.\\x00S\\x00h\\x00e\\x00l\\x00l\\x00C\\x00l\\x00a\\x00s\\x00s\\x00I\\x00n\\x00f\\x00o\\x00]\\x00\r\\x00\n\\x00L\\x00o\\x00c\\x00a\\x00l\\x00i\\x00z\\x00e\\x00d\\x00R\\x00e\\x00s\\x00o\\x00u\\x00r\\x00c\\x00e\\x00N\\x00a\\x00m\\x00e\\x00=\\x00@\\x00%\\x00S\\x00y\\x00s\\x00t\\x00e\\x00m\\x00R\\x00o\\x00o\\x00t\\x00%\\x00\\\\x00s\\x00y\\x00s\\x00t\\x00e\\x00m\\x003\\x002\\x00\\\\x00s\\x00h\\x00e\\x00l\\x00l\\x003\\x002\\x00.\\x00d\\x00l\\x00l\\x00,\\x00-\\x002\\x001\\x007\\x009\\x008\\x00\r\\x00\n\\x00I\\x00c\\x00o\\x00n\\x00R\\x00e\\x00s\\x00o\\x00u\\x00r\\x00c\\x00e\\x00=\\x00%\\x00S\\x00y\\x00s\\x00t\\x00e\\x00m\\x00R\\x00o\\x00o\\x00t\\x00%\\x00\\\\x00s\\x00y\\x00s\\x00t\\x00e\\x00m\\x003\\x002\\x00\\\\x00i\\x00m\\x00a\\x00g\\x00e\\x00r\\x00" }, { "name": "Length", "value": "282" } ], "repeated": 0, "id": 2880 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000394" }, { "name": "HandleName", "value": "C:\\Users\\admin\\Downloads\\desktop.ini" }, { "name": "FileInformationClass", "value": "4", "pretty_value": "FileBasicInformation" }, { "name": "FileInformation", "value": "\\x97\\xc5\\xef\\xaf\\xb6\\xee\\xdc\\x01,{\\xbd6\\x07\\xef\\xdc\\x01\\xdf(\\xf2\\xaf\\xb6\\xee\\xdc\\x01\\xdf(\\xf2\\xaf\\xb6\\xee\\xdc\\x01&\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2881 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000394" } ], "repeated": 0, "id": 2882 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2883 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x10\\x12l\\x00\\x00\\x00\\xfc+\\x00\\x00\\x00\\x00\\x00\\x00\\xe0%\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "9696" } ], "repeated": 0, "id": 2884 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "ReadProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6c12102281" }, { "name": "Size", "value": "0x00000001" }, { "name": "Buffer", "value": "\\x01" } ], "repeated": 0, "id": 2885 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6c12102281" }, { "name": "Buffer", "value": "\\x00" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2886 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2887 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x00000394" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 2888 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000394" }, { "name": "SubKey", "value": "{A52BBA46-E9E1-435F-B3D9-28DAA648C0F6}" }, { "name": "Handle", "value": "0x00000398" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A52BBA46-E9E1-435F-B3D9-28DAA648C0F6}" } ], "repeated": 0, "id": 2889 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000394" } ], "repeated": 0, "id": 2890 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A52BBA46-E9E1-435f-B3D9-28DAA648C0F6}\\Category" } ], "repeated": 0, "id": 2891 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "OneDrive" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A52BBA46-E9E1-435f-B3D9-28DAA648C0F6}\\Name" } ], "repeated": 0, "id": 2892 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "Data", "value": "{5E6C858F-0E22-4760-9AFE-EA3317B67173}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A52BBA46-E9E1-435f-B3D9-28DAA648C0F6}\\ParentFolder" } ], "repeated": 0, "id": 2893 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A52BBA46-E9E1-435f-B3D9-28DAA648C0F6}\\Description" } ], "repeated": 0, "id": 2894 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "OneDrive" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A52BBA46-E9E1-435f-B3D9-28DAA648C0F6}\\RelativePath" } ], "repeated": 0, "id": 2895 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "Data", "value": "shell:::{018D5C66-4533-4307-9B53-224DE2ED1FE6}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A52BBA46-E9E1-435f-B3D9-28DAA648C0F6}\\ParsingName" } ], "repeated": 0, "id": 2896 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A52BBA46-E9E1-435f-B3D9-28DAA648C0F6}\\InfoTip" } ], "repeated": 0, "id": 2897 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "Data", "value": "@%SystemRoot%\\System32\\SettingSyncCore.dll,-1024" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A52BBA46-E9E1-435f-B3D9-28DAA648C0F6}\\LocalizedName" } ], "repeated": 0, "id": 2898 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "Icon" }, { "name": "Data", "value": "%SystemRoot%\\system32\\imageres.dll,-1040" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A52BBA46-E9E1-435f-B3D9-28DAA648C0F6}\\Icon" } ], "repeated": 0, "id": 2899 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A52BBA46-E9E1-435f-B3D9-28DAA648C0F6}\\Security" } ], "repeated": 0, "id": 2900 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A52BBA46-E9E1-435f-B3D9-28DAA648C0F6}\\StreamResource" } ], "repeated": 0, "id": 2901 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A52BBA46-E9E1-435f-B3D9-28DAA648C0F6}\\StreamResourceType" } ], "repeated": 0, "id": 2902 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A52BBA46-E9E1-435f-B3D9-28DAA648C0F6}\\LocalRedirectOnly" } ], "repeated": 0, "id": 2903 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A52BBA46-E9E1-435f-B3D9-28DAA648C0F6}\\Roamable" } ], "repeated": 0, "id": 2904 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A52BBA46-E9E1-435f-B3D9-28DAA648C0F6}\\PreCreate" } ], "repeated": 0, "id": 2905 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A52BBA46-E9E1-435f-B3D9-28DAA648C0F6}\\Stream" } ], "repeated": 0, "id": 2906 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A52BBA46-E9E1-435f-B3D9-28DAA648C0F6}\\PublishExpandedPath" } ], "repeated": 0, "id": 2907 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "Data", "value": "64" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A52BBA46-E9E1-435f-B3D9-28DAA648C0F6}\\DefinitionFlags" } ], "repeated": 0, "id": 2908 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "Attributes" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A52BBA46-E9E1-435f-B3D9-28DAA648C0F6}\\Attributes" } ], "repeated": 0, "id": 2909 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A52BBA46-E9E1-435f-B3D9-28DAA648C0F6}\\FolderTypeID" } ], "repeated": 0, "id": 2910 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A52BBA46-E9E1-435f-B3D9-28DAA648C0F6}\\InitFolderHandler" } ], "repeated": 0, "id": 2911 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000398" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A52BBA46-E9E1-435f-B3D9-28DAA648C0F6}\\PropertyBag" } ], "repeated": 0, "id": 2912 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" } ], "repeated": 0, "id": 2913 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000398" } ], "repeated": 0, "id": 2914 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2915 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": " \\xb6\\xec\\x11l\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2916 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000002e4" }, { "name": "SubKey", "value": "SessionInfo\\1" }, { "name": "Handle", "value": "0x00000394" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1" } ], "repeated": 0, "id": 2917 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000394" }, { "name": "SubKey", "value": "KnownFolders" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1\\KnownFolders" } ], "repeated": 0, "id": 2918 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000394" } ], "repeated": 0, "id": 2919 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xe0\\xb1\\xec\\x11l\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x80\\x94\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2920 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000394" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 2921 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000394" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" }, { "name": "Handle", "value": "0x00000380" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" } ], "repeated": 0, "id": 2922 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000394" } ], "repeated": 0, "id": 2923 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000380" }, { "name": "ValueName", "value": "{A52BBA46-E9E1-435F-B3D9-28DAA648C0F6}" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\{A52BBA46-E9E1-435F-B3D9-28DAA648C0F6}" } ], "repeated": 0, "id": 2924 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000394" } ], "repeated": 0, "id": 2925 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x10\\xe8?\\xc0\\xf5\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2926 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "Handle", "value": "0x0000039c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 2927 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "ProfileImagePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath" } ], "repeated": 0, "id": 2928 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "ProfileImagePath" }, { "name": "Data", "value": "C:\\Users\\admin" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath" } ], "repeated": 0, "id": 2929 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000039c" } ], "repeated": 0, "id": 2930 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000394" } ], "repeated": 0, "id": 2931 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" } ], "repeated": 0, "id": 2932 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000380" } ], "repeated": 0, "id": 2933 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x10\\x12l\\x00\\x00\\x00\\xfc+\\x00\\x00\\x00\\x00\\x00\\x00\\xe0%\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "9696" } ], "repeated": 0, "id": 2934 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "ReadProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6c12102281" }, { "name": "Size", "value": "0x00000001" }, { "name": "Buffer", "value": "\\x00" } ], "repeated": 0, "id": 2935 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6c12102281" }, { "name": "Buffer", "value": "\\x01" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2936 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000380" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\OneDrive\\desktop.ini" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2937 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000380" }, { "name": "HandleName", "value": "C:\\Users\\admin\\OneDrive\\desktop.ini" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "`\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2938 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000380" }, { "name": "HandleName", "value": "C:\\Users\\admin\\OneDrive\\desktop.ini" }, { "name": "Buffer", "value": "[.ShellClassInfo]\r\nIconResource=C:\\Users\\admin\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe,1\r\n" }, { "name": "Length", "value": "96" } ], "repeated": 0, "id": 2939 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000380" }, { "name": "HandleName", "value": "C:\\Users\\admin\\OneDrive\\desktop.ini" }, { "name": "FileInformationClass", "value": "4", "pretty_value": "FileBasicInformation" }, { "name": "FileInformation", "value": "T\\xde\\xc4\\xe0\\xb6\\xee\\xdc\\x01\\xef.\\xbe6\\x07\\xef\\xdc\\x01T\\xde\\xc4\\xe0\\xb6\\xee\\xdc\\x01\\x89A\\xc7\\xe0\\xb6\\xee\\xdc\\x01\\x06\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2940 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000380" } ], "repeated": 0, "id": 2941 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2942 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x10\\x12l\\x00\\x00\\x00\\xfc+\\x00\\x00\\x00\\x00\\x00\\x00\\xe0%\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "9696" } ], "repeated": 0, "id": 2943 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "ReadProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6c12102281" }, { "name": "Size", "value": "0x00000001" }, { "name": "Buffer", "value": "\\x01" } ], "repeated": 0, "id": 2944 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6c12102281" }, { "name": "Buffer", "value": "\\x00" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2945 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 2946 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x00000380" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 2947 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000380" }, { "name": "SubKey", "value": "{F3CE0F7C-4901-4ACC-8648-D5D44B04EF8F}" }, { "name": "Handle", "value": "0x00000398" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F3CE0F7C-4901-4ACC-8648-D5D44B04EF8F}" } ], "repeated": 0, "id": 2948 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000380" } ], "repeated": 0, "id": 2949 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{f3ce0f7c-4901-4acc-8648-d5d44b04ef8f}\\Category" } ], "repeated": 0, "id": 2950 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "UsersFilesFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{f3ce0f7c-4901-4acc-8648-d5d44b04ef8f}\\Name" } ], "repeated": 0, "id": 2951 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{f3ce0f7c-4901-4acc-8648-d5d44b04ef8f}\\ParentFolder" } ], "repeated": 0, "id": 2952 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{f3ce0f7c-4901-4acc-8648-d5d44b04ef8f}\\Description" } ], "repeated": 0, "id": 2953 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{f3ce0f7c-4901-4acc-8648-d5d44b04ef8f}\\RelativePath" } ], "repeated": 0, "id": 2954 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "Data", "value": "::{59031a47-3f72-44a7-89c5-5595fe6b30ee}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{f3ce0f7c-4901-4acc-8648-d5d44b04ef8f}\\ParsingName" } ], "repeated": 0, "id": 2955 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{f3ce0f7c-4901-4acc-8648-d5d44b04ef8f}\\InfoTip" } ], "repeated": 0, "id": 2956 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{f3ce0f7c-4901-4acc-8648-d5d44b04ef8f}\\LocalizedName" } ], "repeated": 0, "id": 2957 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{f3ce0f7c-4901-4acc-8648-d5d44b04ef8f}\\Icon" } ], "repeated": 0, "id": 2958 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{f3ce0f7c-4901-4acc-8648-d5d44b04ef8f}\\Security" } ], "repeated": 0, "id": 2959 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{f3ce0f7c-4901-4acc-8648-d5d44b04ef8f}\\StreamResource" } ], "repeated": 0, "id": 2960 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{f3ce0f7c-4901-4acc-8648-d5d44b04ef8f}\\StreamResourceType" } ], "repeated": 0, "id": 2961 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{f3ce0f7c-4901-4acc-8648-d5d44b04ef8f}\\LocalRedirectOnly" } ], "repeated": 0, "id": 2962 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{f3ce0f7c-4901-4acc-8648-d5d44b04ef8f}\\Roamable" } ], "repeated": 0, "id": 2963 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{f3ce0f7c-4901-4acc-8648-d5d44b04ef8f}\\PreCreate" } ], "repeated": 0, "id": 2964 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{f3ce0f7c-4901-4acc-8648-d5d44b04ef8f}\\Stream" } ], "repeated": 0, "id": 2965 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{f3ce0f7c-4901-4acc-8648-d5d44b04ef8f}\\PublishExpandedPath" } ], "repeated": 0, "id": 2966 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{f3ce0f7c-4901-4acc-8648-d5d44b04ef8f}\\DefinitionFlags" } ], "repeated": 0, "id": 2967 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{f3ce0f7c-4901-4acc-8648-d5d44b04ef8f}\\Attributes" } ], "repeated": 0, "id": 2968 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{f3ce0f7c-4901-4acc-8648-d5d44b04ef8f}\\FolderTypeID" } ], "repeated": 0, "id": 2969 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{f3ce0f7c-4901-4acc-8648-d5d44b04ef8f}\\InitFolderHandler" } ], "repeated": 0, "id": 2970 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000398" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000380" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{f3ce0f7c-4901-4acc-8648-d5d44b04ef8f}\\PropertyBag" } ], "repeated": 0, "id": 2971 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" } ], "repeated": 0, "id": 2972 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtQueryFullAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Users\\admin" } ], "repeated": 0, "id": 2973 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2974 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x00000398" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 2975 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "{008CA0B1-55B4-4C56-B8A8-4DE4B299D3BE}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{008CA0B1-55B4-4C56-B8A8-4DE4B299D3BE}" } ], "repeated": 0, "id": 2976 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "1" }, { "name": "Name", "value": "{00BCFC5A-ED94-4e48-96A1-3F6217F21990}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{00BCFC5A-ED94-4e48-96A1-3F6217F21990}" } ], "repeated": 0, "id": 2977 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "2" }, { "name": "Name", "value": "{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}" } ], "repeated": 0, "id": 2978 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "3" }, { "name": "Name", "value": "{0482af6c-08f1-4c34-8c90-e17ec98b1e17}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0482af6c-08f1-4c34-8c90-e17ec98b1e17}" } ], "repeated": 0, "id": 2979 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "4" }, { "name": "Name", "value": "{054FAE61-4DD8-4787-80B6-090220C4B700}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{054FAE61-4DD8-4787-80B6-090220C4B700}" } ], "repeated": 0, "id": 2980 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "5" }, { "name": "Name", "value": "{0762D272-C50A-4BB0-A382-697DCD729B80}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0762D272-C50A-4BB0-A382-697DCD729B80}" } ], "repeated": 0, "id": 2981 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "6" }, { "name": "Name", "value": "{0AC0837C-BBF8-452A-850D-79D08E667CA7}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0AC0837C-BBF8-452A-850D-79D08E667CA7}" } ], "repeated": 0, "id": 2982 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "7" }, { "name": "Name", "value": "{0D4C3DB6-03A3-462F-A0E6-08924C41B5D4}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0D4C3DB6-03A3-462F-A0E6-08924C41B5D4}" } ], "repeated": 0, "id": 2983 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "8" }, { "name": "Name", "value": "{0ddd015d-b06c-45d5-8c4c-f59713854639}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0ddd015d-b06c-45d5-8c4c-f59713854639}" } ], "repeated": 0, "id": 2984 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "9" }, { "name": "Name", "value": "{0F214138-B1D3-4a90-BBA9-27CBC0C5389A}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0F214138-B1D3-4a90-BBA9-27CBC0C5389A}" } ], "repeated": 0, "id": 2985 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "10" }, { "name": "Name", "value": "{10C07CD0-EF91-4567-B850-448B77CB37F9}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{10C07CD0-EF91-4567-B850-448B77CB37F9}" } ], "repeated": 0, "id": 2986 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "11" }, { "name": "Name", "value": "{12D4C69E-24AD-4923-BE19-31321C43A767}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{12D4C69E-24AD-4923-BE19-31321C43A767}" } ], "repeated": 0, "id": 2987 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "12" }, { "name": "Name", "value": "{1777F761-68AD-4D8A-87BD-30B759FA33DD}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1777F761-68AD-4D8A-87BD-30B759FA33DD}" } ], "repeated": 0, "id": 2988 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "13" }, { "name": "Name", "value": "{18989B1D-99B5-455B-841C-AB7C74E4DDFC}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}" } ], "repeated": 0, "id": 2989 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "14" }, { "name": "Name", "value": "{190337d1-b8ca-4121-a639-6d472d16972a}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{190337d1-b8ca-4121-a639-6d472d16972a}" } ], "repeated": 0, "id": 2990 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "15" }, { "name": "Name", "value": "{1A6FDBA2-F42D-4358-A798-B74D745926C5}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1A6FDBA2-F42D-4358-A798-B74D745926C5}" } ], "repeated": 0, "id": 2991 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "16" }, { "name": "Name", "value": "{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}" } ], "repeated": 0, "id": 2992 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "17" }, { "name": "Name", "value": "{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}" } ], "repeated": 0, "id": 2993 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "18" }, { "name": "Name", "value": "{1C2AC1DC-4358-4B6C-9733-AF21156576F0}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1C2AC1DC-4358-4B6C-9733-AF21156576F0}" } ], "repeated": 0, "id": 2994 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "19" }, { "name": "Name", "value": "{1e87508d-89c2-42f0-8a7e-645a0f50ca58}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1e87508d-89c2-42f0-8a7e-645a0f50ca58}" } ], "repeated": 0, "id": 2995 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "20" }, { "name": "Name", "value": "{2112AB0A-C86A-4ffe-A368-0DE96E47012E}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2112AB0A-C86A-4ffe-A368-0DE96E47012E}" } ], "repeated": 0, "id": 2996 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "21" }, { "name": "Name", "value": "{2400183A-6185-49FB-A2D8-4A392A602BA3}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2400183A-6185-49FB-A2D8-4A392A602BA3}" } ], "repeated": 0, "id": 2997 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "22" }, { "name": "Name", "value": "{24D89E24-2F19-4534-9DDE-6A6671FBB8FE}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{24D89E24-2F19-4534-9DDE-6A6671FBB8FE}" } ], "repeated": 0, "id": 2998 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "23" }, { "name": "Name", "value": "{289A9A43-BE44-4057-A41B-587A76D7E7F9}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{289A9A43-BE44-4057-A41B-587A76D7E7F9}" } ], "repeated": 0, "id": 2999 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "24" }, { "name": "Name", "value": "{2A00375E-224C-49DE-B8D1-440DF7EF3DDC}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2A00375E-224C-49DE-B8D1-440DF7EF3DDC}" } ], "repeated": 0, "id": 3000 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "25" }, { "name": "Name", "value": "{2B0F765D-C0E9-4171-908E-08A611B84FF6}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2B0F765D-C0E9-4171-908E-08A611B84FF6}" } ], "repeated": 0, "id": 3001 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "26" }, { "name": "Name", "value": "{2B20DF75-1EDA-4039-8097-38798227D5B7}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2B20DF75-1EDA-4039-8097-38798227D5B7}" } ], "repeated": 0, "id": 3002 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "27" }, { "name": "Name", "value": "{2C36C0AA-5812-4b87-BFD0-4CD0DFB19B39}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2C36C0AA-5812-4b87-BFD0-4CD0DFB19B39}" } ], "repeated": 0, "id": 3003 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "28" }, { "name": "Name", "value": "{2F8B40C2-83ED-48EE-B383-A1F157EC6F9A}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2F8B40C2-83ED-48EE-B383-A1F157EC6F9A}" } ], "repeated": 0, "id": 3004 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "29" }, { "name": "Name", "value": "{31C0DD25-9439-4F12-BF41-7FF4EDA38722}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{31C0DD25-9439-4F12-BF41-7FF4EDA38722}" } ], "repeated": 0, "id": 3005 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "30" }, { "name": "Name", "value": "{3214FAB5-9757-4298-BB61-92A9DEAA44FF}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3214FAB5-9757-4298-BB61-92A9DEAA44FF}" } ], "repeated": 0, "id": 3006 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "31" }, { "name": "Name", "value": "{339719B5-8C47-4894-94C2-D8F77ADD44A6}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{339719B5-8C47-4894-94C2-D8F77ADD44A6}" } ], "repeated": 0, "id": 3007 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "32" }, { "name": "Name", "value": "{33E28130-4E1E-4676-835A-98395C3BC3BB}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{33E28130-4E1E-4676-835A-98395C3BC3BB}" } ], "repeated": 0, "id": 3008 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "33" }, { "name": "Name", "value": "{352481E8-33BE-4251-BA85-6007CAEDCF9D}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{352481E8-33BE-4251-BA85-6007CAEDCF9D}" } ], "repeated": 0, "id": 3009 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "34" }, { "name": "Name", "value": "{35286a68-3c57-41a1-bbb1-0eae73d76c95}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{35286a68-3c57-41a1-bbb1-0eae73d76c95}" } ], "repeated": 0, "id": 3010 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "35" }, { "name": "Name", "value": "{374DE290-123F-4565-9164-39C4925E467B}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{374DE290-123F-4565-9164-39C4925E467B}" } ], "repeated": 0, "id": 3011 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "36" }, { "name": "Name", "value": "{3B193882-D3AD-4eab-965A-69829D1FB59F}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3B193882-D3AD-4eab-965A-69829D1FB59F}" } ], "repeated": 0, "id": 3012 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "37" }, { "name": "Name", "value": "{3D644C9B-1FB8-4f30-9B45-F670235F79C0}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3D644C9B-1FB8-4f30-9B45-F670235F79C0}" } ], "repeated": 0, "id": 3013 }, { "timestamp": "2026-05-29 01:05:17,649", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "38" }, { "name": "Name", "value": "{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}" } ], "repeated": 0, "id": 3014 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "39" }, { "name": "Name", "value": "{43668BF8-C14E-49B2-97C9-747784D784B7}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{43668BF8-C14E-49B2-97C9-747784D784B7}" } ], "repeated": 0, "id": 3015 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "40" }, { "name": "Name", "value": "{48daf80b-e6cf-4f4e-b800-0e69d84ee384}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{48daf80b-e6cf-4f4e-b800-0e69d84ee384}" } ], "repeated": 0, "id": 3016 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "41" }, { "name": "Name", "value": "{491E922F-5643-4af4-A7EB-4E7A138D8174}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{491E922F-5643-4af4-A7EB-4E7A138D8174}" } ], "repeated": 0, "id": 3017 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "42" }, { "name": "Name", "value": "{4BD8D571-6D19-48D3-BE97-422220080E43}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}" } ], "repeated": 0, "id": 3018 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "43" }, { "name": "Name", "value": "{4BFEFB45-347D-4006-A5BE-AC0CB0567192}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4BFEFB45-347D-4006-A5BE-AC0CB0567192}" } ], "repeated": 0, "id": 3019 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "44" }, { "name": "Name", "value": "{4C5C32FF-BB9D-43b0-B5B4-2D72E54EAAA4}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4C5C32FF-BB9D-43b0-B5B4-2D72E54EAAA4}" } ], "repeated": 0, "id": 3020 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "45" }, { "name": "Name", "value": "{4D9F7874-4E0C-4904-967B-40B0D20C3E4B}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4D9F7874-4E0C-4904-967B-40B0D20C3E4B}" } ], "repeated": 0, "id": 3021 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "46" }, { "name": "Name", "value": "{52528A6B-B9E3-4add-B60D-588C2DBA842D}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{52528A6B-B9E3-4add-B60D-588C2DBA842D}" } ], "repeated": 0, "id": 3022 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "47" }, { "name": "Name", "value": "{52a4f021-7b75-48a9-9f6b-4b87a210bc8f}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{52a4f021-7b75-48a9-9f6b-4b87a210bc8f}" } ], "repeated": 0, "id": 3023 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "48" }, { "name": "Name", "value": "{54EED2E0-E7CA-4fdb-9148-0F4247291CFA}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{54EED2E0-E7CA-4fdb-9148-0F4247291CFA}" } ], "repeated": 0, "id": 3024 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "49" }, { "name": "Name", "value": "{559D40A3-A036-40FA-AF61-84CB430A4D34}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{559D40A3-A036-40FA-AF61-84CB430A4D34}" } ], "repeated": 0, "id": 3025 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "50" }, { "name": "Name", "value": "{56784854-C6CB-462B-8169-88E350ACB882}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{56784854-C6CB-462B-8169-88E350ACB882}" } ], "repeated": 0, "id": 3026 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "51" }, { "name": "Name", "value": "{5cd7aee2-2219-4a67-b85d-6c9ce15660cb}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5cd7aee2-2219-4a67-b85d-6c9ce15660cb}" } ], "repeated": 0, "id": 3027 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "52" }, { "name": "Name", "value": "{5CE4A5E9-E4EB-479D-B89F-130C02886155}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5CE4A5E9-E4EB-479D-B89F-130C02886155}" } ], "repeated": 0, "id": 3028 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "53" }, { "name": "Name", "value": "{5E6C858F-0E22-4760-9AFE-EA3317B67173}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}" } ], "repeated": 0, "id": 3029 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "54" }, { "name": "Name", "value": "{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}" } ], "repeated": 0, "id": 3030 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "55" }, { "name": "Name", "value": "{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}" } ], "repeated": 0, "id": 3031 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "56" }, { "name": "Name", "value": "{6365D5A7-0F0D-45e5-87F6-0DA56B6A4F7D}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{6365D5A7-0F0D-45e5-87F6-0DA56B6A4F7D}" } ], "repeated": 0, "id": 3032 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "57" }, { "name": "Name", "value": "{69D2CF90-FC33-4FB7-9A0C-EBB0F0FCB43C}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{69D2CF90-FC33-4FB7-9A0C-EBB0F0FCB43C}" } ], "repeated": 0, "id": 3033 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "58" }, { "name": "Name", "value": "{6D809377-6AF0-444b-8957-A3773F02200E}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{6D809377-6AF0-444b-8957-A3773F02200E}" } ], "repeated": 0, "id": 3034 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "59" }, { "name": "Name", "value": "{6F0CD92B-2E97-45D1-88FF-B0D186B8DEDD}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{6F0CD92B-2E97-45D1-88FF-B0D186B8DEDD}" } ], "repeated": 0, "id": 3035 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "60" }, { "name": "Name", "value": "{724EF170-A42D-4FEF-9F26-B60E846FBA4F}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{724EF170-A42D-4FEF-9F26-B60E846FBA4F}" } ], "repeated": 0, "id": 3036 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "61" }, { "name": "Name", "value": "{754AC886-DF64-4CBA-86B5-F7FBF4FBCEF5}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{754AC886-DF64-4CBA-86B5-F7FBF4FBCEF5}" } ], "repeated": 0, "id": 3037 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "62" }, { "name": "Name", "value": "{767E6811-49CB-4273-87C2-20F355E1085B}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{767E6811-49CB-4273-87C2-20F355E1085B}" } ], "repeated": 0, "id": 3038 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "63" }, { "name": "Name", "value": "{76FC4E2D-D6AD-4519-A663-37BD56068185}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{76FC4E2D-D6AD-4519-A663-37BD56068185}" } ], "repeated": 0, "id": 3039 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "64" }, { "name": "Name", "value": "{7AD67899-66AF-43BA-9156-6AAD42E6C596}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7AD67899-66AF-43BA-9156-6AAD42E6C596}" } ], "repeated": 0, "id": 3040 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "65" }, { "name": "Name", "value": "{7b0db17d-9cd2-4a93-9733-46cc89022e7c}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7b0db17d-9cd2-4a93-9733-46cc89022e7c}" } ], "repeated": 0, "id": 3041 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "66" }, { "name": "Name", "value": "{7BE16610-1F7F-44AC-BFF0-83E15F2FFCA1}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7BE16610-1F7F-44AC-BFF0-83E15F2FFCA1}" } ], "repeated": 0, "id": 3042 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "67" }, { "name": "Name", "value": "{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}" } ], "repeated": 0, "id": 3043 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "68" }, { "name": "Name", "value": "{7CFBEFBC-DE1F-45AA-B843-A542AC536CC9}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7CFBEFBC-DE1F-45AA-B843-A542AC536CC9}" } ], "repeated": 0, "id": 3044 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "69" }, { "name": "Name", "value": "{7d1d3a04-debb-4115-95cf-2f29da2920da}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7d1d3a04-debb-4115-95cf-2f29da2920da}" } ], "repeated": 0, "id": 3045 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "70" }, { "name": "Name", "value": "{7d83ee9b-2244-4e70-b1f5-5393042af1e4}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7d83ee9b-2244-4e70-b1f5-5393042af1e4}" } ], "repeated": 0, "id": 3046 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "71" }, { "name": "Name", "value": "{7E636BFE-DFA9-4D5E-B456-D7B39851D8A9}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7E636BFE-DFA9-4D5E-B456-D7B39851D8A9}" } ], "repeated": 0, "id": 3047 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "72" }, { "name": "Name", "value": "{82A5EA35-D9CD-47C5-9629-E15D2F714E6E}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{82A5EA35-D9CD-47C5-9629-E15D2F714E6E}" } ], "repeated": 0, "id": 3048 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "73" }, { "name": "Name", "value": "{82A74AEB-AEB4-465C-A014-D097EE346D63}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{82A74AEB-AEB4-465C-A014-D097EE346D63}" } ], "repeated": 0, "id": 3049 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "74" }, { "name": "Name", "value": "{8983036C-27C0-404B-8F08-102D10DCFD74}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{8983036C-27C0-404B-8F08-102D10DCFD74}" } ], "repeated": 0, "id": 3050 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "75" }, { "name": "Name", "value": "{8AD10C31-2ADB-4296-A8F7-E4701232C972}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{8AD10C31-2ADB-4296-A8F7-E4701232C972}" } ], "repeated": 0, "id": 3051 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "76" }, { "name": "Name", "value": "{905e63b6-c1bf-494e-b29c-65b732d3d21a}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{905e63b6-c1bf-494e-b29c-65b732d3d21a}" } ], "repeated": 0, "id": 3052 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "77" }, { "name": "Name", "value": "{915221FB-9EFE-4bda-8FD7-F78DCA774F87}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{915221FB-9EFE-4bda-8FD7-F78DCA774F87}" } ], "repeated": 0, "id": 3053 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "78" }, { "name": "Name", "value": "{9274BD8D-CFD1-41C3-B35E-B13F55A758F4}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9274BD8D-CFD1-41C3-B35E-B13F55A758F4}" } ], "repeated": 0, "id": 3054 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "79" }, { "name": "Name", "value": "{98EC0E18-2098-4D44-8644-66979315A281}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{98EC0E18-2098-4D44-8644-66979315A281}" } ], "repeated": 0, "id": 3055 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "80" }, { "name": "Name", "value": "{9B74B6A3-0DFD-4f11-9E78-5F7800F2E772}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9B74B6A3-0DFD-4f11-9E78-5F7800F2E772}" } ], "repeated": 0, "id": 3056 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "81" }, { "name": "Name", "value": "{9e3995ab-1f9c-4f13-b827-48b24b6c7174}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9e3995ab-1f9c-4f13-b827-48b24b6c7174}" } ], "repeated": 0, "id": 3057 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "82" }, { "name": "Name", "value": "{9E52AB10-F80D-49DF-ACB8-4330F5687855}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9E52AB10-F80D-49DF-ACB8-4330F5687855}" } ], "repeated": 0, "id": 3058 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "83" }, { "name": "Name", "value": "{a0c69a99-21c8-4671-8703-7934162fcf1d}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{a0c69a99-21c8-4671-8703-7934162fcf1d}" } ], "repeated": 0, "id": 3059 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "84" }, { "name": "Name", "value": "{A302545D-DEFF-464b-ABE8-61C8648D939B}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A302545D-DEFF-464b-ABE8-61C8648D939B}" } ], "repeated": 0, "id": 3060 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "85" }, { "name": "Name", "value": "{a305ce99-f527-492b-8b1a-7e76fa98d6e4}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{a305ce99-f527-492b-8b1a-7e76fa98d6e4}" } ], "repeated": 0, "id": 3061 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "86" }, { "name": "Name", "value": "{A3918781-E5F2-4890-B3D9-A7E54332328C}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A3918781-E5F2-4890-B3D9-A7E54332328C}" } ], "repeated": 0, "id": 3062 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "87" }, { "name": "Name", "value": "{A4115719-D62E-491D-AA7C-E74B8BE3B067}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}" } ], "repeated": 0, "id": 3063 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "88" }, { "name": "Name", "value": "{A440879F-87A0-4F7D-B700-0207B966194A}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A440879F-87A0-4F7D-B700-0207B966194A}" } ], "repeated": 0, "id": 3064 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "89" }, { "name": "Name", "value": "{A520A1A4-1780-4FF6-BD18-167343C5AF16}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}" } ], "repeated": 0, "id": 3065 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "90" }, { "name": "Name", "value": "{A52BBA46-E9E1-435f-B3D9-28DAA648C0F6}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A52BBA46-E9E1-435f-B3D9-28DAA648C0F6}" } ], "repeated": 0, "id": 3066 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "91" }, { "name": "Name", "value": "{A63293E8-664E-48DB-A079-DF759E0509F7}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A63293E8-664E-48DB-A079-DF759E0509F7}" } ], "repeated": 0, "id": 3067 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "92" }, { "name": "Name", "value": "{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}" } ], "repeated": 0, "id": 3068 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "93" }, { "name": "Name", "value": "{A990AE9F-A03B-4e80-94BC-9912D7504104}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A990AE9F-A03B-4e80-94BC-9912D7504104}" } ], "repeated": 0, "id": 3069 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "94" }, { "name": "Name", "value": "{AAA8D5A5-F1D6-4259-BAA8-78E7EF60835E}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AAA8D5A5-F1D6-4259-BAA8-78E7EF60835E}" } ], "repeated": 0, "id": 3070 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1f5c0405000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3071 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "95" }, { "name": "Name", "value": "{AB5FB87B-7CE2-4F83-915D-550846C9537B}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AB5FB87B-7CE2-4F83-915D-550846C9537B}" } ], "repeated": 0, "id": 3072 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "96" }, { "name": "Name", "value": "{AE50C081-EBD2-438A-8655-8A092E34987A}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}" } ], "repeated": 0, "id": 3073 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "97" }, { "name": "Name", "value": "{B2C5E279-7ADD-439F-B28C-C41FE1BBF672}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B2C5E279-7ADD-439F-B28C-C41FE1BBF672}" } ], "repeated": 0, "id": 3074 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "98" }, { "name": "Name", "value": "{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}" } ], "repeated": 0, "id": 3075 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "99" }, { "name": "Name", "value": "{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}" } ], "repeated": 0, "id": 3076 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "100" }, { "name": "Name", "value": "{B7534046-3ECB-4C18-BE4E-64CD4CB7D6AC}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B7534046-3ECB-4C18-BE4E-64CD4CB7D6AC}" } ], "repeated": 0, "id": 3077 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "101" }, { "name": "Name", "value": "{b7bede81-df94-4682-a7d8-57a52620b86f}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{b7bede81-df94-4682-a7d8-57a52620b86f}" } ], "repeated": 0, "id": 3078 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "102" }, { "name": "Name", "value": "{B88F4DAA-E7BD-49a9-B74D-02885A5DC765}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B88F4DAA-E7BD-49a9-B74D-02885A5DC765}" } ], "repeated": 0, "id": 3079 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "103" }, { "name": "Name", "value": "{B94237E7-57AC-4347-9151-B08C6C32D1F7}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B94237E7-57AC-4347-9151-B08C6C32D1F7}" } ], "repeated": 0, "id": 3080 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "104" }, { "name": "Name", "value": "{B97D20BB-F46A-4C97-BA10-5E3608430854}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B97D20BB-F46A-4C97-BA10-5E3608430854}" } ], "repeated": 0, "id": 3081 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "105" }, { "name": "Name", "value": "{bcb5256f-79f6-4cee-b725-dc34e402fd46}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{bcb5256f-79f6-4cee-b725-dc34e402fd46}" } ], "repeated": 0, "id": 3082 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "106" }, { "name": "Name", "value": "{bcbd3057-ca5c-4622-b42d-bc56db0ae516}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{bcbd3057-ca5c-4622-b42d-bc56db0ae516}" } ], "repeated": 0, "id": 3083 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "107" }, { "name": "Name", "value": "{bfb9d5e0-c6a9-404c-b2b2-ae6db6af4968}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{bfb9d5e0-c6a9-404c-b2b2-ae6db6af4968}" } ], "repeated": 0, "id": 3084 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "108" }, { "name": "Name", "value": "{C1BAE2D0-10DF-4334-BEDD-7AA20B227A9D}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C1BAE2D0-10DF-4334-BEDD-7AA20B227A9D}" } ], "repeated": 0, "id": 3085 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "109" }, { "name": "Name", "value": "{C3F2459E-80D6-45DC-BFEF-1F769F2BE730}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C3F2459E-80D6-45DC-BFEF-1F769F2BE730}" } ], "repeated": 0, "id": 3086 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "110" }, { "name": "Name", "value": "{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}" } ], "repeated": 0, "id": 3087 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "111" }, { "name": "Name", "value": "{C5ABBF53-E17F-4121-8900-86626FC2C973}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C5ABBF53-E17F-4121-8900-86626FC2C973}" } ], "repeated": 0, "id": 3088 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "112" }, { "name": "Name", "value": "{C870044B-F49E-4126-A9C3-B52A1FF411E8}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C870044B-F49E-4126-A9C3-B52A1FF411E8}" } ], "repeated": 0, "id": 3089 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "113" }, { "name": "Name", "value": "{D0384E7D-BAC3-4797-8F14-CBA229B392B5}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D0384E7D-BAC3-4797-8F14-CBA229B392B5}" } ], "repeated": 0, "id": 3090 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "114" }, { "name": "Name", "value": "{D20BEEC4-5CA8-4905-AE3B-BF251EA09B53}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D20BEEC4-5CA8-4905-AE3B-BF251EA09B53}" } ], "repeated": 0, "id": 3091 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "115" }, { "name": "Name", "value": "{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}" } ], "repeated": 0, "id": 3092 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "116" }, { "name": "Name", "value": "{D9DC8A3B-B784-432E-A781-5A1130A75963}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D9DC8A3B-B784-432E-A781-5A1130A75963}" } ], "repeated": 0, "id": 3093 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "117" }, { "name": "Name", "value": "{DBE8E08E-3053-4BBC-B183-2A7B2B191E59}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DBE8E08E-3053-4BBC-B183-2A7B2B191E59}" } ], "repeated": 0, "id": 3094 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "118" }, { "name": "Name", "value": "{de61d971-5ebc-4f02-a3a9-6c82895e5c04}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{de61d971-5ebc-4f02-a3a9-6c82895e5c04}" } ], "repeated": 0, "id": 3095 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "119" }, { "name": "Name", "value": "{DE92C1C7-837F-4F69-A3BB-86E631204A23}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DE92C1C7-837F-4F69-A3BB-86E631204A23}" } ], "repeated": 0, "id": 3096 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "120" }, { "name": "Name", "value": "{DE974D24-D9C6-4D3E-BF91-F4455120B917}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DE974D24-D9C6-4D3E-BF91-F4455120B917}" } ], "repeated": 0, "id": 3097 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "121" }, { "name": "Name", "value": "{DEBF2536-E1A8-4c59-B6A2-414586476AEA}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DEBF2536-E1A8-4c59-B6A2-414586476AEA}" } ], "repeated": 0, "id": 3098 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "122" }, { "name": "Name", "value": "{df7266ac-9274-4867-8d55-3bd661de872d}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{df7266ac-9274-4867-8d55-3bd661de872d}" } ], "repeated": 0, "id": 3099 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "123" }, { "name": "Name", "value": "{DFDF76A2-C82A-4D63-906A-5644AC457385}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DFDF76A2-C82A-4D63-906A-5644AC457385}" } ], "repeated": 0, "id": 3100 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "124" }, { "name": "Name", "value": "{E25B5812-BE88-4bd9-94B0-29233477B6C3}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{E25B5812-BE88-4bd9-94B0-29233477B6C3}" } ], "repeated": 0, "id": 3101 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "125" }, { "name": "Name", "value": "{E555AB60-153B-4D17-9F04-A5FE99FC15EC}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{E555AB60-153B-4D17-9F04-A5FE99FC15EC}" } ], "repeated": 0, "id": 3102 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "126" }, { "name": "Name", "value": "{ED4824AF-DCE4-45A8-81E2-FC7965083634}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{ED4824AF-DCE4-45A8-81E2-FC7965083634}" } ], "repeated": 0, "id": 3103 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "127" }, { "name": "Name", "value": "{EDC0FE71-98D8-4F4A-B920-C8DC133CB165}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{EDC0FE71-98D8-4F4A-B920-C8DC133CB165}" } ], "repeated": 0, "id": 3104 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "128" }, { "name": "Name", "value": "{EE32E446-31CA-4ABA-814F-A5EBD2FD6D5E}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{EE32E446-31CA-4ABA-814F-A5EBD2FD6D5E}" } ], "repeated": 0, "id": 3105 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "129" }, { "name": "Name", "value": "{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}" } ], "repeated": 0, "id": 3106 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "130" }, { "name": "Name", "value": "{F38BF404-1D43-42F2-9305-67DE0B28FC23}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}" } ], "repeated": 0, "id": 3107 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "131" }, { "name": "Name", "value": "{f3ce0f7c-4901-4acc-8648-d5d44b04ef8f}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{f3ce0f7c-4901-4acc-8648-d5d44b04ef8f}" } ], "repeated": 0, "id": 3108 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "132" }, { "name": "Name", "value": "{f42ee2d3-909f-4907-8871-4c22fc0bf756}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{f42ee2d3-909f-4907-8871-4c22fc0bf756}" } ], "repeated": 0, "id": 3109 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "133" }, { "name": "Name", "value": "{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}" } ], "repeated": 0, "id": 3110 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "134" }, { "name": "Name", "value": "{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}" } ], "repeated": 0, "id": 3111 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "135" }, { "name": "Name", "value": "{FDD39AD0-238F-46AF-ADB4-6C85480369C7}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}" } ], "repeated": 0, "id": 3112 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": false, "return": "0x00000103", "pretty_return": "NO_MORE_ITEMS", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "Index", "value": "136" }, { "name": "Name", "value": "" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\" } ], "repeated": 0, "id": 3113 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" } ], "repeated": 0, "id": 3114 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x00000398" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 3115 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000398" }, { "name": "SubKey", "value": "{7D1D3A04-DEBB-4115-95CF-2F29DA2920DA}" }, { "name": "Handle", "value": "0x000003a0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7D1D3A04-DEBB-4115-95CF-2F29DA2920DA}" } ], "repeated": 0, "id": 3116 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" } ], "repeated": 0, "id": 3117 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003a0" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7d1d3a04-debb-4115-95cf-2f29da2920da}\\Category" } ], "repeated": 0, "id": 3118 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003a0" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "Searches" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7d1d3a04-debb-4115-95cf-2f29da2920da}\\Name" } ], "repeated": 0, "id": 3119 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003a0" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7d1d3a04-debb-4115-95cf-2f29da2920da}\\ParentFolder" } ], "repeated": 0, "id": 3120 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003a0" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7d1d3a04-debb-4115-95cf-2f29da2920da}\\Description" } ], "repeated": 0, "id": 3121 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003a0" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "Searches" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7d1d3a04-debb-4115-95cf-2f29da2920da}\\RelativePath" } ], "repeated": 0, "id": 3122 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003a0" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "Data", "value": "::{59031a47-3f72-44a7-89c5-5595fe6b30ee}\\{7d1d3a04-debb-4115-95cf-2f29da2920da}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7d1d3a04-debb-4115-95cf-2f29da2920da}\\ParsingName" } ], "repeated": 0, "id": 3123 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003a0" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7d1d3a04-debb-4115-95cf-2f29da2920da}\\InfoTip" } ], "repeated": 0, "id": 3124 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003a0" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "Data", "value": "@%SystemRoot%\\system32\\shell32.dll,-9031" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7d1d3a04-debb-4115-95cf-2f29da2920da}\\LocalizedName" } ], "repeated": 0, "id": 3125 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003a0" }, { "name": "ValueName", "value": "Icon" }, { "name": "Data", "value": "%SystemRoot%\\system32\\imageres.dll,-18" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7d1d3a04-debb-4115-95cf-2f29da2920da}\\Icon" } ], "repeated": 0, "id": 3126 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003a0" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7d1d3a04-debb-4115-95cf-2f29da2920da}\\Security" } ], "repeated": 0, "id": 3127 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003a0" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7d1d3a04-debb-4115-95cf-2f29da2920da}\\StreamResource" } ], "repeated": 0, "id": 3128 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003a0" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7d1d3a04-debb-4115-95cf-2f29da2920da}\\StreamResourceType" } ], "repeated": 0, "id": 3129 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003a0" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7d1d3a04-debb-4115-95cf-2f29da2920da}\\LocalRedirectOnly" } ], "repeated": 0, "id": 3130 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003a0" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7d1d3a04-debb-4115-95cf-2f29da2920da}\\Roamable" } ], "repeated": 0, "id": 3131 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003a0" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7d1d3a04-debb-4115-95cf-2f29da2920da}\\PreCreate" } ], "repeated": 0, "id": 3132 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003a0" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7d1d3a04-debb-4115-95cf-2f29da2920da}\\Stream" } ], "repeated": 0, "id": 3133 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003a0" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7d1d3a04-debb-4115-95cf-2f29da2920da}\\PublishExpandedPath" } ], "repeated": 0, "id": 3134 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003a0" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7d1d3a04-debb-4115-95cf-2f29da2920da}\\DefinitionFlags" } ], "repeated": 0, "id": 3135 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003a0" }, { "name": "ValueName", "value": "Attributes" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7d1d3a04-debb-4115-95cf-2f29da2920da}\\Attributes" } ], "repeated": 0, "id": 3136 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003a0" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "Data", "value": "{0b0ba2e3-405f-415e-a6ee-cad625207853}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7d1d3a04-debb-4115-95cf-2f29da2920da}\\FolderTypeID" } ], "repeated": 0, "id": 3137 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003a0" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7d1d3a04-debb-4115-95cf-2f29da2920da}\\InitFolderHandler" } ], "repeated": 0, "id": 3138 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000003a0" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7d1d3a04-debb-4115-95cf-2f29da2920da}\\PropertyBag" } ], "repeated": 0, "id": 3139 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003a0" } ], "repeated": 0, "id": 3140 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "4DF0C730-DF9D-4AE3-9153-AA6B82E9795A" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "8BE2D872-86AA-4D47-B776-32CCA40C7018" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 3141 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" } ], "repeated": 0, "id": 3142 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 3143 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 3144 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000003a0" } ], "repeated": 0, "id": 3145 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3146 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "`\\xa7\\xec\\x11l\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3147 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000002e4" }, { "name": "SubKey", "value": "SessionInfo\\1" }, { "name": "Handle", "value": "0x000003a4" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1" } ], "repeated": 0, "id": 3148 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000003a4" }, { "name": "SubKey", "value": "KnownFolders" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1\\KnownFolders" } ], "repeated": 0, "id": 3149 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003a4" } ], "repeated": 0, "id": 3150 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xa3\\xec\\x11l\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x80\\xa4\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3151 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003a4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 3152 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003a4" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" }, { "name": "Handle", "value": "0x000003a8" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" } ], "repeated": 0, "id": 3153 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003a4" } ], "repeated": 0, "id": 3154 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003a8" }, { "name": "ValueName", "value": "{7D1D3A04-DEBB-4115-95CF-2F29DA2920DA}" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\{7D1D3A04-DEBB-4115-95CF-2F29DA2920DA}" } ], "repeated": 0, "id": 3155 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000003a4" } ], "repeated": 0, "id": 3156 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x10\\xe3?\\xc0\\xf5\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3157 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "Handle", "value": "0x000003ac" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 3158 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "ProfileImagePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath" } ], "repeated": 0, "id": 3159 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "ProfileImagePath" }, { "name": "Data", "value": "C:\\Users\\admin" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath" } ], "repeated": 0, "id": 3160 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" } ], "repeated": 0, "id": 3161 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003a4" } ], "repeated": 0, "id": 3162 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003a0" } ], "repeated": 0, "id": 3163 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003a8" } ], "repeated": 0, "id": 3164 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000003a8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 3165 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003a8" }, { "name": "SubKey", "value": "{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}" }, { "name": "Handle", "value": "0x000003a0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}" } ], "repeated": 0, "id": 3166 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003a8" } ], "repeated": 0, "id": 3167 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003a0" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}\\Category" } ], "repeated": 0, "id": 3168 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003a0" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "ProgramFilesCommon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}\\Name" } ], "repeated": 0, "id": 3169 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003a0" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}\\ParentFolder" } ], "repeated": 0, "id": 3170 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003a0" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}\\Description" } ], "repeated": 0, "id": 3171 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003a0" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}\\RelativePath" } ], "repeated": 0, "id": 3172 }, { "timestamp": "2026-05-29 01:05:17,665", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003a0" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}\\ParsingName" } ], "repeated": 0, "id": 3173 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003a0" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}\\InfoTip" } ], "repeated": 0, "id": 3174 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003a0" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}\\LocalizedName" } ], "repeated": 0, "id": 3175 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003a0" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}\\Icon" } ], "repeated": 0, "id": 3176 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003a0" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}\\Security" } ], "repeated": 0, "id": 3177 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003a0" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}\\StreamResource" } ], "repeated": 0, "id": 3178 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003a0" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}\\StreamResourceType" } ], "repeated": 0, "id": 3179 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003a0" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}\\LocalRedirectOnly" } ], "repeated": 0, "id": 3180 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003a0" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}\\Roamable" } ], "repeated": 0, "id": 3181 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003a0" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}\\PreCreate" } ], "repeated": 0, "id": 3182 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003a0" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}\\Stream" } ], "repeated": 0, "id": 3183 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003a0" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}\\PublishExpandedPath" } ], "repeated": 0, "id": 3184 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003a0" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}\\DefinitionFlags" } ], "repeated": 0, "id": 3185 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003a0" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}\\Attributes" } ], "repeated": 0, "id": 3186 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003a0" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}\\FolderTypeID" } ], "repeated": 0, "id": 3187 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003a0" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}\\InitFolderHandler" } ], "repeated": 0, "id": 3188 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000003a0" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}\\PropertyBag" } ], "repeated": 0, "id": 3189 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003a0" } ], "repeated": 0, "id": 3190 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000003a0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 3191 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003a0" }, { "name": "SubKey", "value": "{2112AB0A-C86A-4FFE-A368-0DE96E47012E}" }, { "name": "Handle", "value": "0x000003b0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2112AB0A-C86A-4FFE-A368-0DE96E47012E}" } ], "repeated": 0, "id": 3192 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003a0" } ], "repeated": 0, "id": 3193 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b0" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2112AB0A-C86A-4ffe-A368-0DE96E47012E}\\Category" } ], "repeated": 0, "id": 3194 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b0" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "MusicLibrary" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2112AB0A-C86A-4ffe-A368-0DE96E47012E}\\Name" } ], "repeated": 0, "id": 3195 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b0" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "Data", "value": "{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2112AB0A-C86A-4ffe-A368-0DE96E47012E}\\ParentFolder" } ], "repeated": 0, "id": 3196 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b0" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2112AB0A-C86A-4ffe-A368-0DE96E47012E}\\Description" } ], "repeated": 0, "id": 3197 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b0" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "Music.library-ms" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2112AB0A-C86A-4ffe-A368-0DE96E47012E}\\RelativePath" } ], "repeated": 0, "id": 3198 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b0" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "Data", "value": "::{031E4825-7B94-4dc3-B131-E946B44C8DD5}\\{2112AB0A-C86A-4ffe-A368-0DE96E47012E}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2112AB0A-C86A-4ffe-A368-0DE96E47012E}\\ParsingName" } ], "repeated": 0, "id": 3199 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b0" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "Data", "value": "@%SystemRoot%\\system32\\shell32.dll,-12689" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2112AB0A-C86A-4ffe-A368-0DE96E47012E}\\InfoTip" } ], "repeated": 0, "id": 3200 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b0" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "Data", "value": "@%SystemRoot%\\system32\\windows.storage.dll,-34584" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2112AB0A-C86A-4ffe-A368-0DE96E47012E}\\LocalizedName" } ], "repeated": 0, "id": 3201 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b0" }, { "name": "ValueName", "value": "Icon" }, { "name": "Data", "value": "%SystemRoot%\\system32\\imageres.dll,-1004" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2112AB0A-C86A-4ffe-A368-0DE96E47012E}\\Icon" } ], "repeated": 0, "id": 3202 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b0" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2112AB0A-C86A-4ffe-A368-0DE96E47012E}\\Security" } ], "repeated": 0, "id": 3203 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b0" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "Data", "value": "%SystemRoot%\\system32\\shell32.dll,-2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2112AB0A-C86A-4ffe-A368-0DE96E47012E}\\StreamResource" } ], "repeated": 0, "id": 3204 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b0" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "Data", "value": "LIBRARY" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2112AB0A-C86A-4ffe-A368-0DE96E47012E}\\StreamResourceType" } ], "repeated": 0, "id": 3205 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b0" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2112AB0A-C86A-4ffe-A368-0DE96E47012E}\\LocalRedirectOnly" } ], "repeated": 0, "id": 3206 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b0" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2112AB0A-C86A-4ffe-A368-0DE96E47012E}\\Roamable" } ], "repeated": 0, "id": 3207 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b0" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2112AB0A-C86A-4ffe-A368-0DE96E47012E}\\PreCreate" } ], "repeated": 0, "id": 3208 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b0" }, { "name": "ValueName", "value": "Stream" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2112AB0A-C86A-4ffe-A368-0DE96E47012E}\\Stream" } ], "repeated": 0, "id": 3209 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b0" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2112AB0A-C86A-4ffe-A368-0DE96E47012E}\\PublishExpandedPath" } ], "repeated": 0, "id": 3210 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b0" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2112AB0A-C86A-4ffe-A368-0DE96E47012E}\\DefinitionFlags" } ], "repeated": 0, "id": 3211 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b0" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2112AB0A-C86A-4ffe-A368-0DE96E47012E}\\Attributes" } ], "repeated": 0, "id": 3212 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b0" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2112AB0A-C86A-4ffe-A368-0DE96E47012E}\\FolderTypeID" } ], "repeated": 0, "id": 3213 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b0" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2112AB0A-C86A-4ffe-A368-0DE96E47012E}\\InitFolderHandler" } ], "repeated": 0, "id": 3214 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003b0" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x000003a0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2112AB0A-C86A-4ffe-A368-0DE96E47012E}\\PropertyBag" } ], "repeated": 0, "id": 3215 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b0" } ], "repeated": 0, "id": 3216 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000003b0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 3217 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003b0" }, { "name": "SubKey", "value": "{48DAF80B-E6CF-4F4E-B800-0E69D84EE384}" }, { "name": "Handle", "value": "0x000003b4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{48DAF80B-E6CF-4F4E-B800-0E69D84EE384}" } ], "repeated": 0, "id": 3218 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b0" } ], "repeated": 0, "id": 3219 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b4" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "3" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{48daf80b-e6cf-4f4e-b800-0e69d84ee384}\\Category" } ], "repeated": 0, "id": 3220 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b4" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "PublicLibraries" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{48daf80b-e6cf-4f4e-b800-0e69d84ee384}\\Name" } ], "repeated": 0, "id": 3221 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b4" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "Data", "value": "{DFDF76A2-C82A-4D63-906A-5644AC457385}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{48daf80b-e6cf-4f4e-b800-0e69d84ee384}\\ParentFolder" } ], "repeated": 0, "id": 3222 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b4" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{48daf80b-e6cf-4f4e-b800-0e69d84ee384}\\Description" } ], "repeated": 0, "id": 3223 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b4" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "Libraries" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{48daf80b-e6cf-4f4e-b800-0e69d84ee384}\\RelativePath" } ], "repeated": 0, "id": 3224 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b4" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{48daf80b-e6cf-4f4e-b800-0e69d84ee384}\\ParsingName" } ], "repeated": 0, "id": 3225 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b4" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{48daf80b-e6cf-4f4e-b800-0e69d84ee384}\\InfoTip" } ], "repeated": 0, "id": 3226 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b4" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{48daf80b-e6cf-4f4e-b800-0e69d84ee384}\\LocalizedName" } ], "repeated": 0, "id": 3227 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b4" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{48daf80b-e6cf-4f4e-b800-0e69d84ee384}\\Icon" } ], "repeated": 0, "id": 3228 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b4" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{48daf80b-e6cf-4f4e-b800-0e69d84ee384}\\Security" } ], "repeated": 0, "id": 3229 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b4" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{48daf80b-e6cf-4f4e-b800-0e69d84ee384}\\StreamResource" } ], "repeated": 0, "id": 3230 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b4" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{48daf80b-e6cf-4f4e-b800-0e69d84ee384}\\StreamResourceType" } ], "repeated": 0, "id": 3231 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b4" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{48daf80b-e6cf-4f4e-b800-0e69d84ee384}\\LocalRedirectOnly" } ], "repeated": 0, "id": 3232 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b4" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{48daf80b-e6cf-4f4e-b800-0e69d84ee384}\\Roamable" } ], "repeated": 0, "id": 3233 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b4" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{48daf80b-e6cf-4f4e-b800-0e69d84ee384}\\PreCreate" } ], "repeated": 0, "id": 3234 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b4" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{48daf80b-e6cf-4f4e-b800-0e69d84ee384}\\Stream" } ], "repeated": 0, "id": 3235 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b4" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{48daf80b-e6cf-4f4e-b800-0e69d84ee384}\\PublishExpandedPath" } ], "repeated": 0, "id": 3236 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b4" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{48daf80b-e6cf-4f4e-b800-0e69d84ee384}\\DefinitionFlags" } ], "repeated": 0, "id": 3237 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b4" }, { "name": "ValueName", "value": "Attributes" }, { "name": "Data", "value": "3" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{48daf80b-e6cf-4f4e-b800-0e69d84ee384}\\Attributes" } ], "repeated": 0, "id": 3238 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b4" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{48daf80b-e6cf-4f4e-b800-0e69d84ee384}\\FolderTypeID" } ], "repeated": 0, "id": 3239 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b4" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{48daf80b-e6cf-4f4e-b800-0e69d84ee384}\\InitFolderHandler" } ], "repeated": 0, "id": 3240 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000003b4" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{48daf80b-e6cf-4f4e-b800-0e69d84ee384}\\PropertyBag" } ], "repeated": 0, "id": 3241 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b4" } ], "repeated": 0, "id": 3242 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000003b4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 3243 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003b4" }, { "name": "SubKey", "value": "{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}" }, { "name": "Handle", "value": "0x000003b0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}" } ], "repeated": 0, "id": 3244 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b4" } ], "repeated": 0, "id": 3245 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b0" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "3" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\\Category" } ], "repeated": 0, "id": 3246 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b0" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "Common Desktop" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\\Name" } ], "repeated": 0, "id": 3247 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b0" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "Data", "value": "{DFDF76A2-C82A-4D63-906A-5644AC457385}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\\ParentFolder" } ], "repeated": 0, "id": 3248 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b0" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\\Description" } ], "repeated": 0, "id": 3249 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b0" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "Desktop" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\\RelativePath" } ], "repeated": 0, "id": 3250 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b0" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\\ParsingName" } ], "repeated": 0, "id": 3251 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b0" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\\InfoTip" } ], "repeated": 0, "id": 3252 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b0" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "Data", "value": "@%SystemRoot%\\system32\\shell32.dll,-21799" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\\LocalizedName" } ], "repeated": 0, "id": 3253 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b0" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\\Icon" } ], "repeated": 0, "id": 3254 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b0" }, { "name": "ValueName", "value": "Security" }, { "name": "Data", "value": "D:P(A;OICI;FA;;;BA)(A;OICI;0x1200a9;;;IU)(A;OICI;FA;;;SY)" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\\Security" } ], "repeated": 0, "id": 3255 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b0" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\\StreamResource" } ], "repeated": 0, "id": 3256 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b0" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\\StreamResourceType" } ], "repeated": 0, "id": 3257 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b0" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\\LocalRedirectOnly" } ], "repeated": 0, "id": 3258 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b0" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\\Roamable" } ], "repeated": 0, "id": 3259 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b0" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\\PreCreate" } ], "repeated": 0, "id": 3260 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b0" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\\Stream" } ], "repeated": 0, "id": 3261 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b0" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\\PublishExpandedPath" } ], "repeated": 0, "id": 3262 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b0" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\\DefinitionFlags" } ], "repeated": 0, "id": 3263 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b0" }, { "name": "ValueName", "value": "Attributes" }, { "name": "Data", "value": "3" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\\Attributes" } ], "repeated": 0, "id": 3264 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b0" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\\FolderTypeID" } ], "repeated": 0, "id": 3265 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b0" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\\InitFolderHandler" } ], "repeated": 0, "id": 3266 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000003b0" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\\PropertyBag" } ], "repeated": 0, "id": 3267 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b0" } ], "repeated": 0, "id": 3268 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000003b0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 3269 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003b0" }, { "name": "SubKey", "value": "{7BE16610-1F7F-44AC-BFF0-83E15F2FFCA1}" }, { "name": "Handle", "value": "0x000003b4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7BE16610-1F7F-44AC-BFF0-83E15F2FFCA1}" } ], "repeated": 0, "id": 3270 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b0" } ], "repeated": 0, "id": 3271 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b4" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7BE16610-1F7F-44AC-BFF0-83E15F2FFCA1}\\Category" } ], "repeated": 0, "id": 3272 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b4" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "AppDataDocuments" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7BE16610-1F7F-44AC-BFF0-83E15F2FFCA1}\\Name" } ], "repeated": 0, "id": 3273 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b4" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "Data", "value": "{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7BE16610-1F7F-44AC-BFF0-83E15F2FFCA1}\\ParentFolder" } ], "repeated": 0, "id": 3274 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b4" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7BE16610-1F7F-44AC-BFF0-83E15F2FFCA1}\\Description" } ], "repeated": 0, "id": 3275 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b4" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "Documents" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7BE16610-1F7F-44AC-BFF0-83E15F2FFCA1}\\RelativePath" } ], "repeated": 0, "id": 3276 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b4" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7BE16610-1F7F-44AC-BFF0-83E15F2FFCA1}\\ParsingName" } ], "repeated": 0, "id": 3277 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b4" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7BE16610-1F7F-44AC-BFF0-83E15F2FFCA1}\\InfoTip" } ], "repeated": 0, "id": 3278 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b4" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7BE16610-1F7F-44AC-BFF0-83E15F2FFCA1}\\LocalizedName" } ], "repeated": 0, "id": 3279 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b4" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7BE16610-1F7F-44AC-BFF0-83E15F2FFCA1}\\Icon" } ], "repeated": 0, "id": 3280 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b4" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7BE16610-1F7F-44AC-BFF0-83E15F2FFCA1}\\Security" } ], "repeated": 0, "id": 3281 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b4" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7BE16610-1F7F-44AC-BFF0-83E15F2FFCA1}\\StreamResource" } ], "repeated": 0, "id": 3282 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b4" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7BE16610-1F7F-44AC-BFF0-83E15F2FFCA1}\\StreamResourceType" } ], "repeated": 0, "id": 3283 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b4" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7BE16610-1F7F-44AC-BFF0-83E15F2FFCA1}\\LocalRedirectOnly" } ], "repeated": 0, "id": 3284 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b4" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7BE16610-1F7F-44AC-BFF0-83E15F2FFCA1}\\Roamable" } ], "repeated": 0, "id": 3285 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b4" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7BE16610-1F7F-44AC-BFF0-83E15F2FFCA1}\\PreCreate" } ], "repeated": 0, "id": 3286 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b4" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7BE16610-1F7F-44AC-BFF0-83E15F2FFCA1}\\Stream" } ], "repeated": 0, "id": 3287 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b4" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7BE16610-1F7F-44AC-BFF0-83E15F2FFCA1}\\PublishExpandedPath" } ], "repeated": 0, "id": 3288 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b4" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7BE16610-1F7F-44AC-BFF0-83E15F2FFCA1}\\DefinitionFlags" } ], "repeated": 0, "id": 3289 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b4" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7BE16610-1F7F-44AC-BFF0-83E15F2FFCA1}\\Attributes" } ], "repeated": 0, "id": 3290 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b4" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7BE16610-1F7F-44AC-BFF0-83E15F2FFCA1}\\FolderTypeID" } ], "repeated": 0, "id": 3291 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b4" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7BE16610-1F7F-44AC-BFF0-83E15F2FFCA1}\\InitFolderHandler" } ], "repeated": 0, "id": 3292 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000003b4" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7BE16610-1F7F-44AC-BFF0-83E15F2FFCA1}\\PropertyBag" } ], "repeated": 0, "id": 3293 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b4" } ], "repeated": 0, "id": 3294 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000003b4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 3295 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003b4" }, { "name": "SubKey", "value": "{9E52AB10-F80D-49DF-ACB8-4330F5687855}" }, { "name": "Handle", "value": "0x000003b0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9E52AB10-F80D-49DF-ACB8-4330F5687855}" } ], "repeated": 0, "id": 3296 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b4" } ], "repeated": 0, "id": 3297 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b0" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9E52AB10-F80D-49DF-ACB8-4330F5687855}\\Category" } ], "repeated": 0, "id": 3298 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b0" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "CD Burning" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9E52AB10-F80D-49DF-ACB8-4330F5687855}\\Name" } ], "repeated": 0, "id": 3299 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b0" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "Data", "value": "{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9E52AB10-F80D-49DF-ACB8-4330F5687855}\\ParentFolder" } ], "repeated": 0, "id": 3300 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b0" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9E52AB10-F80D-49DF-ACB8-4330F5687855}\\Description" } ], "repeated": 0, "id": 3301 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b0" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "Microsoft\\Windows\\Burn\\Burn" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9E52AB10-F80D-49DF-ACB8-4330F5687855}\\RelativePath" } ], "repeated": 0, "id": 3302 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b0" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9E52AB10-F80D-49DF-ACB8-4330F5687855}\\ParsingName" } ], "repeated": 0, "id": 3303 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b0" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9E52AB10-F80D-49DF-ACB8-4330F5687855}\\InfoTip" } ], "repeated": 0, "id": 3304 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b0" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "Data", "value": "@%SystemRoot%\\system32\\shell32.dll,-21815" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9E52AB10-F80D-49DF-ACB8-4330F5687855}\\LocalizedName" } ], "repeated": 0, "id": 3305 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b0" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9E52AB10-F80D-49DF-ACB8-4330F5687855}\\Icon" } ], "repeated": 0, "id": 3306 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b0" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9E52AB10-F80D-49DF-ACB8-4330F5687855}\\Security" } ], "repeated": 0, "id": 3307 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b0" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9E52AB10-F80D-49DF-ACB8-4330F5687855}\\StreamResource" } ], "repeated": 0, "id": 3308 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b0" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9E52AB10-F80D-49DF-ACB8-4330F5687855}\\StreamResourceType" } ], "repeated": 0, "id": 3309 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b0" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9E52AB10-F80D-49DF-ACB8-4330F5687855}\\LocalRedirectOnly" } ], "repeated": 0, "id": 3310 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b0" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9E52AB10-F80D-49DF-ACB8-4330F5687855}\\Roamable" } ], "repeated": 0, "id": 3311 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b0" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9E52AB10-F80D-49DF-ACB8-4330F5687855}\\PreCreate" } ], "repeated": 0, "id": 3312 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b0" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9E52AB10-F80D-49DF-ACB8-4330F5687855}\\Stream" } ], "repeated": 0, "id": 3313 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b0" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9E52AB10-F80D-49DF-ACB8-4330F5687855}\\PublishExpandedPath" } ], "repeated": 0, "id": 3314 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b0" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9E52AB10-F80D-49DF-ACB8-4330F5687855}\\DefinitionFlags" } ], "repeated": 0, "id": 3315 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b0" }, { "name": "ValueName", "value": "Attributes" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9E52AB10-F80D-49DF-ACB8-4330F5687855}\\Attributes" } ], "repeated": 0, "id": 3316 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b0" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9E52AB10-F80D-49DF-ACB8-4330F5687855}\\FolderTypeID" } ], "repeated": 0, "id": 3317 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b0" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9E52AB10-F80D-49DF-ACB8-4330F5687855}\\InitFolderHandler" } ], "repeated": 0, "id": 3318 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000003b0" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9E52AB10-F80D-49DF-ACB8-4330F5687855}\\PropertyBag" } ], "repeated": 0, "id": 3319 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b0" } ], "repeated": 0, "id": 3320 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000003b0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 3321 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003b0" }, { "name": "SubKey", "value": "{767E6811-49CB-4273-87C2-20F355E1085B}" }, { "name": "Handle", "value": "0x000003b4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{767E6811-49CB-4273-87C2-20F355E1085B}" } ], "repeated": 0, "id": 3322 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b0" } ], "repeated": 0, "id": 3323 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b4" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{767E6811-49CB-4273-87C2-20F355E1085B}\\Category" } ], "repeated": 0, "id": 3324 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b4" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "OneDriveCameraRoll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{767E6811-49CB-4273-87C2-20F355E1085B}\\Name" } ], "repeated": 0, "id": 3325 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b4" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "Data", "value": "{339719B5-8C47-4894-94C2-D8F77ADD44A6}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{767E6811-49CB-4273-87C2-20F355E1085B}\\ParentFolder" } ], "repeated": 0, "id": 3326 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b4" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{767E6811-49CB-4273-87C2-20F355E1085B}\\Description" } ], "repeated": 0, "id": 3327 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b4" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "Camera Roll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{767E6811-49CB-4273-87C2-20F355E1085B}\\RelativePath" } ], "repeated": 0, "id": 3328 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b4" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{767E6811-49CB-4273-87C2-20F355E1085B}\\ParsingName" } ], "repeated": 0, "id": 3329 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b4" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{767E6811-49CB-4273-87C2-20F355E1085B}\\InfoTip" } ], "repeated": 0, "id": 3330 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b4" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{767E6811-49CB-4273-87C2-20F355E1085B}\\LocalizedName" } ], "repeated": 0, "id": 3331 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b4" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{767E6811-49CB-4273-87C2-20F355E1085B}\\Icon" } ], "repeated": 0, "id": 3332 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b4" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{767E6811-49CB-4273-87C2-20F355E1085B}\\Security" } ], "repeated": 0, "id": 3333 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b4" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{767E6811-49CB-4273-87C2-20F355E1085B}\\StreamResource" } ], "repeated": 0, "id": 3334 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b4" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{767E6811-49CB-4273-87C2-20F355E1085B}\\StreamResourceType" } ], "repeated": 0, "id": 3335 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b4" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{767E6811-49CB-4273-87C2-20F355E1085B}\\LocalRedirectOnly" } ], "repeated": 0, "id": 3336 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b4" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{767E6811-49CB-4273-87C2-20F355E1085B}\\Roamable" } ], "repeated": 0, "id": 3337 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b4" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{767E6811-49CB-4273-87C2-20F355E1085B}\\PreCreate" } ], "repeated": 0, "id": 3338 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b4" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{767E6811-49CB-4273-87C2-20F355E1085B}\\Stream" } ], "repeated": 0, "id": 3339 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b4" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{767E6811-49CB-4273-87C2-20F355E1085B}\\PublishExpandedPath" } ], "repeated": 0, "id": 3340 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b4" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "Data", "value": "64" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{767E6811-49CB-4273-87C2-20F355E1085B}\\DefinitionFlags" } ], "repeated": 0, "id": 3341 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b4" }, { "name": "ValueName", "value": "Attributes" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{767E6811-49CB-4273-87C2-20F355E1085B}\\Attributes" } ], "repeated": 0, "id": 3342 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b4" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "Data", "value": "{b3690e58-e961-423b-b687-386ebfd83239}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{767E6811-49CB-4273-87C2-20F355E1085B}\\FolderTypeID" } ], "repeated": 0, "id": 3343 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b4" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{767E6811-49CB-4273-87C2-20F355E1085B}\\InitFolderHandler" } ], "repeated": 0, "id": 3344 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003b4" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x000003b0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{767E6811-49CB-4273-87C2-20F355E1085B}\\PropertyBag" } ], "repeated": 0, "id": 3345 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b4" } ], "repeated": 0, "id": 3346 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000003b4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 3347 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003b4" }, { "name": "SubKey", "value": "{E25B5812-BE88-4BD9-94B0-29233477B6C3}" }, { "name": "Handle", "value": "0x000003a8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{E25B5812-BE88-4BD9-94B0-29233477B6C3}" } ], "repeated": 0, "id": 3348 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b4" } ], "repeated": 0, "id": 3349 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003a8" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{E25B5812-BE88-4bd9-94B0-29233477B6C3}\\Category" } ], "repeated": 0, "id": 3350 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003a8" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "SavedPicturesLibrary" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{E25B5812-BE88-4bd9-94B0-29233477B6C3}\\Name" } ], "repeated": 0, "id": 3351 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003a8" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "Data", "value": "{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{E25B5812-BE88-4bd9-94B0-29233477B6C3}\\ParentFolder" } ], "repeated": 0, "id": 3352 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003a8" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{E25B5812-BE88-4bd9-94B0-29233477B6C3}\\Description" } ], "repeated": 0, "id": 3353 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003a8" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "SavedPictures.library-ms" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{E25B5812-BE88-4bd9-94B0-29233477B6C3}\\RelativePath" } ], "repeated": 0, "id": 3354 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003a8" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "Data", "value": "::{031E4825-7B94-4dc3-B131-E946B44C8DD5}\\{E25B5812-BE88-4bd9-94B0-29233477B6C3}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{E25B5812-BE88-4bd9-94B0-29233477B6C3}\\ParsingName" } ], "repeated": 0, "id": 3355 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003a8" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{E25B5812-BE88-4bd9-94B0-29233477B6C3}\\InfoTip" } ], "repeated": 0, "id": 3356 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003a8" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "Data", "value": "@%SystemRoot%\\system32\\windows.storage.dll,-34583" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{E25B5812-BE88-4bd9-94B0-29233477B6C3}\\LocalizedName" } ], "repeated": 0, "id": 3357 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003a8" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{E25B5812-BE88-4bd9-94B0-29233477B6C3}\\Icon" } ], "repeated": 0, "id": 3358 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003a8" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{E25B5812-BE88-4bd9-94B0-29233477B6C3}\\Security" } ], "repeated": 0, "id": 3359 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003a8" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "Data", "value": "%SystemRoot%\\system32\\shell32.dll,-6" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{E25B5812-BE88-4bd9-94B0-29233477B6C3}\\StreamResource" } ], "repeated": 0, "id": 3360 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003a8" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "Data", "value": "LIBRARY" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{E25B5812-BE88-4bd9-94B0-29233477B6C3}\\StreamResourceType" } ], "repeated": 0, "id": 3361 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003a8" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{E25B5812-BE88-4bd9-94B0-29233477B6C3}\\LocalRedirectOnly" } ], "repeated": 0, "id": 3362 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003a8" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{E25B5812-BE88-4bd9-94B0-29233477B6C3}\\Roamable" } ], "repeated": 0, "id": 3363 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003a8" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{E25B5812-BE88-4bd9-94B0-29233477B6C3}\\PreCreate" } ], "repeated": 0, "id": 3364 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003a8" }, { "name": "ValueName", "value": "Stream" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{E25B5812-BE88-4bd9-94B0-29233477B6C3}\\Stream" } ], "repeated": 0, "id": 3365 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003a8" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{E25B5812-BE88-4bd9-94B0-29233477B6C3}\\PublishExpandedPath" } ], "repeated": 0, "id": 3366 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003a8" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{E25B5812-BE88-4bd9-94B0-29233477B6C3}\\DefinitionFlags" } ], "repeated": 0, "id": 3367 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003a8" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{E25B5812-BE88-4bd9-94B0-29233477B6C3}\\Attributes" } ], "repeated": 0, "id": 3368 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003a8" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{E25B5812-BE88-4bd9-94B0-29233477B6C3}\\FolderTypeID" } ], "repeated": 0, "id": 3369 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003a8" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{E25B5812-BE88-4bd9-94B0-29233477B6C3}\\InitFolderHandler" } ], "repeated": 0, "id": 3370 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003a8" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x000003b4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{E25B5812-BE88-4bd9-94B0-29233477B6C3}\\PropertyBag" } ], "repeated": 0, "id": 3371 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003a8" } ], "repeated": 0, "id": 3372 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000003a8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 3373 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003a8" }, { "name": "SubKey", "value": "{98EC0E18-2098-4D44-8644-66979315A281}" }, { "name": "Handle", "value": "0x000003a4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{98EC0E18-2098-4D44-8644-66979315A281}" } ], "repeated": 0, "id": 3374 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003a8" } ], "repeated": 0, "id": 3375 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003a4" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{98EC0E18-2098-4D44-8644-66979315A281}\\Category" } ], "repeated": 0, "id": 3376 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003a4" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "MAPIFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{98EC0E18-2098-4D44-8644-66979315A281}\\Name" } ], "repeated": 0, "id": 3377 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003a4" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{98EC0E18-2098-4D44-8644-66979315A281}\\ParentFolder" } ], "repeated": 0, "id": 3378 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003a4" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{98EC0E18-2098-4D44-8644-66979315A281}\\Description" } ], "repeated": 0, "id": 3379 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003a4" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{98EC0E18-2098-4D44-8644-66979315A281}\\RelativePath" } ], "repeated": 0, "id": 3380 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003a4" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "Data", "value": "shell:::{89D83576-6BD1-4C86-9454-BEB04E94C819}\\*" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{98EC0E18-2098-4D44-8644-66979315A281}\\ParsingName" } ], "repeated": 0, "id": 3381 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003a4" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{98EC0E18-2098-4D44-8644-66979315A281}\\InfoTip" } ], "repeated": 0, "id": 3382 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003a4" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{98EC0E18-2098-4D44-8644-66979315A281}\\LocalizedName" } ], "repeated": 0, "id": 3383 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003a4" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{98EC0E18-2098-4D44-8644-66979315A281}\\Icon" } ], "repeated": 0, "id": 3384 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003a4" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{98EC0E18-2098-4D44-8644-66979315A281}\\Security" } ], "repeated": 0, "id": 3385 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003a4" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{98EC0E18-2098-4D44-8644-66979315A281}\\StreamResource" } ], "repeated": 0, "id": 3386 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003a4" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{98EC0E18-2098-4D44-8644-66979315A281}\\StreamResourceType" } ], "repeated": 0, "id": 3387 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003a4" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{98EC0E18-2098-4D44-8644-66979315A281}\\LocalRedirectOnly" } ], "repeated": 0, "id": 3388 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003a4" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{98EC0E18-2098-4D44-8644-66979315A281}\\Roamable" } ], "repeated": 0, "id": 3389 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003a4" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{98EC0E18-2098-4D44-8644-66979315A281}\\PreCreate" } ], "repeated": 0, "id": 3390 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003a4" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{98EC0E18-2098-4D44-8644-66979315A281}\\Stream" } ], "repeated": 0, "id": 3391 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003a4" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{98EC0E18-2098-4D44-8644-66979315A281}\\PublishExpandedPath" } ], "repeated": 0, "id": 3392 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003a4" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{98EC0E18-2098-4D44-8644-66979315A281}\\DefinitionFlags" } ], "repeated": 0, "id": 3393 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003a4" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{98EC0E18-2098-4D44-8644-66979315A281}\\Attributes" } ], "repeated": 0, "id": 3394 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003a4" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{98EC0E18-2098-4D44-8644-66979315A281}\\FolderTypeID" } ], "repeated": 0, "id": 3395 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003a4" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{98EC0E18-2098-4D44-8644-66979315A281}\\InitFolderHandler" } ], "repeated": 0, "id": 3396 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000003a4" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{98EC0E18-2098-4D44-8644-66979315A281}\\PropertyBag" } ], "repeated": 0, "id": 3397 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003a4" } ], "repeated": 0, "id": 3398 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000003a4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 3399 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003a4" }, { "name": "SubKey", "value": "{18989B1D-99B5-455B-841C-AB7C74E4DDFC}" }, { "name": "Handle", "value": "0x000003a8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}" } ], "repeated": 0, "id": 3400 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003a4" } ], "repeated": 0, "id": 3401 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003a8" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\Category" } ], "repeated": 0, "id": 3402 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003a8" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "My Video" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\Name" } ], "repeated": 0, "id": 3403 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003a8" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\ParentFolder" } ], "repeated": 0, "id": 3404 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003a8" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\Description" } ], "repeated": 0, "id": 3405 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003a8" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "Videos" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\RelativePath" } ], "repeated": 0, "id": 3406 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003a8" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "Data", "value": "shell:::{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\::{A0953C92-50DC-43BF-BE83-3742FED03C9C}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\ParsingName" } ], "repeated": 0, "id": 3407 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003a8" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "Data", "value": "@%SystemRoot%\\system32\\shell32.dll,-12690" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\InfoTip" } ], "repeated": 0, "id": 3408 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003a8" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "Data", "value": "@%SystemRoot%\\system32\\windows.storage.dll,-21791" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\LocalizedName" } ], "repeated": 0, "id": 3409 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003a8" }, { "name": "ValueName", "value": "Icon" }, { "name": "Data", "value": "%SystemRoot%\\system32\\imageres.dll,-189" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\Icon" } ], "repeated": 0, "id": 3410 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003a8" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\Security" } ], "repeated": 0, "id": 3411 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003a8" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\StreamResource" } ], "repeated": 0, "id": 3412 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003a8" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\StreamResourceType" } ], "repeated": 0, "id": 3413 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003a8" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\LocalRedirectOnly" } ], "repeated": 0, "id": 3414 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003a8" }, { "name": "ValueName", "value": "Roamable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\Roamable" } ], "repeated": 0, "id": 3415 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003a8" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\PreCreate" } ], "repeated": 0, "id": 3416 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003a8" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\Stream" } ], "repeated": 0, "id": 3417 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003a8" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\PublishExpandedPath" } ], "repeated": 0, "id": 3418 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003a8" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\DefinitionFlags" } ], "repeated": 0, "id": 3419 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003a8" }, { "name": "ValueName", "value": "Attributes" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\Attributes" } ], "repeated": 0, "id": 3420 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003a8" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\FolderTypeID" } ], "repeated": 0, "id": 3421 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003a8" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\InitFolderHandler" } ], "repeated": 0, "id": 3422 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003a8" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x000003a4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\PropertyBag" } ], "repeated": 0, "id": 3423 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003a8" } ], "repeated": 0, "id": 3424 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003a4" }, { "name": "ValueName", "value": "ThisPCPolicy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\PropertyBag\\ThisPCPolicy" } ], "repeated": 0, "id": 3425 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003a4" }, { "name": "ValueName", "value": "ThisPCPolicy" }, { "name": "Data", "value": "Hide" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\PropertyBag\\ThisPCPolicy" } ], "repeated": 0, "id": 3426 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000003a8" } ], "repeated": 0, "id": 3427 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3428 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003a8" } ], "repeated": 0, "id": 3429 }, { "timestamp": "2026-05-29 01:05:17,680", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x10\\xc9\\xec\\x11l\\x00\\x00\\x00\\x00\\x00\\x00\\x00l\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00l\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00<\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xdc\\xe6?\\xc0\\xf5\\x01\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3430 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003a8" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 3431 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003a8" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3432 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000003a8" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 3433 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x0000000c" }, { "name": "TokenHandle", "value": "0x000003ac" } ], "repeated": 0, "id": 3434 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" }, { "name": "Handle", "value": "0x000003b8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" } ], "repeated": 0, "id": 3435 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "RDVirtualizationPool" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\RDVirtualizationPool" } ], "repeated": 0, "id": 3436 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b8" } ], "repeated": 0, "id": 3437 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" }, { "name": "Handle", "value": "0x000003b8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" } ], "repeated": 0, "id": 3438 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "RDVirtualizationPool" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\RDVirtualizationPool" } ], "repeated": 0, "id": 3439 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b8" } ], "repeated": 0, "id": 3440 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x90\\xc9\\xec\\x11l\\x00\\x00\\x00\\x00\\x00\\x00\\x00l\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xa0\\xbd}\\x1a\\xff\\x7f\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xf8\\x81}\\x1a" } ], "repeated": 0, "id": 3441 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\fdeploy" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\fdeploy" } ], "repeated": 0, "id": 3442 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" } ], "repeated": 0, "id": 3443 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003a8" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" }, { "name": "Handle", "value": "0x000003ac" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" } ], "repeated": 0, "id": 3444 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" } ], "repeated": 0, "id": 3445 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003a8" } ], "repeated": 0, "id": 3446 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000003a8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 3447 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003a8" }, { "name": "SubKey", "value": "{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}" }, { "name": "Handle", "value": "0x000003ac" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}" } ], "repeated": 0, "id": 3448 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003a8" } ], "repeated": 0, "id": 3449 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{52a4f021-7b75-48a9-9f6b-4b87a210bc8f}\\Category" } ], "repeated": 0, "id": 3450 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "Quick Launch" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{52a4f021-7b75-48a9-9f6b-4b87a210bc8f}\\Name" } ], "repeated": 0, "id": 3451 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "Data", "value": "{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{52a4f021-7b75-48a9-9f6b-4b87a210bc8f}\\ParentFolder" } ], "repeated": 0, "id": 3452 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{52a4f021-7b75-48a9-9f6b-4b87a210bc8f}\\Description" } ], "repeated": 0, "id": 3453 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "Microsoft\\Internet Explorer\\Quick Launch" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{52a4f021-7b75-48a9-9f6b-4b87a210bc8f}\\RelativePath" } ], "repeated": 0, "id": 3454 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{52a4f021-7b75-48a9-9f6b-4b87a210bc8f}\\ParsingName" } ], "repeated": 0, "id": 3455 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{52a4f021-7b75-48a9-9f6b-4b87a210bc8f}\\InfoTip" } ], "repeated": 0, "id": 3456 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{52a4f021-7b75-48a9-9f6b-4b87a210bc8f}\\LocalizedName" } ], "repeated": 0, "id": 3457 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{52a4f021-7b75-48a9-9f6b-4b87a210bc8f}\\Icon" } ], "repeated": 0, "id": 3458 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{52a4f021-7b75-48a9-9f6b-4b87a210bc8f}\\Security" } ], "repeated": 0, "id": 3459 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{52a4f021-7b75-48a9-9f6b-4b87a210bc8f}\\StreamResource" } ], "repeated": 0, "id": 3460 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{52a4f021-7b75-48a9-9f6b-4b87a210bc8f}\\StreamResourceType" } ], "repeated": 0, "id": 3461 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{52a4f021-7b75-48a9-9f6b-4b87a210bc8f}\\LocalRedirectOnly" } ], "repeated": 0, "id": 3462 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{52a4f021-7b75-48a9-9f6b-4b87a210bc8f}\\Roamable" } ], "repeated": 0, "id": 3463 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{52a4f021-7b75-48a9-9f6b-4b87a210bc8f}\\PreCreate" } ], "repeated": 0, "id": 3464 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{52a4f021-7b75-48a9-9f6b-4b87a210bc8f}\\Stream" } ], "repeated": 0, "id": 3465 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{52a4f021-7b75-48a9-9f6b-4b87a210bc8f}\\PublishExpandedPath" } ], "repeated": 0, "id": 3466 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{52a4f021-7b75-48a9-9f6b-4b87a210bc8f}\\DefinitionFlags" } ], "repeated": 0, "id": 3467 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{52a4f021-7b75-48a9-9f6b-4b87a210bc8f}\\Attributes" } ], "repeated": 0, "id": 3468 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{52a4f021-7b75-48a9-9f6b-4b87a210bc8f}\\FolderTypeID" } ], "repeated": 0, "id": 3469 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{52a4f021-7b75-48a9-9f6b-4b87a210bc8f}\\InitFolderHandler" } ], "repeated": 0, "id": 3470 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000003ac" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{52a4f021-7b75-48a9-9f6b-4b87a210bc8f}\\PropertyBag" } ], "repeated": 0, "id": 3471 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" } ], "repeated": 0, "id": 3472 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000003ac" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 3473 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003ac" }, { "name": "SubKey", "value": "{DE974D24-D9C6-4D3E-BF91-F4455120B917}" }, { "name": "Handle", "value": "0x000003a8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DE974D24-D9C6-4D3E-BF91-F4455120B917}" } ], "repeated": 0, "id": 3474 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" } ], "repeated": 0, "id": 3475 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003a8" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DE974D24-D9C6-4D3E-BF91-F4455120B917}\\Category" } ], "repeated": 0, "id": 3476 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003a8" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "ProgramFilesCommonX86" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DE974D24-D9C6-4D3E-BF91-F4455120B917}\\Name" } ], "repeated": 0, "id": 3477 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003a8" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DE974D24-D9C6-4D3E-BF91-F4455120B917}\\ParentFolder" } ], "repeated": 0, "id": 3478 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003a8" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DE974D24-D9C6-4D3E-BF91-F4455120B917}\\Description" } ], "repeated": 0, "id": 3479 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003a8" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DE974D24-D9C6-4D3E-BF91-F4455120B917}\\RelativePath" } ], "repeated": 0, "id": 3480 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003a8" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DE974D24-D9C6-4D3E-BF91-F4455120B917}\\ParsingName" } ], "repeated": 0, "id": 3481 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003a8" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DE974D24-D9C6-4D3E-BF91-F4455120B917}\\InfoTip" } ], "repeated": 0, "id": 3482 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003a8" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DE974D24-D9C6-4D3E-BF91-F4455120B917}\\LocalizedName" } ], "repeated": 0, "id": 3483 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003a8" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DE974D24-D9C6-4D3E-BF91-F4455120B917}\\Icon" } ], "repeated": 0, "id": 3484 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003a8" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DE974D24-D9C6-4D3E-BF91-F4455120B917}\\Security" } ], "repeated": 0, "id": 3485 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003a8" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DE974D24-D9C6-4D3E-BF91-F4455120B917}\\StreamResource" } ], "repeated": 0, "id": 3486 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003a8" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DE974D24-D9C6-4D3E-BF91-F4455120B917}\\StreamResourceType" } ], "repeated": 0, "id": 3487 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003a8" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DE974D24-D9C6-4D3E-BF91-F4455120B917}\\LocalRedirectOnly" } ], "repeated": 0, "id": 3488 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003a8" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DE974D24-D9C6-4D3E-BF91-F4455120B917}\\Roamable" } ], "repeated": 0, "id": 3489 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003a8" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DE974D24-D9C6-4D3E-BF91-F4455120B917}\\PreCreate" } ], "repeated": 0, "id": 3490 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003a8" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DE974D24-D9C6-4D3E-BF91-F4455120B917}\\Stream" } ], "repeated": 0, "id": 3491 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003a8" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DE974D24-D9C6-4D3E-BF91-F4455120B917}\\PublishExpandedPath" } ], "repeated": 0, "id": 3492 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003a8" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DE974D24-D9C6-4D3E-BF91-F4455120B917}\\DefinitionFlags" } ], "repeated": 0, "id": 3493 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003a8" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DE974D24-D9C6-4D3E-BF91-F4455120B917}\\Attributes" } ], "repeated": 0, "id": 3494 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003a8" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DE974D24-D9C6-4D3E-BF91-F4455120B917}\\FolderTypeID" } ], "repeated": 0, "id": 3495 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003a8" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DE974D24-D9C6-4D3E-BF91-F4455120B917}\\InitFolderHandler" } ], "repeated": 0, "id": 3496 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000003a8" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DE974D24-D9C6-4D3E-BF91-F4455120B917}\\PropertyBag" } ], "repeated": 0, "id": 3497 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003a8" } ], "repeated": 0, "id": 3498 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000003a8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 3499 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003a8" }, { "name": "SubKey", "value": "{24D89E24-2F19-4534-9DDE-6A6671FBB8FE}" }, { "name": "Handle", "value": "0x000003ac" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{24D89E24-2F19-4534-9DDE-6A6671FBB8FE}" } ], "repeated": 0, "id": 3500 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003a8" } ], "repeated": 0, "id": 3501 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{24D89E24-2F19-4534-9DDE-6A6671FBB8FE}\\Category" } ], "repeated": 0, "id": 3502 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "OneDriveDocuments" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{24D89E24-2F19-4534-9DDE-6A6671FBB8FE}\\Name" } ], "repeated": 0, "id": 3503 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "Data", "value": "{A52BBA46-E9E1-435f-B3D9-28DAA648C0F6}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{24D89E24-2F19-4534-9DDE-6A6671FBB8FE}\\ParentFolder" } ], "repeated": 0, "id": 3504 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{24D89E24-2F19-4534-9DDE-6A6671FBB8FE}\\Description" } ], "repeated": 0, "id": 3505 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "Documents" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{24D89E24-2F19-4534-9DDE-6A6671FBB8FE}\\RelativePath" } ], "repeated": 0, "id": 3506 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{24D89E24-2F19-4534-9DDE-6A6671FBB8FE}\\ParsingName" } ], "repeated": 0, "id": 3507 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{24D89E24-2F19-4534-9DDE-6A6671FBB8FE}\\InfoTip" } ], "repeated": 0, "id": 3508 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{24D89E24-2F19-4534-9DDE-6A6671FBB8FE}\\LocalizedName" } ], "repeated": 0, "id": 3509 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{24D89E24-2F19-4534-9DDE-6A6671FBB8FE}\\Icon" } ], "repeated": 0, "id": 3510 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{24D89E24-2F19-4534-9DDE-6A6671FBB8FE}\\Security" } ], "repeated": 0, "id": 3511 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{24D89E24-2F19-4534-9DDE-6A6671FBB8FE}\\StreamResource" } ], "repeated": 0, "id": 3512 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{24D89E24-2F19-4534-9DDE-6A6671FBB8FE}\\StreamResourceType" } ], "repeated": 0, "id": 3513 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{24D89E24-2F19-4534-9DDE-6A6671FBB8FE}\\LocalRedirectOnly" } ], "repeated": 0, "id": 3514 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{24D89E24-2F19-4534-9DDE-6A6671FBB8FE}\\Roamable" } ], "repeated": 0, "id": 3515 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{24D89E24-2F19-4534-9DDE-6A6671FBB8FE}\\PreCreate" } ], "repeated": 0, "id": 3516 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{24D89E24-2F19-4534-9DDE-6A6671FBB8FE}\\Stream" } ], "repeated": 0, "id": 3517 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{24D89E24-2F19-4534-9DDE-6A6671FBB8FE}\\PublishExpandedPath" } ], "repeated": 0, "id": 3518 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "Data", "value": "64" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{24D89E24-2F19-4534-9DDE-6A6671FBB8FE}\\DefinitionFlags" } ], "repeated": 0, "id": 3519 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Attributes" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{24D89E24-2F19-4534-9DDE-6A6671FBB8FE}\\Attributes" } ], "repeated": 0, "id": 3520 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "Data", "value": "{DD61BD66-70E8-48dd-9655-65C5E1AAC2D1}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{24D89E24-2F19-4534-9DDE-6A6671FBB8FE}\\FolderTypeID" } ], "repeated": 0, "id": 3521 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{24D89E24-2F19-4534-9DDE-6A6671FBB8FE}\\InitFolderHandler" } ], "repeated": 0, "id": 3522 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003ac" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x000003a8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{24D89E24-2F19-4534-9DDE-6A6671FBB8FE}\\PropertyBag" } ], "repeated": 0, "id": 3523 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" } ], "repeated": 0, "id": 3524 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000003ac" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 3525 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003ac" }, { "name": "SubKey", "value": "{31C0DD25-9439-4F12-BF41-7FF4EDA38722}" }, { "name": "Handle", "value": "0x000003b8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{31C0DD25-9439-4F12-BF41-7FF4EDA38722}" } ], "repeated": 0, "id": 3526 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" } ], "repeated": 0, "id": 3527 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{31C0DD25-9439-4F12-BF41-7FF4EDA38722}\\Category" } ], "repeated": 0, "id": 3528 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "3D Objects" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{31C0DD25-9439-4F12-BF41-7FF4EDA38722}\\Name" } ], "repeated": 0, "id": 3529 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "Data", "value": "{5E6C858F-0E22-4760-9AFE-EA3317B67173}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{31C0DD25-9439-4F12-BF41-7FF4EDA38722}\\ParentFolder" } ], "repeated": 0, "id": 3530 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{31C0DD25-9439-4F12-BF41-7FF4EDA38722}\\Description" } ], "repeated": 0, "id": 3531 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "3D Objects" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{31C0DD25-9439-4F12-BF41-7FF4EDA38722}\\RelativePath" } ], "repeated": 0, "id": 3532 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{31C0DD25-9439-4F12-BF41-7FF4EDA38722}\\ParsingName" } ], "repeated": 0, "id": 3533 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{31C0DD25-9439-4F12-BF41-7FF4EDA38722}\\InfoTip" } ], "repeated": 0, "id": 3534 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "Data", "value": "@%SystemRoot%\\system32\\windows.storage.dll,-21825" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{31C0DD25-9439-4F12-BF41-7FF4EDA38722}\\LocalizedName" } ], "repeated": 0, "id": 3535 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "Icon" }, { "name": "Data", "value": "%SystemRoot%\\system32\\imageres.dll,-198" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{31C0DD25-9439-4F12-BF41-7FF4EDA38722}\\Icon" } ], "repeated": 0, "id": 3536 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{31C0DD25-9439-4F12-BF41-7FF4EDA38722}\\Security" } ], "repeated": 0, "id": 3537 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{31C0DD25-9439-4F12-BF41-7FF4EDA38722}\\StreamResource" } ], "repeated": 0, "id": 3538 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{31C0DD25-9439-4F12-BF41-7FF4EDA38722}\\StreamResourceType" } ], "repeated": 0, "id": 3539 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{31C0DD25-9439-4F12-BF41-7FF4EDA38722}\\LocalRedirectOnly" } ], "repeated": 0, "id": 3540 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{31C0DD25-9439-4F12-BF41-7FF4EDA38722}\\Roamable" } ], "repeated": 0, "id": 3541 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{31C0DD25-9439-4F12-BF41-7FF4EDA38722}\\PreCreate" } ], "repeated": 0, "id": 3542 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{31C0DD25-9439-4F12-BF41-7FF4EDA38722}\\Stream" } ], "repeated": 0, "id": 3543 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{31C0DD25-9439-4F12-BF41-7FF4EDA38722}\\PublishExpandedPath" } ], "repeated": 0, "id": 3544 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{31C0DD25-9439-4F12-BF41-7FF4EDA38722}\\DefinitionFlags" } ], "repeated": 0, "id": 3545 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{31C0DD25-9439-4F12-BF41-7FF4EDA38722}\\Attributes" } ], "repeated": 0, "id": 3546 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "Data", "value": "{b3690e58-e961-423b-b687-386ebfd83239}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{31C0DD25-9439-4F12-BF41-7FF4EDA38722}\\FolderTypeID" } ], "repeated": 0, "id": 3547 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{31C0DD25-9439-4F12-BF41-7FF4EDA38722}\\InitFolderHandler" } ], "repeated": 0, "id": 3548 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000003b8" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{31C0DD25-9439-4F12-BF41-7FF4EDA38722}\\PropertyBag" } ], "repeated": 0, "id": 3549 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b8" } ], "repeated": 0, "id": 3550 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" } ], "repeated": 0, "id": 3551 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 3552 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 3553 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000003b8" } ], "repeated": 0, "id": 3554 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3555 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "`\\xa7\\xec\\x11l\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3556 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000002e4" }, { "name": "SubKey", "value": "SessionInfo\\1" }, { "name": "Handle", "value": "0x000003ac" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1" } ], "repeated": 0, "id": 3557 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000003ac" }, { "name": "SubKey", "value": "KnownFolders" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1\\KnownFolders" } ], "repeated": 0, "id": 3558 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" } ], "repeated": 0, "id": 3559 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xa3\\xec\\x11l\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x80\\xac\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3560 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003ac" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 3561 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003ac" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" }, { "name": "Handle", "value": "0x000003bc" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" } ], "repeated": 0, "id": 3562 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" } ], "repeated": 0, "id": 3563 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003bc" }, { "name": "ValueName", "value": "{31C0DD25-9439-4F12-BF41-7FF4EDA38722}" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\{31C0DD25-9439-4F12-BF41-7FF4EDA38722}" } ], "repeated": 0, "id": 3564 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000003ac" } ], "repeated": 0, "id": 3565 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x00\\xe4?\\xc0\\xf5\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3566 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "Handle", "value": "0x000003c0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 3567 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "ProfileImagePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath" } ], "repeated": 0, "id": 3568 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "ProfileImagePath" }, { "name": "Data", "value": "C:\\Users\\admin" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath" } ], "repeated": 0, "id": 3569 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003c0" } ], "repeated": 0, "id": 3570 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" } ], "repeated": 0, "id": 3571 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b8" } ], "repeated": 0, "id": 3572 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003bc" } ], "repeated": 0, "id": 3573 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000003bc" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 3574 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003bc" }, { "name": "SubKey", "value": "{6F0CD92B-2E97-45D1-88FF-B0D186B8DEDD}" }, { "name": "Handle", "value": "0x000003b8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{6F0CD92B-2E97-45D1-88FF-B0D186B8DEDD}" } ], "repeated": 0, "id": 3575 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003bc" } ], "repeated": 0, "id": 3576 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{6F0CD92B-2E97-45D1-88FF-B0D186B8DEDD}\\Category" } ], "repeated": 0, "id": 3577 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "ConnectionsFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{6F0CD92B-2E97-45D1-88FF-B0D186B8DEDD}\\Name" } ], "repeated": 0, "id": 3578 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{6F0CD92B-2E97-45D1-88FF-B0D186B8DEDD}\\ParentFolder" } ], "repeated": 0, "id": 3579 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{6F0CD92B-2E97-45D1-88FF-B0D186B8DEDD}\\Description" } ], "repeated": 0, "id": 3580 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{6F0CD92B-2E97-45D1-88FF-B0D186B8DEDD}\\RelativePath" } ], "repeated": 0, "id": 3581 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "Data", "value": "::{26EE0668-A00A-44D7-9371-BEB064C98683}\\0\\::{7007ACC7-3202-11D1-AAD2-00805FC1270E}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{6F0CD92B-2E97-45D1-88FF-B0D186B8DEDD}\\ParsingName" } ], "repeated": 0, "id": 3582 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{6F0CD92B-2E97-45D1-88FF-B0D186B8DEDD}\\InfoTip" } ], "repeated": 0, "id": 3583 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{6F0CD92B-2E97-45D1-88FF-B0D186B8DEDD}\\LocalizedName" } ], "repeated": 0, "id": 3584 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{6F0CD92B-2E97-45D1-88FF-B0D186B8DEDD}\\Icon" } ], "repeated": 0, "id": 3585 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{6F0CD92B-2E97-45D1-88FF-B0D186B8DEDD}\\Security" } ], "repeated": 0, "id": 3586 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{6F0CD92B-2E97-45D1-88FF-B0D186B8DEDD}\\StreamResource" } ], "repeated": 0, "id": 3587 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{6F0CD92B-2E97-45D1-88FF-B0D186B8DEDD}\\StreamResourceType" } ], "repeated": 0, "id": 3588 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{6F0CD92B-2E97-45D1-88FF-B0D186B8DEDD}\\LocalRedirectOnly" } ], "repeated": 0, "id": 3589 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{6F0CD92B-2E97-45D1-88FF-B0D186B8DEDD}\\Roamable" } ], "repeated": 0, "id": 3590 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{6F0CD92B-2E97-45D1-88FF-B0D186B8DEDD}\\PreCreate" } ], "repeated": 0, "id": 3591 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{6F0CD92B-2E97-45D1-88FF-B0D186B8DEDD}\\Stream" } ], "repeated": 0, "id": 3592 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{6F0CD92B-2E97-45D1-88FF-B0D186B8DEDD}\\PublishExpandedPath" } ], "repeated": 0, "id": 3593 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{6F0CD92B-2E97-45D1-88FF-B0D186B8DEDD}\\DefinitionFlags" } ], "repeated": 0, "id": 3594 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{6F0CD92B-2E97-45D1-88FF-B0D186B8DEDD}\\Attributes" } ], "repeated": 0, "id": 3595 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{6F0CD92B-2E97-45D1-88FF-B0D186B8DEDD}\\FolderTypeID" } ], "repeated": 0, "id": 3596 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{6F0CD92B-2E97-45D1-88FF-B0D186B8DEDD}\\InitFolderHandler" } ], "repeated": 0, "id": 3597 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000003b8" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{6F0CD92B-2E97-45D1-88FF-B0D186B8DEDD}\\PropertyBag" } ], "repeated": 0, "id": 3598 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b8" } ], "repeated": 0, "id": 3599 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000003b8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 3600 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003b8" }, { "name": "SubKey", "value": "{76FC4E2D-D6AD-4519-A663-37BD56068185}" }, { "name": "Handle", "value": "0x00000394" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{76FC4E2D-D6AD-4519-A663-37BD56068185}" } ], "repeated": 0, "id": 3601 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b8" } ], "repeated": 0, "id": 3602 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000394" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{76FC4E2D-D6AD-4519-A663-37BD56068185}\\Category" } ], "repeated": 0, "id": 3603 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000394" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "PrintersFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{76FC4E2D-D6AD-4519-A663-37BD56068185}\\Name" } ], "repeated": 0, "id": 3604 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000394" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{76FC4E2D-D6AD-4519-A663-37BD56068185}\\ParentFolder" } ], "repeated": 0, "id": 3605 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000394" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{76FC4E2D-D6AD-4519-A663-37BD56068185}\\Description" } ], "repeated": 0, "id": 3606 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000394" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{76FC4E2D-D6AD-4519-A663-37BD56068185}\\RelativePath" } ], "repeated": 0, "id": 3607 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000394" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "Data", "value": "::{21EC2020-3AEA-1069-A2DD-08002B30309D}\\::{2227A280-3AEA-1069-A2DE-08002B30309D}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{76FC4E2D-D6AD-4519-A663-37BD56068185}\\ParsingName" } ], "repeated": 0, "id": 3608 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000394" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{76FC4E2D-D6AD-4519-A663-37BD56068185}\\InfoTip" } ], "repeated": 0, "id": 3609 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000394" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{76FC4E2D-D6AD-4519-A663-37BD56068185}\\LocalizedName" } ], "repeated": 0, "id": 3610 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000394" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{76FC4E2D-D6AD-4519-A663-37BD56068185}\\Icon" } ], "repeated": 0, "id": 3611 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000394" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{76FC4E2D-D6AD-4519-A663-37BD56068185}\\Security" } ], "repeated": 0, "id": 3612 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000394" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{76FC4E2D-D6AD-4519-A663-37BD56068185}\\StreamResource" } ], "repeated": 0, "id": 3613 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000394" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{76FC4E2D-D6AD-4519-A663-37BD56068185}\\StreamResourceType" } ], "repeated": 0, "id": 3614 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000394" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{76FC4E2D-D6AD-4519-A663-37BD56068185}\\LocalRedirectOnly" } ], "repeated": 0, "id": 3615 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000394" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{76FC4E2D-D6AD-4519-A663-37BD56068185}\\Roamable" } ], "repeated": 0, "id": 3616 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000394" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{76FC4E2D-D6AD-4519-A663-37BD56068185}\\PreCreate" } ], "repeated": 0, "id": 3617 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000394" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{76FC4E2D-D6AD-4519-A663-37BD56068185}\\Stream" } ], "repeated": 0, "id": 3618 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000394" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{76FC4E2D-D6AD-4519-A663-37BD56068185}\\PublishExpandedPath" } ], "repeated": 0, "id": 3619 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000394" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{76FC4E2D-D6AD-4519-A663-37BD56068185}\\DefinitionFlags" } ], "repeated": 0, "id": 3620 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000394" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{76FC4E2D-D6AD-4519-A663-37BD56068185}\\Attributes" } ], "repeated": 0, "id": 3621 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000394" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{76FC4E2D-D6AD-4519-A663-37BD56068185}\\FolderTypeID" } ], "repeated": 0, "id": 3622 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000394" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{76FC4E2D-D6AD-4519-A663-37BD56068185}\\InitFolderHandler" } ], "repeated": 0, "id": 3623 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000394" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{76FC4E2D-D6AD-4519-A663-37BD56068185}\\PropertyBag" } ], "repeated": 0, "id": 3624 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000394" } ], "repeated": 0, "id": 3625 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x00000394" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 3626 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000394" }, { "name": "SubKey", "value": "{491E922F-5643-4AF4-A7EB-4E7A138D8174}" }, { "name": "Handle", "value": "0x000003b8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{491E922F-5643-4AF4-A7EB-4E7A138D8174}" } ], "repeated": 0, "id": 3627 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000394" } ], "repeated": 0, "id": 3628 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{491E922F-5643-4af4-A7EB-4E7A138D8174}\\Category" } ], "repeated": 0, "id": 3629 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "VideosLibrary" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{491E922F-5643-4af4-A7EB-4E7A138D8174}\\Name" } ], "repeated": 0, "id": 3630 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "Data", "value": "{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{491E922F-5643-4af4-A7EB-4E7A138D8174}\\ParentFolder" } ], "repeated": 0, "id": 3631 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{491E922F-5643-4af4-A7EB-4E7A138D8174}\\Description" } ], "repeated": 0, "id": 3632 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "Videos.library-ms" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{491E922F-5643-4af4-A7EB-4E7A138D8174}\\RelativePath" } ], "repeated": 0, "id": 3633 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "Data", "value": "::{031E4825-7B94-4dc3-B131-E946B44C8DD5}\\{491E922F-5643-4af4-A7EB-4E7A138D8174}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{491E922F-5643-4af4-A7EB-4E7A138D8174}\\ParsingName" } ], "repeated": 0, "id": 3634 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "Data", "value": "@%SystemRoot%\\system32\\shell32.dll,-12690" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{491E922F-5643-4af4-A7EB-4E7A138D8174}\\InfoTip" } ], "repeated": 0, "id": 3635 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "Data", "value": "@%SystemRoot%\\system32\\windows.storage.dll,-34620" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{491E922F-5643-4af4-A7EB-4E7A138D8174}\\LocalizedName" } ], "repeated": 0, "id": 3636 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "Icon" }, { "name": "Data", "value": "%SystemRoot%\\system32\\imageres.dll,-1005" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{491E922F-5643-4af4-A7EB-4E7A138D8174}\\Icon" } ], "repeated": 0, "id": 3637 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{491E922F-5643-4af4-A7EB-4E7A138D8174}\\Security" } ], "repeated": 0, "id": 3638 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "Data", "value": "%SystemRoot%\\system32\\shell32.dll,-4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{491E922F-5643-4af4-A7EB-4E7A138D8174}\\StreamResource" } ], "repeated": 0, "id": 3639 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "Data", "value": "LIBRARY" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{491E922F-5643-4af4-A7EB-4E7A138D8174}\\StreamResourceType" } ], "repeated": 0, "id": 3640 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{491E922F-5643-4af4-A7EB-4E7A138D8174}\\LocalRedirectOnly" } ], "repeated": 0, "id": 3641 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{491E922F-5643-4af4-A7EB-4E7A138D8174}\\Roamable" } ], "repeated": 0, "id": 3642 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{491E922F-5643-4af4-A7EB-4E7A138D8174}\\PreCreate" } ], "repeated": 0, "id": 3643 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "Stream" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{491E922F-5643-4af4-A7EB-4E7A138D8174}\\Stream" } ], "repeated": 0, "id": 3644 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{491E922F-5643-4af4-A7EB-4E7A138D8174}\\PublishExpandedPath" } ], "repeated": 0, "id": 3645 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{491E922F-5643-4af4-A7EB-4E7A138D8174}\\DefinitionFlags" } ], "repeated": 0, "id": 3646 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{491E922F-5643-4af4-A7EB-4E7A138D8174}\\Attributes" } ], "repeated": 0, "id": 3647 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{491E922F-5643-4af4-A7EB-4E7A138D8174}\\FolderTypeID" } ], "repeated": 0, "id": 3648 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{491E922F-5643-4af4-A7EB-4E7A138D8174}\\InitFolderHandler" } ], "repeated": 0, "id": 3649 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003b8" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000394" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{491E922F-5643-4af4-A7EB-4E7A138D8174}\\PropertyBag" } ], "repeated": 0, "id": 3650 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b8" } ], "repeated": 0, "id": 3651 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000003b8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 3652 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003b8" }, { "name": "SubKey", "value": "{33E28130-4E1E-4676-835A-98395C3BC3BB}" }, { "name": "Handle", "value": "0x0000039c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{33E28130-4E1E-4676-835A-98395C3BC3BB}" } ], "repeated": 0, "id": 3653 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b8" } ], "repeated": 0, "id": 3654 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{33E28130-4E1E-4676-835A-98395C3BC3BB}\\Category" } ], "repeated": 0, "id": 3655 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "My Pictures" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{33E28130-4E1E-4676-835A-98395C3BC3BB}\\Name" } ], "repeated": 0, "id": 3656 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{33E28130-4E1E-4676-835A-98395C3BC3BB}\\ParentFolder" } ], "repeated": 0, "id": 3657 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{33E28130-4E1E-4676-835A-98395C3BC3BB}\\Description" } ], "repeated": 0, "id": 3658 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "Pictures" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{33E28130-4E1E-4676-835A-98395C3BC3BB}\\RelativePath" } ], "repeated": 0, "id": 3659 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "Data", "value": "shell:::{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\::{3ADD1653-EB32-4CB0-BBD7-DFA0ABB5ACCA}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{33E28130-4E1E-4676-835A-98395C3BC3BB}\\ParsingName" } ], "repeated": 0, "id": 3660 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "Data", "value": "@%SystemRoot%\\system32\\shell32.dll,-12688" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{33E28130-4E1E-4676-835A-98395C3BC3BB}\\InfoTip" } ], "repeated": 0, "id": 3661 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "Data", "value": "@%SystemRoot%\\system32\\windows.storage.dll,-21779" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{33E28130-4E1E-4676-835A-98395C3BC3BB}\\LocalizedName" } ], "repeated": 0, "id": 3662 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "Icon" }, { "name": "Data", "value": "%SystemRoot%\\system32\\imageres.dll,-113" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{33E28130-4E1E-4676-835A-98395C3BC3BB}\\Icon" } ], "repeated": 0, "id": 3663 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{33E28130-4E1E-4676-835A-98395C3BC3BB}\\Security" } ], "repeated": 0, "id": 3664 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{33E28130-4E1E-4676-835A-98395C3BC3BB}\\StreamResource" } ], "repeated": 0, "id": 3665 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{33E28130-4E1E-4676-835A-98395C3BC3BB}\\StreamResourceType" } ], "repeated": 0, "id": 3666 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{33E28130-4E1E-4676-835A-98395C3BC3BB}\\LocalRedirectOnly" } ], "repeated": 0, "id": 3667 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "Roamable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{33E28130-4E1E-4676-835A-98395C3BC3BB}\\Roamable" } ], "repeated": 0, "id": 3668 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{33E28130-4E1E-4676-835A-98395C3BC3BB}\\PreCreate" } ], "repeated": 0, "id": 3669 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{33E28130-4E1E-4676-835A-98395C3BC3BB}\\Stream" } ], "repeated": 0, "id": 3670 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{33E28130-4E1E-4676-835A-98395C3BC3BB}\\PublishExpandedPath" } ], "repeated": 0, "id": 3671 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{33E28130-4E1E-4676-835A-98395C3BC3BB}\\DefinitionFlags" } ], "repeated": 0, "id": 3672 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "Attributes" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{33E28130-4E1E-4676-835A-98395C3BC3BB}\\Attributes" } ], "repeated": 0, "id": 3673 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{33E28130-4E1E-4676-835A-98395C3BC3BB}\\FolderTypeID" } ], "repeated": 0, "id": 3674 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{33E28130-4E1E-4676-835A-98395C3BC3BB}\\InitFolderHandler" } ], "repeated": 0, "id": 3675 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000039c" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x000003c4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{33E28130-4E1E-4676-835A-98395C3BC3BB}\\PropertyBag" } ], "repeated": 0, "id": 3676 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000039c" } ], "repeated": 0, "id": 3677 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003c4" }, { "name": "ValueName", "value": "ThisPCPolicy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{33E28130-4E1E-4676-835A-98395C3BC3BB}\\PropertyBag\\ThisPCPolicy" } ], "repeated": 0, "id": 3678 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003c4" }, { "name": "ValueName", "value": "ThisPCPolicy" }, { "name": "Data", "value": "Hide" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{33E28130-4E1E-4676-835A-98395C3BC3BB}\\PropertyBag\\ThisPCPolicy" } ], "repeated": 0, "id": 3679 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000039c" } ], "repeated": 0, "id": 3680 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3681 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000039c" } ], "repeated": 0, "id": 3682 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x10\\xc9\\xec\\x11l\\x00\\x00\\x00\\x00\\x00\\x00\\x00l\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00l\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00<\\x00\\x00\\x00\\x00\\x00\\x00\\x00L\\xea?\\xc0\\xf5\\x01\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3683 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000039c" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 3684 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000039c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3685 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000039c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 3686 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x0000000c" }, { "name": "TokenHandle", "value": "0x000003c8" } ], "repeated": 0, "id": 3687 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" }, { "name": "Handle", "value": "0x000003cc" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" } ], "repeated": 0, "id": 3688 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003cc" }, { "name": "ValueName", "value": "RDVirtualizationPool" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\RDVirtualizationPool" } ], "repeated": 0, "id": 3689 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003cc" } ], "repeated": 0, "id": 3690 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" }, { "name": "Handle", "value": "0x000003cc" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" } ], "repeated": 0, "id": 3691 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003cc" }, { "name": "ValueName", "value": "RDVirtualizationPool" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\RDVirtualizationPool" } ], "repeated": 0, "id": 3692 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003cc" } ], "repeated": 0, "id": 3693 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x90\\xc9\\xec\\x11l\\x00\\x00\\x00\\x00\\x00\\x00\\x00l\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xa0\\xbd}\\x1a\\xff\\x7f\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xf8\\x81}\\x1a" } ], "repeated": 0, "id": 3694 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\fdeploy" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\fdeploy" } ], "repeated": 0, "id": 3695 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003c8" } ], "repeated": 0, "id": 3696 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000039c" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" }, { "name": "Handle", "value": "0x000003c8" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" } ], "repeated": 0, "id": 3697 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003c8" } ], "repeated": 0, "id": 3698 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000039c" } ], "repeated": 0, "id": 3699 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x0000039c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 3700 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000039c" }, { "name": "SubKey", "value": "{8AD10C31-2ADB-4296-A8F7-E4701232C972}" }, { "name": "Handle", "value": "0x000003c8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{8AD10C31-2ADB-4296-A8F7-E4701232C972}" } ], "repeated": 0, "id": 3701 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000039c" } ], "repeated": 0, "id": 3702 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003c8" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{8AD10C31-2ADB-4296-A8F7-E4701232C972}\\Category" } ], "repeated": 0, "id": 3703 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003c8" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "ResourceDir" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{8AD10C31-2ADB-4296-A8F7-E4701232C972}\\Name" } ], "repeated": 0, "id": 3704 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c8" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{8AD10C31-2ADB-4296-A8F7-E4701232C972}\\ParentFolder" } ], "repeated": 0, "id": 3705 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c8" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{8AD10C31-2ADB-4296-A8F7-E4701232C972}\\Description" } ], "repeated": 0, "id": 3706 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c8" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{8AD10C31-2ADB-4296-A8F7-E4701232C972}\\RelativePath" } ], "repeated": 0, "id": 3707 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c8" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{8AD10C31-2ADB-4296-A8F7-E4701232C972}\\ParsingName" } ], "repeated": 0, "id": 3708 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c8" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{8AD10C31-2ADB-4296-A8F7-E4701232C972}\\InfoTip" } ], "repeated": 0, "id": 3709 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c8" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{8AD10C31-2ADB-4296-A8F7-E4701232C972}\\LocalizedName" } ], "repeated": 0, "id": 3710 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c8" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{8AD10C31-2ADB-4296-A8F7-E4701232C972}\\Icon" } ], "repeated": 0, "id": 3711 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c8" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{8AD10C31-2ADB-4296-A8F7-E4701232C972}\\Security" } ], "repeated": 0, "id": 3712 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c8" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{8AD10C31-2ADB-4296-A8F7-E4701232C972}\\StreamResource" } ], "repeated": 0, "id": 3713 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c8" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{8AD10C31-2ADB-4296-A8F7-E4701232C972}\\StreamResourceType" } ], "repeated": 0, "id": 3714 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c8" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{8AD10C31-2ADB-4296-A8F7-E4701232C972}\\LocalRedirectOnly" } ], "repeated": 0, "id": 3715 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c8" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{8AD10C31-2ADB-4296-A8F7-E4701232C972}\\Roamable" } ], "repeated": 0, "id": 3716 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c8" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{8AD10C31-2ADB-4296-A8F7-E4701232C972}\\PreCreate" } ], "repeated": 0, "id": 3717 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c8" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{8AD10C31-2ADB-4296-A8F7-E4701232C972}\\Stream" } ], "repeated": 0, "id": 3718 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c8" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{8AD10C31-2ADB-4296-A8F7-E4701232C972}\\PublishExpandedPath" } ], "repeated": 0, "id": 3719 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c8" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{8AD10C31-2ADB-4296-A8F7-E4701232C972}\\DefinitionFlags" } ], "repeated": 0, "id": 3720 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c8" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{8AD10C31-2ADB-4296-A8F7-E4701232C972}\\Attributes" } ], "repeated": 0, "id": 3721 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c8" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{8AD10C31-2ADB-4296-A8F7-E4701232C972}\\FolderTypeID" } ], "repeated": 0, "id": 3722 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c8" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{8AD10C31-2ADB-4296-A8F7-E4701232C972}\\InitFolderHandler" } ], "repeated": 0, "id": 3723 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000003c8" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{8AD10C31-2ADB-4296-A8F7-E4701232C972}\\PropertyBag" } ], "repeated": 0, "id": 3724 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003c8" } ], "repeated": 0, "id": 3725 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000003c8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 3726 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003c8" }, { "name": "SubKey", "value": "{DEBF2536-E1A8-4C59-B6A2-414586476AEA}" }, { "name": "Handle", "value": "0x0000039c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DEBF2536-E1A8-4C59-B6A2-414586476AEA}" } ], "repeated": 0, "id": 3727 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003c8" } ], "repeated": 0, "id": 3728 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "3" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DEBF2536-E1A8-4c59-B6A2-414586476AEA}\\Category" } ], "repeated": 0, "id": 3729 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "PublicGameTasks" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DEBF2536-E1A8-4c59-B6A2-414586476AEA}\\Name" } ], "repeated": 0, "id": 3730 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "Data", "value": "{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DEBF2536-E1A8-4c59-B6A2-414586476AEA}\\ParentFolder" } ], "repeated": 0, "id": 3731 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DEBF2536-E1A8-4c59-B6A2-414586476AEA}\\Description" } ], "repeated": 0, "id": 3732 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "Microsoft\\Windows\\GameExplorer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DEBF2536-E1A8-4c59-B6A2-414586476AEA}\\RelativePath" } ], "repeated": 0, "id": 3733 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DEBF2536-E1A8-4c59-B6A2-414586476AEA}\\ParsingName" } ], "repeated": 0, "id": 3734 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DEBF2536-E1A8-4c59-B6A2-414586476AEA}\\InfoTip" } ], "repeated": 0, "id": 3735 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DEBF2536-E1A8-4c59-B6A2-414586476AEA}\\LocalizedName" } ], "repeated": 0, "id": 3736 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DEBF2536-E1A8-4c59-B6A2-414586476AEA}\\Icon" } ], "repeated": 0, "id": 3737 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DEBF2536-E1A8-4c59-B6A2-414586476AEA}\\Security" } ], "repeated": 0, "id": 3738 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DEBF2536-E1A8-4c59-B6A2-414586476AEA}\\StreamResource" } ], "repeated": 0, "id": 3739 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DEBF2536-E1A8-4c59-B6A2-414586476AEA}\\StreamResourceType" } ], "repeated": 0, "id": 3740 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DEBF2536-E1A8-4c59-B6A2-414586476AEA}\\LocalRedirectOnly" } ], "repeated": 0, "id": 3741 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DEBF2536-E1A8-4c59-B6A2-414586476AEA}\\Roamable" } ], "repeated": 0, "id": 3742 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DEBF2536-E1A8-4c59-B6A2-414586476AEA}\\PreCreate" } ], "repeated": 0, "id": 3743 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DEBF2536-E1A8-4c59-B6A2-414586476AEA}\\Stream" } ], "repeated": 0, "id": 3744 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DEBF2536-E1A8-4c59-B6A2-414586476AEA}\\PublishExpandedPath" } ], "repeated": 0, "id": 3745 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DEBF2536-E1A8-4c59-B6A2-414586476AEA}\\DefinitionFlags" } ], "repeated": 0, "id": 3746 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DEBF2536-E1A8-4c59-B6A2-414586476AEA}\\Attributes" } ], "repeated": 0, "id": 3747 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DEBF2536-E1A8-4c59-B6A2-414586476AEA}\\FolderTypeID" } ], "repeated": 0, "id": 3748 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DEBF2536-E1A8-4c59-B6A2-414586476AEA}\\InitFolderHandler" } ], "repeated": 0, "id": 3749 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x0000039c" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DEBF2536-E1A8-4c59-B6A2-414586476AEA}\\PropertyBag" } ], "repeated": 0, "id": 3750 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000039c" } ], "repeated": 0, "id": 3751 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x0000039c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 3752 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000039c" }, { "name": "SubKey", "value": "{0F214138-B1D3-4A90-BBA9-27CBC0C5389A}" }, { "name": "Handle", "value": "0x000003bc" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0F214138-B1D3-4A90-BBA9-27CBC0C5389A}" } ], "repeated": 0, "id": 3753 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000039c" } ], "repeated": 0, "id": 3754 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003bc" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0F214138-B1D3-4a90-BBA9-27CBC0C5389A}\\Category" } ], "repeated": 0, "id": 3755 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003bc" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "SyncSetupFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0F214138-B1D3-4a90-BBA9-27CBC0C5389A}\\Name" } ], "repeated": 0, "id": 3756 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003bc" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0F214138-B1D3-4a90-BBA9-27CBC0C5389A}\\ParentFolder" } ], "repeated": 0, "id": 3757 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003bc" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0F214138-B1D3-4a90-BBA9-27CBC0C5389A}\\Description" } ], "repeated": 0, "id": 3758 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003bc" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0F214138-B1D3-4a90-BBA9-27CBC0C5389A}\\RelativePath" } ], "repeated": 0, "id": 3759 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003bc" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "Data", "value": "::{26EE0668-A00A-44D7-9371-BEB064C98683}\\0\\::{9C73F5E5-7AE7-4E32-A8E8-8D23B85255BF}\\::{F1390A9A-A3F4-4E5D-9C5F-98F3BD8D935C}," }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0F214138-B1D3-4a90-BBA9-27CBC0C5389A}\\ParsingName" } ], "repeated": 0, "id": 3760 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003bc" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0F214138-B1D3-4a90-BBA9-27CBC0C5389A}\\InfoTip" } ], "repeated": 0, "id": 3761 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003bc" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0F214138-B1D3-4a90-BBA9-27CBC0C5389A}\\LocalizedName" } ], "repeated": 0, "id": 3762 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003bc" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0F214138-B1D3-4a90-BBA9-27CBC0C5389A}\\Icon" } ], "repeated": 0, "id": 3763 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003bc" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0F214138-B1D3-4a90-BBA9-27CBC0C5389A}\\Security" } ], "repeated": 0, "id": 3764 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003bc" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0F214138-B1D3-4a90-BBA9-27CBC0C5389A}\\StreamResource" } ], "repeated": 0, "id": 3765 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003bc" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0F214138-B1D3-4a90-BBA9-27CBC0C5389A}\\StreamResourceType" } ], "repeated": 0, "id": 3766 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003bc" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0F214138-B1D3-4a90-BBA9-27CBC0C5389A}\\LocalRedirectOnly" } ], "repeated": 0, "id": 3767 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003bc" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0F214138-B1D3-4a90-BBA9-27CBC0C5389A}\\Roamable" } ], "repeated": 0, "id": 3768 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003bc" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0F214138-B1D3-4a90-BBA9-27CBC0C5389A}\\PreCreate" } ], "repeated": 0, "id": 3769 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003bc" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0F214138-B1D3-4a90-BBA9-27CBC0C5389A}\\Stream" } ], "repeated": 0, "id": 3770 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003bc" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0F214138-B1D3-4a90-BBA9-27CBC0C5389A}\\PublishExpandedPath" } ], "repeated": 0, "id": 3771 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003bc" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0F214138-B1D3-4a90-BBA9-27CBC0C5389A}\\DefinitionFlags" } ], "repeated": 0, "id": 3772 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003bc" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0F214138-B1D3-4a90-BBA9-27CBC0C5389A}\\Attributes" } ], "repeated": 0, "id": 3773 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003bc" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0F214138-B1D3-4a90-BBA9-27CBC0C5389A}\\FolderTypeID" } ], "repeated": 0, "id": 3774 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003bc" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0F214138-B1D3-4a90-BBA9-27CBC0C5389A}\\InitFolderHandler" } ], "repeated": 0, "id": 3775 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000003bc" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0F214138-B1D3-4a90-BBA9-27CBC0C5389A}\\PropertyBag" } ], "repeated": 0, "id": 3776 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003bc" } ], "repeated": 0, "id": 3777 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000003bc" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 3778 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003bc" }, { "name": "SubKey", "value": "{2400183A-6185-49FB-A2D8-4A392A602BA3}" }, { "name": "Handle", "value": "0x0000039c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2400183A-6185-49FB-A2D8-4A392A602BA3}" } ], "repeated": 0, "id": 3779 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003bc" } ], "repeated": 0, "id": 3780 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "3" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2400183A-6185-49FB-A2D8-4A392A602BA3}\\Category" } ], "repeated": 0, "id": 3781 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "CommonVideo" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2400183A-6185-49FB-A2D8-4A392A602BA3}\\Name" } ], "repeated": 0, "id": 3782 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "Data", "value": "{DFDF76A2-C82A-4D63-906A-5644AC457385}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2400183A-6185-49FB-A2D8-4A392A602BA3}\\ParentFolder" } ], "repeated": 0, "id": 3783 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2400183A-6185-49FB-A2D8-4A392A602BA3}\\Description" } ], "repeated": 0, "id": 3784 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "Videos" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2400183A-6185-49FB-A2D8-4A392A602BA3}\\RelativePath" } ], "repeated": 0, "id": 3785 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2400183A-6185-49FB-A2D8-4A392A602BA3}\\ParsingName" } ], "repeated": 0, "id": 3786 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "Data", "value": "@%SystemRoot%\\system32\\shell32.dll,-12690" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2400183A-6185-49FB-A2D8-4A392A602BA3}\\InfoTip" } ], "repeated": 0, "id": 3787 }, { "timestamp": "2026-05-29 01:05:17,696", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "Data", "value": "@%SystemRoot%\\system32\\shell32.dll,-21804" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2400183A-6185-49FB-A2D8-4A392A602BA3}\\LocalizedName" } ], "repeated": 0, "id": 3788 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "Icon" }, { "name": "Data", "value": "%SystemRoot%\\system32\\imageres.dll,-3" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2400183A-6185-49FB-A2D8-4A392A602BA3}\\Icon" } ], "repeated": 0, "id": 3789 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2400183A-6185-49FB-A2D8-4A392A602BA3}\\Security" } ], "repeated": 0, "id": 3790 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2400183A-6185-49FB-A2D8-4A392A602BA3}\\StreamResource" } ], "repeated": 0, "id": 3791 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2400183A-6185-49FB-A2D8-4A392A602BA3}\\StreamResourceType" } ], "repeated": 0, "id": 3792 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2400183A-6185-49FB-A2D8-4A392A602BA3}\\LocalRedirectOnly" } ], "repeated": 0, "id": 3793 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2400183A-6185-49FB-A2D8-4A392A602BA3}\\Roamable" } ], "repeated": 0, "id": 3794 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2400183A-6185-49FB-A2D8-4A392A602BA3}\\PreCreate" } ], "repeated": 0, "id": 3795 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2400183A-6185-49FB-A2D8-4A392A602BA3}\\Stream" } ], "repeated": 0, "id": 3796 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2400183A-6185-49FB-A2D8-4A392A602BA3}\\PublishExpandedPath" } ], "repeated": 0, "id": 3797 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2400183A-6185-49FB-A2D8-4A392A602BA3}\\DefinitionFlags" } ], "repeated": 0, "id": 3798 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "Attributes" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2400183A-6185-49FB-A2D8-4A392A602BA3}\\Attributes" } ], "repeated": 0, "id": 3799 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2400183A-6185-49FB-A2D8-4A392A602BA3}\\FolderTypeID" } ], "repeated": 0, "id": 3800 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2400183A-6185-49FB-A2D8-4A392A602BA3}\\InitFolderHandler" } ], "repeated": 0, "id": 3801 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000039c" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x000003bc" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2400183A-6185-49FB-A2D8-4A392A602BA3}\\PropertyBag" } ], "repeated": 0, "id": 3802 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000039c" } ], "repeated": 0, "id": 3803 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1f5c0408000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3804 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000037c" }, { "name": "ValueName", "value": "ThisPCPolicy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\\PropertyBag\\ThisPCPolicy" } ], "repeated": 0, "id": 3805 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" } ], "repeated": 0, "id": 3806 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 3807 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 3808 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x0000039c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 3809 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000039c" }, { "name": "SubKey", "value": "{D9DC8A3B-B784-432E-A781-5A1130A75963}" }, { "name": "Handle", "value": "0x000003ac" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D9DC8A3B-B784-432E-A781-5A1130A75963}" } ], "repeated": 0, "id": 3810 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000039c" } ], "repeated": 0, "id": 3811 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D9DC8A3B-B784-432E-A781-5A1130A75963}\\Category" } ], "repeated": 0, "id": 3812 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "History" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D9DC8A3B-B784-432E-A781-5A1130A75963}\\Name" } ], "repeated": 0, "id": 3813 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "Data", "value": "{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D9DC8A3B-B784-432E-A781-5A1130A75963}\\ParentFolder" } ], "repeated": 0, "id": 3814 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D9DC8A3B-B784-432E-A781-5A1130A75963}\\Description" } ], "repeated": 0, "id": 3815 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "Microsoft\\Windows\\History" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D9DC8A3B-B784-432E-A781-5A1130A75963}\\RelativePath" } ], "repeated": 0, "id": 3816 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D9DC8A3B-B784-432E-A781-5A1130A75963}\\ParsingName" } ], "repeated": 0, "id": 3817 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D9DC8A3B-B784-432E-A781-5A1130A75963}\\InfoTip" } ], "repeated": 0, "id": 3818 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D9DC8A3B-B784-432E-A781-5A1130A75963}\\LocalizedName" } ], "repeated": 0, "id": 3819 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D9DC8A3B-B784-432E-A781-5A1130A75963}\\Icon" } ], "repeated": 0, "id": 3820 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D9DC8A3B-B784-432E-A781-5A1130A75963}\\Security" } ], "repeated": 0, "id": 3821 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D9DC8A3B-B784-432E-A781-5A1130A75963}\\StreamResource" } ], "repeated": 0, "id": 3822 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D9DC8A3B-B784-432E-A781-5A1130A75963}\\StreamResourceType" } ], "repeated": 0, "id": 3823 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D9DC8A3B-B784-432E-A781-5A1130A75963}\\LocalRedirectOnly" } ], "repeated": 0, "id": 3824 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D9DC8A3B-B784-432E-A781-5A1130A75963}\\Roamable" } ], "repeated": 0, "id": 3825 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D9DC8A3B-B784-432E-A781-5A1130A75963}\\PreCreate" } ], "repeated": 0, "id": 3826 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D9DC8A3B-B784-432E-A781-5A1130A75963}\\Stream" } ], "repeated": 0, "id": 3827 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D9DC8A3B-B784-432E-A781-5A1130A75963}\\PublishExpandedPath" } ], "repeated": 0, "id": 3828 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D9DC8A3B-B784-432E-A781-5A1130A75963}\\DefinitionFlags" } ], "repeated": 0, "id": 3829 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D9DC8A3B-B784-432E-A781-5A1130A75963}\\Attributes" } ], "repeated": 0, "id": 3830 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D9DC8A3B-B784-432E-A781-5A1130A75963}\\FolderTypeID" } ], "repeated": 0, "id": 3831 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D9DC8A3B-B784-432E-A781-5A1130A75963}\\InitFolderHandler" } ], "repeated": 0, "id": 3832 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000003ac" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D9DC8A3B-B784-432E-A781-5A1130A75963}\\PropertyBag" } ], "repeated": 0, "id": 3833 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" } ], "repeated": 0, "id": 3834 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000003ac" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 3835 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000003ac" }, { "name": "SubKey", "value": "{C4900540-2379-4C75-844B-64E6FAF8716B}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C4900540-2379-4C75-844B-64E6FAF8716B}" } ], "repeated": 0, "id": 3836 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" } ], "repeated": 0, "id": 3837 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000003ac" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 3838 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003ac" }, { "name": "SubKey", "value": "{289A9A43-BE44-4057-A41B-587A76D7E7F9}" }, { "name": "Handle", "value": "0x0000039c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{289A9A43-BE44-4057-A41B-587A76D7E7F9}" } ], "repeated": 0, "id": 3839 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" } ], "repeated": 0, "id": 3840 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{289A9A43-BE44-4057-A41B-587A76D7E7F9}\\Category" } ], "repeated": 0, "id": 3841 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "SyncResultsFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{289A9A43-BE44-4057-A41B-587A76D7E7F9}\\Name" } ], "repeated": 0, "id": 3842 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{289A9A43-BE44-4057-A41B-587A76D7E7F9}\\ParentFolder" } ], "repeated": 0, "id": 3843 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{289A9A43-BE44-4057-A41B-587A76D7E7F9}\\Description" } ], "repeated": 0, "id": 3844 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{289A9A43-BE44-4057-A41B-587A76D7E7F9}\\RelativePath" } ], "repeated": 0, "id": 3845 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "Data", "value": "::{26EE0668-A00A-44D7-9371-BEB064C98683}\\0\\::{9C73F5E5-7AE7-4E32-A8E8-8D23B85255BF}\\::{BC48B32F-5910-47F5-8570-5074A8A5636A}," }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{289A9A43-BE44-4057-A41B-587A76D7E7F9}\\ParsingName" } ], "repeated": 0, "id": 3846 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{289A9A43-BE44-4057-A41B-587A76D7E7F9}\\InfoTip" } ], "repeated": 0, "id": 3847 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{289A9A43-BE44-4057-A41B-587A76D7E7F9}\\LocalizedName" } ], "repeated": 0, "id": 3848 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{289A9A43-BE44-4057-A41B-587A76D7E7F9}\\Icon" } ], "repeated": 0, "id": 3849 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{289A9A43-BE44-4057-A41B-587A76D7E7F9}\\Security" } ], "repeated": 0, "id": 3850 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{289A9A43-BE44-4057-A41B-587A76D7E7F9}\\StreamResource" } ], "repeated": 0, "id": 3851 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{289A9A43-BE44-4057-A41B-587A76D7E7F9}\\StreamResourceType" } ], "repeated": 0, "id": 3852 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{289A9A43-BE44-4057-A41B-587A76D7E7F9}\\LocalRedirectOnly" } ], "repeated": 0, "id": 3853 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{289A9A43-BE44-4057-A41B-587A76D7E7F9}\\Roamable" } ], "repeated": 0, "id": 3854 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{289A9A43-BE44-4057-A41B-587A76D7E7F9}\\PreCreate" } ], "repeated": 0, "id": 3855 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{289A9A43-BE44-4057-A41B-587A76D7E7F9}\\Stream" } ], "repeated": 0, "id": 3856 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{289A9A43-BE44-4057-A41B-587A76D7E7F9}\\PublishExpandedPath" } ], "repeated": 0, "id": 3857 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{289A9A43-BE44-4057-A41B-587A76D7E7F9}\\DefinitionFlags" } ], "repeated": 0, "id": 3858 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{289A9A43-BE44-4057-A41B-587A76D7E7F9}\\Attributes" } ], "repeated": 0, "id": 3859 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{289A9A43-BE44-4057-A41B-587A76D7E7F9}\\FolderTypeID" } ], "repeated": 0, "id": 3860 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{289A9A43-BE44-4057-A41B-587A76D7E7F9}\\InitFolderHandler" } ], "repeated": 0, "id": 3861 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x0000039c" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{289A9A43-BE44-4057-A41B-587A76D7E7F9}\\PropertyBag" } ], "repeated": 0, "id": 3862 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000039c" } ], "repeated": 0, "id": 3863 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x0000039c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 3864 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000039c" }, { "name": "SubKey", "value": "{4BFEFB45-347D-4006-A5BE-AC0CB0567192}" }, { "name": "Handle", "value": "0x000003ac" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4BFEFB45-347D-4006-A5BE-AC0CB0567192}" } ], "repeated": 0, "id": 3865 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000039c" } ], "repeated": 0, "id": 3866 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4BFEFB45-347D-4006-A5BE-AC0CB0567192}\\Category" } ], "repeated": 0, "id": 3867 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "ConflictFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4BFEFB45-347D-4006-A5BE-AC0CB0567192}\\Name" } ], "repeated": 0, "id": 3868 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4BFEFB45-347D-4006-A5BE-AC0CB0567192}\\ParentFolder" } ], "repeated": 0, "id": 3869 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4BFEFB45-347D-4006-A5BE-AC0CB0567192}\\Description" } ], "repeated": 0, "id": 3870 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4BFEFB45-347D-4006-A5BE-AC0CB0567192}\\RelativePath" } ], "repeated": 0, "id": 3871 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "Data", "value": "::{26EE0668-A00A-44D7-9371-BEB064C98683}\\0\\::{9C73F5E5-7AE7-4E32-A8E8-8D23B85255BF}\\::{E413D040-6788-4C22-957E-175D1C513A34}," }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4BFEFB45-347D-4006-A5BE-AC0CB0567192}\\ParsingName" } ], "repeated": 0, "id": 3872 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4BFEFB45-347D-4006-A5BE-AC0CB0567192}\\InfoTip" } ], "repeated": 0, "id": 3873 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4BFEFB45-347D-4006-A5BE-AC0CB0567192}\\LocalizedName" } ], "repeated": 0, "id": 3874 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4BFEFB45-347D-4006-A5BE-AC0CB0567192}\\Icon" } ], "repeated": 0, "id": 3875 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4BFEFB45-347D-4006-A5BE-AC0CB0567192}\\Security" } ], "repeated": 0, "id": 3876 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4BFEFB45-347D-4006-A5BE-AC0CB0567192}\\StreamResource" } ], "repeated": 0, "id": 3877 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4BFEFB45-347D-4006-A5BE-AC0CB0567192}\\StreamResourceType" } ], "repeated": 0, "id": 3878 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4BFEFB45-347D-4006-A5BE-AC0CB0567192}\\LocalRedirectOnly" } ], "repeated": 0, "id": 3879 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4BFEFB45-347D-4006-A5BE-AC0CB0567192}\\Roamable" } ], "repeated": 0, "id": 3880 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4BFEFB45-347D-4006-A5BE-AC0CB0567192}\\PreCreate" } ], "repeated": 0, "id": 3881 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4BFEFB45-347D-4006-A5BE-AC0CB0567192}\\Stream" } ], "repeated": 0, "id": 3882 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4BFEFB45-347D-4006-A5BE-AC0CB0567192}\\PublishExpandedPath" } ], "repeated": 0, "id": 3883 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4BFEFB45-347D-4006-A5BE-AC0CB0567192}\\DefinitionFlags" } ], "repeated": 0, "id": 3884 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4BFEFB45-347D-4006-A5BE-AC0CB0567192}\\Attributes" } ], "repeated": 0, "id": 3885 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4BFEFB45-347D-4006-A5BE-AC0CB0567192}\\FolderTypeID" } ], "repeated": 0, "id": 3886 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4BFEFB45-347D-4006-A5BE-AC0CB0567192}\\InitFolderHandler" } ], "repeated": 0, "id": 3887 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000003ac" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4BFEFB45-347D-4006-A5BE-AC0CB0567192}\\PropertyBag" } ], "repeated": 0, "id": 3888 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" } ], "repeated": 0, "id": 3889 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000003ac" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 3890 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003ac" }, { "name": "SubKey", "value": "{B7534046-3ECB-4C18-BE4E-64CD4CB7D6AC}" }, { "name": "Handle", "value": "0x0000039c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B7534046-3ECB-4C18-BE4E-64CD4CB7D6AC}" } ], "repeated": 0, "id": 3891 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" } ], "repeated": 0, "id": 3892 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B7534046-3ECB-4C18-BE4E-64CD4CB7D6AC}\\Category" } ], "repeated": 0, "id": 3893 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "RecycleBinFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B7534046-3ECB-4C18-BE4E-64CD4CB7D6AC}\\Name" } ], "repeated": 0, "id": 3894 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B7534046-3ECB-4C18-BE4E-64CD4CB7D6AC}\\ParentFolder" } ], "repeated": 0, "id": 3895 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B7534046-3ECB-4C18-BE4E-64CD4CB7D6AC}\\Description" } ], "repeated": 0, "id": 3896 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B7534046-3ECB-4C18-BE4E-64CD4CB7D6AC}\\RelativePath" } ], "repeated": 0, "id": 3897 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "Data", "value": "::{645FF040-5081-101B-9F08-00AA002F954E}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B7534046-3ECB-4C18-BE4E-64CD4CB7D6AC}\\ParsingName" } ], "repeated": 0, "id": 3898 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B7534046-3ECB-4C18-BE4E-64CD4CB7D6AC}\\InfoTip" } ], "repeated": 0, "id": 3899 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B7534046-3ECB-4C18-BE4E-64CD4CB7D6AC}\\LocalizedName" } ], "repeated": 0, "id": 3900 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B7534046-3ECB-4C18-BE4E-64CD4CB7D6AC}\\Icon" } ], "repeated": 0, "id": 3901 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B7534046-3ECB-4C18-BE4E-64CD4CB7D6AC}\\Security" } ], "repeated": 0, "id": 3902 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B7534046-3ECB-4C18-BE4E-64CD4CB7D6AC}\\StreamResource" } ], "repeated": 0, "id": 3903 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B7534046-3ECB-4C18-BE4E-64CD4CB7D6AC}\\StreamResourceType" } ], "repeated": 0, "id": 3904 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B7534046-3ECB-4C18-BE4E-64CD4CB7D6AC}\\LocalRedirectOnly" } ], "repeated": 0, "id": 3905 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B7534046-3ECB-4C18-BE4E-64CD4CB7D6AC}\\Roamable" } ], "repeated": 0, "id": 3906 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B7534046-3ECB-4C18-BE4E-64CD4CB7D6AC}\\PreCreate" } ], "repeated": 0, "id": 3907 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B7534046-3ECB-4C18-BE4E-64CD4CB7D6AC}\\Stream" } ], "repeated": 0, "id": 3908 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B7534046-3ECB-4C18-BE4E-64CD4CB7D6AC}\\PublishExpandedPath" } ], "repeated": 0, "id": 3909 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B7534046-3ECB-4C18-BE4E-64CD4CB7D6AC}\\DefinitionFlags" } ], "repeated": 0, "id": 3910 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B7534046-3ECB-4C18-BE4E-64CD4CB7D6AC}\\Attributes" } ], "repeated": 0, "id": 3911 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B7534046-3ECB-4C18-BE4E-64CD4CB7D6AC}\\FolderTypeID" } ], "repeated": 0, "id": 3912 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B7534046-3ECB-4C18-BE4E-64CD4CB7D6AC}\\InitFolderHandler" } ], "repeated": 0, "id": 3913 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x0000039c" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B7534046-3ECB-4C18-BE4E-64CD4CB7D6AC}\\PropertyBag" } ], "repeated": 0, "id": 3914 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000039c" } ], "repeated": 0, "id": 3915 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1f5c040a000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3916 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" } ], "repeated": 0, "id": 3917 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 3918 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 3919 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x0000039c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 3920 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000039c" }, { "name": "SubKey", "value": "{EE32E446-31CA-4ABA-814F-A5EBD2FD6D5E}" }, { "name": "Handle", "value": "0x000003ac" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{EE32E446-31CA-4ABA-814F-A5EBD2FD6D5E}" } ], "repeated": 0, "id": 3921 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000039c" } ], "repeated": 0, "id": 3922 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{EE32E446-31CA-4ABA-814F-A5EBD2FD6D5E}\\Category" } ], "repeated": 0, "id": 3923 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "CSCFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{EE32E446-31CA-4ABA-814F-A5EBD2FD6D5E}\\Name" } ], "repeated": 0, "id": 3924 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{EE32E446-31CA-4ABA-814F-A5EBD2FD6D5E}\\ParentFolder" } ], "repeated": 0, "id": 3925 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{EE32E446-31CA-4ABA-814F-A5EBD2FD6D5E}\\Description" } ], "repeated": 0, "id": 3926 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{EE32E446-31CA-4ABA-814F-A5EBD2FD6D5E}\\RelativePath" } ], "repeated": 0, "id": 3927 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "Data", "value": "shell:::{BD7A2E7B-21CB-41b2-A086-B309680C6B7E}\\*" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{EE32E446-31CA-4ABA-814F-A5EBD2FD6D5E}\\ParsingName" } ], "repeated": 0, "id": 3928 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{EE32E446-31CA-4ABA-814F-A5EBD2FD6D5E}\\InfoTip" } ], "repeated": 0, "id": 3929 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{EE32E446-31CA-4ABA-814F-A5EBD2FD6D5E}\\LocalizedName" } ], "repeated": 0, "id": 3930 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{EE32E446-31CA-4ABA-814F-A5EBD2FD6D5E}\\Icon" } ], "repeated": 0, "id": 3931 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{EE32E446-31CA-4ABA-814F-A5EBD2FD6D5E}\\Security" } ], "repeated": 0, "id": 3932 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{EE32E446-31CA-4ABA-814F-A5EBD2FD6D5E}\\StreamResource" } ], "repeated": 0, "id": 3933 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{EE32E446-31CA-4ABA-814F-A5EBD2FD6D5E}\\StreamResourceType" } ], "repeated": 0, "id": 3934 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{EE32E446-31CA-4ABA-814F-A5EBD2FD6D5E}\\LocalRedirectOnly" } ], "repeated": 0, "id": 3935 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{EE32E446-31CA-4ABA-814F-A5EBD2FD6D5E}\\Roamable" } ], "repeated": 0, "id": 3936 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{EE32E446-31CA-4ABA-814F-A5EBD2FD6D5E}\\PreCreate" } ], "repeated": 0, "id": 3937 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{EE32E446-31CA-4ABA-814F-A5EBD2FD6D5E}\\Stream" } ], "repeated": 0, "id": 3938 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{EE32E446-31CA-4ABA-814F-A5EBD2FD6D5E}\\PublishExpandedPath" } ], "repeated": 0, "id": 3939 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{EE32E446-31CA-4ABA-814F-A5EBD2FD6D5E}\\DefinitionFlags" } ], "repeated": 0, "id": 3940 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{EE32E446-31CA-4ABA-814F-A5EBD2FD6D5E}\\Attributes" } ], "repeated": 0, "id": 3941 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{EE32E446-31CA-4ABA-814F-A5EBD2FD6D5E}\\FolderTypeID" } ], "repeated": 0, "id": 3942 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{EE32E446-31CA-4ABA-814F-A5EBD2FD6D5E}\\InitFolderHandler" } ], "repeated": 0, "id": 3943 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000003ac" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{EE32E446-31CA-4ABA-814F-A5EBD2FD6D5E}\\PropertyBag" } ], "repeated": 0, "id": 3944 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" } ], "repeated": 0, "id": 3945 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000003ac" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 3946 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003ac" }, { "name": "SubKey", "value": "{C870044B-F49E-4126-A9C3-B52A1FF411E8}" }, { "name": "Handle", "value": "0x0000039c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C870044B-F49E-4126-A9C3-B52A1FF411E8}" } ], "repeated": 0, "id": 3947 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" } ], "repeated": 0, "id": 3948 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C870044B-F49E-4126-A9C3-B52A1FF411E8}\\Category" } ], "repeated": 0, "id": 3949 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "Ringtones" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C870044B-F49E-4126-A9C3-B52A1FF411E8}\\Name" } ], "repeated": 0, "id": 3950 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "Data", "value": "{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C870044B-F49E-4126-A9C3-B52A1FF411E8}\\ParentFolder" } ], "repeated": 0, "id": 3951 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C870044B-F49E-4126-A9C3-B52A1FF411E8}\\Description" } ], "repeated": 0, "id": 3952 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "Microsoft\\Windows\\Ringtones" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C870044B-F49E-4126-A9C3-B52A1FF411E8}\\RelativePath" } ], "repeated": 0, "id": 3953 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C870044B-F49E-4126-A9C3-B52A1FF411E8}\\ParsingName" } ], "repeated": 0, "id": 3954 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C870044B-F49E-4126-A9C3-B52A1FF411E8}\\InfoTip" } ], "repeated": 0, "id": 3955 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C870044B-F49E-4126-A9C3-B52A1FF411E8}\\LocalizedName" } ], "repeated": 0, "id": 3956 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C870044B-F49E-4126-A9C3-B52A1FF411E8}\\Icon" } ], "repeated": 0, "id": 3957 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C870044B-F49E-4126-A9C3-B52A1FF411E8}\\Security" } ], "repeated": 0, "id": 3958 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C870044B-F49E-4126-A9C3-B52A1FF411E8}\\StreamResource" } ], "repeated": 0, "id": 3959 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C870044B-F49E-4126-A9C3-B52A1FF411E8}\\StreamResourceType" } ], "repeated": 0, "id": 3960 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C870044B-F49E-4126-A9C3-B52A1FF411E8}\\LocalRedirectOnly" } ], "repeated": 0, "id": 3961 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C870044B-F49E-4126-A9C3-B52A1FF411E8}\\Roamable" } ], "repeated": 0, "id": 3962 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C870044B-F49E-4126-A9C3-B52A1FF411E8}\\PreCreate" } ], "repeated": 0, "id": 3963 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C870044B-F49E-4126-A9C3-B52A1FF411E8}\\Stream" } ], "repeated": 0, "id": 3964 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C870044B-F49E-4126-A9C3-B52A1FF411E8}\\PublishExpandedPath" } ], "repeated": 0, "id": 3965 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C870044B-F49E-4126-A9C3-B52A1FF411E8}\\DefinitionFlags" } ], "repeated": 0, "id": 3966 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C870044B-F49E-4126-A9C3-B52A1FF411E8}\\Attributes" } ], "repeated": 0, "id": 3967 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C870044B-F49E-4126-A9C3-B52A1FF411E8}\\FolderTypeID" } ], "repeated": 0, "id": 3968 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C870044B-F49E-4126-A9C3-B52A1FF411E8}\\InitFolderHandler" } ], "repeated": 0, "id": 3969 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x0000039c" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C870044B-F49E-4126-A9C3-B52A1FF411E8}\\PropertyBag" } ], "repeated": 0, "id": 3970 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000039c" } ], "repeated": 0, "id": 3971 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x0000039c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 3972 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000039c" }, { "name": "SubKey", "value": "{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}" }, { "name": "Handle", "value": "0x000003ac" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}" } ], "repeated": 0, "id": 3973 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000039c" } ], "repeated": 0, "id": 3974 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "3" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\\Category" } ], "repeated": 0, "id": 3975 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "Common Programs" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\\Name" } ], "repeated": 0, "id": 3976 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "Data", "value": "{A4115719-D62E-491D-AA7C-E74B8BE3B067}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\\ParentFolder" } ], "repeated": 0, "id": 3977 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\\Description" } ], "repeated": 0, "id": 3978 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "Programs" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\\RelativePath" } ], "repeated": 0, "id": 3979 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\\ParsingName" } ], "repeated": 0, "id": 3980 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\\InfoTip" } ], "repeated": 0, "id": 3981 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "Data", "value": "@%SystemRoot%\\system32\\shell32.dll,-21782" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\\LocalizedName" } ], "repeated": 0, "id": 3982 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\\Icon" } ], "repeated": 0, "id": 3983 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\\Security" } ], "repeated": 0, "id": 3984 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\\StreamResource" } ], "repeated": 0, "id": 3985 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\\StreamResourceType" } ], "repeated": 0, "id": 3986 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\\LocalRedirectOnly" } ], "repeated": 0, "id": 3987 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\\Roamable" } ], "repeated": 0, "id": 3988 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\\PreCreate" } ], "repeated": 0, "id": 3989 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\\Stream" } ], "repeated": 0, "id": 3990 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\\PublishExpandedPath" } ], "repeated": 0, "id": 3991 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\\DefinitionFlags" } ], "repeated": 0, "id": 3992 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Attributes" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\\Attributes" } ], "repeated": 0, "id": 3993 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\\FolderTypeID" } ], "repeated": 0, "id": 3994 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\\InitFolderHandler" } ], "repeated": 0, "id": 3995 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000003ac" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\\PropertyBag" } ], "repeated": 0, "id": 3996 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" } ], "repeated": 0, "id": 3997 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000003ac" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 3998 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003ac" }, { "name": "SubKey", "value": "{C5ABBF53-E17F-4121-8900-86626FC2C973}" }, { "name": "Handle", "value": "0x0000039c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C5ABBF53-E17F-4121-8900-86626FC2C973}" } ], "repeated": 0, "id": 3999 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" } ], "repeated": 0, "id": 4000 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C5ABBF53-E17F-4121-8900-86626FC2C973}\\Category" } ], "repeated": 0, "id": 4001 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "NetHood" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C5ABBF53-E17F-4121-8900-86626FC2C973}\\Name" } ], "repeated": 0, "id": 4002 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "Data", "value": "{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C5ABBF53-E17F-4121-8900-86626FC2C973}\\ParentFolder" } ], "repeated": 0, "id": 4003 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C5ABBF53-E17F-4121-8900-86626FC2C973}\\Description" } ], "repeated": 0, "id": 4004 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "Microsoft\\Windows\\Network Shortcuts" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C5ABBF53-E17F-4121-8900-86626FC2C973}\\RelativePath" } ], "repeated": 0, "id": 4005 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C5ABBF53-E17F-4121-8900-86626FC2C973}\\ParsingName" } ], "repeated": 0, "id": 4006 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C5ABBF53-E17F-4121-8900-86626FC2C973}\\InfoTip" } ], "repeated": 0, "id": 4007 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C5ABBF53-E17F-4121-8900-86626FC2C973}\\LocalizedName" } ], "repeated": 0, "id": 4008 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C5ABBF53-E17F-4121-8900-86626FC2C973}\\Icon" } ], "repeated": 0, "id": 4009 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C5ABBF53-E17F-4121-8900-86626FC2C973}\\Security" } ], "repeated": 0, "id": 4010 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C5ABBF53-E17F-4121-8900-86626FC2C973}\\StreamResource" } ], "repeated": 0, "id": 4011 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C5ABBF53-E17F-4121-8900-86626FC2C973}\\StreamResourceType" } ], "repeated": 0, "id": 4012 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C5ABBF53-E17F-4121-8900-86626FC2C973}\\LocalRedirectOnly" } ], "repeated": 0, "id": 4013 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C5ABBF53-E17F-4121-8900-86626FC2C973}\\Roamable" } ], "repeated": 0, "id": 4014 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C5ABBF53-E17F-4121-8900-86626FC2C973}\\PreCreate" } ], "repeated": 0, "id": 4015 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C5ABBF53-E17F-4121-8900-86626FC2C973}\\Stream" } ], "repeated": 0, "id": 4016 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C5ABBF53-E17F-4121-8900-86626FC2C973}\\PublishExpandedPath" } ], "repeated": 0, "id": 4017 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C5ABBF53-E17F-4121-8900-86626FC2C973}\\DefinitionFlags" } ], "repeated": 0, "id": 4018 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C5ABBF53-E17F-4121-8900-86626FC2C973}\\Attributes" } ], "repeated": 0, "id": 4019 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C5ABBF53-E17F-4121-8900-86626FC2C973}\\FolderTypeID" } ], "repeated": 0, "id": 4020 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C5ABBF53-E17F-4121-8900-86626FC2C973}\\InitFolderHandler" } ], "repeated": 0, "id": 4021 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x0000039c" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C5ABBF53-E17F-4121-8900-86626FC2C973}\\PropertyBag" } ], "repeated": 0, "id": 4022 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000039c" } ], "repeated": 0, "id": 4023 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x0000039c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 4024 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000039c" }, { "name": "SubKey", "value": "{56784854-C6CB-462B-8169-88E350ACB882}" }, { "name": "Handle", "value": "0x000003ac" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{56784854-C6CB-462B-8169-88E350ACB882}" } ], "repeated": 0, "id": 4025 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000039c" } ], "repeated": 0, "id": 4026 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{56784854-C6CB-462B-8169-88E350ACB882}\\Category" } ], "repeated": 0, "id": 4027 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "Contacts" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{56784854-C6CB-462B-8169-88E350ACB882}\\Name" } ], "repeated": 0, "id": 4028 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{56784854-C6CB-462B-8169-88E350ACB882}\\ParentFolder" } ], "repeated": 0, "id": 4029 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{56784854-C6CB-462B-8169-88E350ACB882}\\Description" } ], "repeated": 0, "id": 4030 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "Contacts" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{56784854-C6CB-462B-8169-88E350ACB882}\\RelativePath" } ], "repeated": 0, "id": 4031 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "Data", "value": "::{59031a47-3f72-44a7-89c5-5595fe6b30ee}\\{56784854-C6CB-462B-8169-88E350ACB882}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{56784854-C6CB-462B-8169-88E350ACB882}\\ParsingName" } ], "repeated": 0, "id": 4032 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "Data", "value": "@%CommonProgramFiles%\\system\\wab32res.dll,-10200" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{56784854-C6CB-462B-8169-88E350ACB882}\\InfoTip" } ], "repeated": 0, "id": 4033 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "Data", "value": "@%CommonProgramFiles%\\system\\wab32res.dll,-10100" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{56784854-C6CB-462B-8169-88E350ACB882}\\LocalizedName" } ], "repeated": 0, "id": 4034 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Icon" }, { "name": "Data", "value": "%SystemRoot%\\system32\\imageres.dll,-181" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{56784854-C6CB-462B-8169-88E350ACB882}\\Icon" } ], "repeated": 0, "id": 4035 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{56784854-C6CB-462B-8169-88E350ACB882}\\Security" } ], "repeated": 0, "id": 4036 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{56784854-C6CB-462B-8169-88E350ACB882}\\StreamResource" } ], "repeated": 0, "id": 4037 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{56784854-C6CB-462B-8169-88E350ACB882}\\StreamResourceType" } ], "repeated": 0, "id": 4038 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{56784854-C6CB-462B-8169-88E350ACB882}\\LocalRedirectOnly" } ], "repeated": 0, "id": 4039 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Roamable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{56784854-C6CB-462B-8169-88E350ACB882}\\Roamable" } ], "repeated": 0, "id": 4040 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{56784854-C6CB-462B-8169-88E350ACB882}\\PreCreate" } ], "repeated": 0, "id": 4041 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{56784854-C6CB-462B-8169-88E350ACB882}\\Stream" } ], "repeated": 0, "id": 4042 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{56784854-C6CB-462B-8169-88E350ACB882}\\PublishExpandedPath" } ], "repeated": 0, "id": 4043 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{56784854-C6CB-462B-8169-88E350ACB882}\\DefinitionFlags" } ], "repeated": 0, "id": 4044 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Attributes" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{56784854-C6CB-462B-8169-88E350ACB882}\\Attributes" } ], "repeated": 0, "id": 4045 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "Data", "value": "{de2b70ec-9bf7-4a93-bd3d-243f7881d492}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{56784854-C6CB-462B-8169-88E350ACB882}\\FolderTypeID" } ], "repeated": 0, "id": 4046 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{56784854-C6CB-462B-8169-88E350ACB882}\\InitFolderHandler" } ], "repeated": 0, "id": 4047 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003ac" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x0000039c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{56784854-C6CB-462B-8169-88E350ACB882}\\PropertyBag" } ], "repeated": 0, "id": 4048 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" } ], "repeated": 0, "id": 4049 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000039c" }, { "name": "ValueName", "value": "ThisPCPolicy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{56784854-C6CB-462B-8169-88E350ACB882}\\PropertyBag\\ThisPCPolicy" } ], "repeated": 0, "id": 4050 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" } ], "repeated": 0, "id": 4051 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 4052 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 4053 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000003ac" } ], "repeated": 0, "id": 4054 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4055 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "`\\xa7\\xec\\x11l\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4056 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000002e4" }, { "name": "SubKey", "value": "SessionInfo\\1" }, { "name": "Handle", "value": "0x000003c8" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1" } ], "repeated": 0, "id": 4057 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000003c8" }, { "name": "SubKey", "value": "KnownFolders" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1\\KnownFolders" } ], "repeated": 0, "id": 4058 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003c8" } ], "repeated": 0, "id": 4059 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xa3\\xec\\x11l\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x80\\xc8\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4060 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003c8" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 4061 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003c8" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" }, { "name": "Handle", "value": "0x000003b8" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" } ], "repeated": 0, "id": 4062 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003c8" } ], "repeated": 0, "id": 4063 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "{56784854-C6CB-462B-8169-88E350ACB882}" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\{56784854-C6CB-462B-8169-88E350ACB882}" } ], "repeated": 0, "id": 4064 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000003c8" } ], "repeated": 0, "id": 4065 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xf0\\xe4?\\xc0\\xf5\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4066 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "Handle", "value": "0x000003c0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 4067 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "ProfileImagePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath" } ], "repeated": 0, "id": 4068 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "ProfileImagePath" }, { "name": "Data", "value": "C:\\Users\\admin" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath" } ], "repeated": 0, "id": 4069 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003c0" } ], "repeated": 0, "id": 4070 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003c8" } ], "repeated": 0, "id": 4071 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" } ], "repeated": 0, "id": 4072 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b8" } ], "repeated": 0, "id": 4073 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000003b8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 4074 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003b8" }, { "name": "SubKey", "value": "{BCBD3057-CA5C-4622-B42D-BC56DB0AE516}" }, { "name": "Handle", "value": "0x000003ac" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{BCBD3057-CA5C-4622-B42D-BC56DB0AE516}" } ], "repeated": 0, "id": 4075 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b8" } ], "repeated": 0, "id": 4076 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{bcbd3057-ca5c-4622-b42d-bc56db0ae516}\\Category" } ], "repeated": 0, "id": 4077 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "UserProgramFilesCommon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{bcbd3057-ca5c-4622-b42d-bc56db0ae516}\\Name" } ], "repeated": 0, "id": 4078 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "Data", "value": "{5cd7aee2-2219-4a67-b85d-6c9ce15660cb}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{bcbd3057-ca5c-4622-b42d-bc56db0ae516}\\ParentFolder" } ], "repeated": 0, "id": 4079 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{bcbd3057-ca5c-4622-b42d-bc56db0ae516}\\Description" } ], "repeated": 0, "id": 4080 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "Common" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{bcbd3057-ca5c-4622-b42d-bc56db0ae516}\\RelativePath" } ], "repeated": 0, "id": 4081 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{bcbd3057-ca5c-4622-b42d-bc56db0ae516}\\ParsingName" } ], "repeated": 0, "id": 4082 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{bcbd3057-ca5c-4622-b42d-bc56db0ae516}\\InfoTip" } ], "repeated": 0, "id": 4083 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{bcbd3057-ca5c-4622-b42d-bc56db0ae516}\\LocalizedName" } ], "repeated": 0, "id": 4084 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{bcbd3057-ca5c-4622-b42d-bc56db0ae516}\\Icon" } ], "repeated": 0, "id": 4085 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{bcbd3057-ca5c-4622-b42d-bc56db0ae516}\\Security" } ], "repeated": 0, "id": 4086 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{bcbd3057-ca5c-4622-b42d-bc56db0ae516}\\StreamResource" } ], "repeated": 0, "id": 4087 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{bcbd3057-ca5c-4622-b42d-bc56db0ae516}\\StreamResourceType" } ], "repeated": 0, "id": 4088 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{bcbd3057-ca5c-4622-b42d-bc56db0ae516}\\LocalRedirectOnly" } ], "repeated": 0, "id": 4089 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{bcbd3057-ca5c-4622-b42d-bc56db0ae516}\\Roamable" } ], "repeated": 0, "id": 4090 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{bcbd3057-ca5c-4622-b42d-bc56db0ae516}\\PreCreate" } ], "repeated": 0, "id": 4091 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{bcbd3057-ca5c-4622-b42d-bc56db0ae516}\\Stream" } ], "repeated": 0, "id": 4092 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{bcbd3057-ca5c-4622-b42d-bc56db0ae516}\\PublishExpandedPath" } ], "repeated": 0, "id": 4093 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{bcbd3057-ca5c-4622-b42d-bc56db0ae516}\\DefinitionFlags" } ], "repeated": 0, "id": 4094 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{bcbd3057-ca5c-4622-b42d-bc56db0ae516}\\Attributes" } ], "repeated": 0, "id": 4095 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{bcbd3057-ca5c-4622-b42d-bc56db0ae516}\\FolderTypeID" } ], "repeated": 0, "id": 4096 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{bcbd3057-ca5c-4622-b42d-bc56db0ae516}\\InitFolderHandler" } ], "repeated": 0, "id": 4097 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000003ac" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{bcbd3057-ca5c-4622-b42d-bc56db0ae516}\\PropertyBag" } ], "repeated": 0, "id": 4098 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" } ], "repeated": 0, "id": 4099 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000003ac" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 4100 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003ac" }, { "name": "SubKey", "value": "{00BCFC5A-ED94-4E48-96A1-3F6217F21990}" }, { "name": "Handle", "value": "0x000003cc" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{00BCFC5A-ED94-4E48-96A1-3F6217F21990}" } ], "repeated": 0, "id": 4101 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" } ], "repeated": 0, "id": 4102 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003cc" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{00BCFC5A-ED94-4e48-96A1-3F6217F21990}\\Category" } ], "repeated": 0, "id": 4103 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003cc" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "Roaming Tiles" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{00BCFC5A-ED94-4e48-96A1-3F6217F21990}\\Name" } ], "repeated": 0, "id": 4104 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003cc" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "Data", "value": "{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{00BCFC5A-ED94-4e48-96A1-3F6217F21990}\\ParentFolder" } ], "repeated": 0, "id": 4105 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003cc" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{00BCFC5A-ED94-4e48-96A1-3F6217F21990}\\Description" } ], "repeated": 0, "id": 4106 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003cc" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "Microsoft\\Windows\\RoamingTiles" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{00BCFC5A-ED94-4e48-96A1-3F6217F21990}\\RelativePath" } ], "repeated": 0, "id": 4107 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003cc" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{00BCFC5A-ED94-4e48-96A1-3F6217F21990}\\ParsingName" } ], "repeated": 0, "id": 4108 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003cc" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{00BCFC5A-ED94-4e48-96A1-3F6217F21990}\\InfoTip" } ], "repeated": 0, "id": 4109 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003cc" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{00BCFC5A-ED94-4e48-96A1-3F6217F21990}\\LocalizedName" } ], "repeated": 0, "id": 4110 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003cc" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{00BCFC5A-ED94-4e48-96A1-3F6217F21990}\\Icon" } ], "repeated": 0, "id": 4111 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003cc" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{00BCFC5A-ED94-4e48-96A1-3F6217F21990}\\Security" } ], "repeated": 0, "id": 4112 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003cc" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{00BCFC5A-ED94-4e48-96A1-3F6217F21990}\\StreamResource" } ], "repeated": 0, "id": 4113 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003cc" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{00BCFC5A-ED94-4e48-96A1-3F6217F21990}\\StreamResourceType" } ], "repeated": 0, "id": 4114 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003cc" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{00BCFC5A-ED94-4e48-96A1-3F6217F21990}\\LocalRedirectOnly" } ], "repeated": 0, "id": 4115 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003cc" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{00BCFC5A-ED94-4e48-96A1-3F6217F21990}\\Roamable" } ], "repeated": 0, "id": 4116 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003cc" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{00BCFC5A-ED94-4e48-96A1-3F6217F21990}\\PreCreate" } ], "repeated": 0, "id": 4117 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003cc" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{00BCFC5A-ED94-4e48-96A1-3F6217F21990}\\Stream" } ], "repeated": 0, "id": 4118 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003cc" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{00BCFC5A-ED94-4e48-96A1-3F6217F21990}\\PublishExpandedPath" } ], "repeated": 0, "id": 4119 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003cc" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{00BCFC5A-ED94-4e48-96A1-3F6217F21990}\\DefinitionFlags" } ], "repeated": 0, "id": 4120 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003cc" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{00BCFC5A-ED94-4e48-96A1-3F6217F21990}\\Attributes" } ], "repeated": 0, "id": 4121 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003cc" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{00BCFC5A-ED94-4e48-96A1-3F6217F21990}\\FolderTypeID" } ], "repeated": 0, "id": 4122 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003cc" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{00BCFC5A-ED94-4e48-96A1-3F6217F21990}\\InitFolderHandler" } ], "repeated": 0, "id": 4123 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000003cc" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{00BCFC5A-ED94-4e48-96A1-3F6217F21990}\\PropertyBag" } ], "repeated": 0, "id": 4124 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003cc" } ], "repeated": 0, "id": 4125 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000384" }, { "name": "ValueName", "value": "ThisPCPolicy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0ddd015d-b06c-45d5-8c4c-f59713854639}\\PropertyBag\\ThisPCPolicy" } ], "repeated": 0, "id": 4126 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000384" }, { "name": "ValueName", "value": "ThisPCPolicy" }, { "name": "Data", "value": "Show" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0ddd015d-b06c-45d5-8c4c-f59713854639}\\PropertyBag\\ThisPCPolicy" } ], "repeated": 0, "id": 4127 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000384" }, { "name": "ValueName", "value": "BaseFolderId" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0ddd015d-b06c-45d5-8c4c-f59713854639}\\PropertyBag\\BaseFolderId" } ], "repeated": 0, "id": 4128 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000384" }, { "name": "ValueName", "value": "BaseFolderId" }, { "name": "Data", "value": "{33E28130-4E1E-4676-835A-98395C3BC3BB}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0ddd015d-b06c-45d5-8c4c-f59713854639}\\PropertyBag\\BaseFolderId" } ], "repeated": 0, "id": 4129 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000003cc" } ], "repeated": 0, "id": 4130 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4131 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003cc" } ], "repeated": 0, "id": 4132 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x10\\xc9\\xec\\x11l\\x00\\x00\\x00\\x00\\x00\\x00\\x00l\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00l\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00<\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xbc\\xe3?\\xc0\\xf5\\x01\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4133 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003cc" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 4134 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003cc" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 4135 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000003cc" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 4136 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x0000000c" }, { "name": "TokenHandle", "value": "0x000003ac" } ], "repeated": 0, "id": 4137 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" }, { "name": "Handle", "value": "0x000003d0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" } ], "repeated": 0, "id": 4138 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "RDVirtualizationPool" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\RDVirtualizationPool" } ], "repeated": 0, "id": 4139 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d0" } ], "repeated": 0, "id": 4140 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" }, { "name": "Handle", "value": "0x000003d0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" } ], "repeated": 0, "id": 4141 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "RDVirtualizationPool" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\RDVirtualizationPool" } ], "repeated": 0, "id": 4142 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d0" } ], "repeated": 0, "id": 4143 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x90\\xc9\\xec\\x11l\\x00\\x00\\x00\\x00\\x00\\x00\\x00l\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xa0\\xbd}\\x1a\\xff\\x7f\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xf8\\x81}\\x1a" } ], "repeated": 0, "id": 4144 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\fdeploy" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\fdeploy" } ], "repeated": 0, "id": 4145 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" } ], "repeated": 0, "id": 4146 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003cc" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" }, { "name": "Handle", "value": "0x000003ac" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" } ], "repeated": 0, "id": 4147 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" } ], "repeated": 0, "id": 4148 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003cc" } ], "repeated": 0, "id": 4149 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" } ], "repeated": 0, "id": 4150 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 4151 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 4152 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000003cc" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 4153 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003cc" }, { "name": "SubKey", "value": "{A302545D-DEFF-464B-ABE8-61C8648D939B}" }, { "name": "Handle", "value": "0x000003ac" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A302545D-DEFF-464B-ABE8-61C8648D939B}" } ], "repeated": 0, "id": 4154 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003cc" } ], "repeated": 0, "id": 4155 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A302545D-DEFF-464b-ABE8-61C8648D939B}\\Category" } ], "repeated": 0, "id": 4156 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "UsersLibrariesFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A302545D-DEFF-464b-ABE8-61C8648D939B}\\Name" } ], "repeated": 0, "id": 4157 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A302545D-DEFF-464b-ABE8-61C8648D939B}\\ParentFolder" } ], "repeated": 0, "id": 4158 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A302545D-DEFF-464b-ABE8-61C8648D939B}\\Description" } ], "repeated": 0, "id": 4159 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A302545D-DEFF-464b-ABE8-61C8648D939B}\\RelativePath" } ], "repeated": 0, "id": 4160 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "Data", "value": "::{031E4825-7B94-4dc3-B131-E946B44C8DD5}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A302545D-DEFF-464b-ABE8-61C8648D939B}\\ParsingName" } ], "repeated": 0, "id": 4161 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A302545D-DEFF-464b-ABE8-61C8648D939B}\\InfoTip" } ], "repeated": 0, "id": 4162 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A302545D-DEFF-464b-ABE8-61C8648D939B}\\LocalizedName" } ], "repeated": 0, "id": 4163 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A302545D-DEFF-464b-ABE8-61C8648D939B}\\Icon" } ], "repeated": 0, "id": 4164 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A302545D-DEFF-464b-ABE8-61C8648D939B}\\Security" } ], "repeated": 0, "id": 4165 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A302545D-DEFF-464b-ABE8-61C8648D939B}\\StreamResource" } ], "repeated": 0, "id": 4166 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A302545D-DEFF-464b-ABE8-61C8648D939B}\\StreamResourceType" } ], "repeated": 0, "id": 4167 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A302545D-DEFF-464b-ABE8-61C8648D939B}\\LocalRedirectOnly" } ], "repeated": 0, "id": 4168 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A302545D-DEFF-464b-ABE8-61C8648D939B}\\Roamable" } ], "repeated": 0, "id": 4169 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A302545D-DEFF-464b-ABE8-61C8648D939B}\\PreCreate" } ], "repeated": 0, "id": 4170 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A302545D-DEFF-464b-ABE8-61C8648D939B}\\Stream" } ], "repeated": 0, "id": 4171 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A302545D-DEFF-464b-ABE8-61C8648D939B}\\PublishExpandedPath" } ], "repeated": 0, "id": 4172 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A302545D-DEFF-464b-ABE8-61C8648D939B}\\DefinitionFlags" } ], "repeated": 0, "id": 4173 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A302545D-DEFF-464b-ABE8-61C8648D939B}\\Attributes" } ], "repeated": 0, "id": 4174 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A302545D-DEFF-464b-ABE8-61C8648D939B}\\FolderTypeID" } ], "repeated": 0, "id": 4175 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A302545D-DEFF-464b-ABE8-61C8648D939B}\\InitFolderHandler" } ], "repeated": 0, "id": 4176 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003ac" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x000003cc" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A302545D-DEFF-464b-ABE8-61C8648D939B}\\PropertyBag" } ], "repeated": 0, "id": 4177 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" } ], "repeated": 0, "id": 4178 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000003ac" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 4179 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003ac" }, { "name": "SubKey", "value": "{2B0F765D-C0E9-4171-908E-08A611B84FF6}" }, { "name": "Handle", "value": "0x000003d0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2B0F765D-C0E9-4171-908E-08A611B84FF6}" } ], "repeated": 0, "id": 4180 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" } ], "repeated": 0, "id": 4181 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2B0F765D-C0E9-4171-908E-08A611B84FF6}\\Category" } ], "repeated": 0, "id": 4182 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "Cookies" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2B0F765D-C0E9-4171-908E-08A611B84FF6}\\Name" } ], "repeated": 0, "id": 4183 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "Data", "value": "{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2B0F765D-C0E9-4171-908E-08A611B84FF6}\\ParentFolder" } ], "repeated": 0, "id": 4184 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2B0F765D-C0E9-4171-908E-08A611B84FF6}\\Description" } ], "repeated": 0, "id": 4185 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "Microsoft\\Windows\\INetCookies" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2B0F765D-C0E9-4171-908E-08A611B84FF6}\\RelativePath" } ], "repeated": 0, "id": 4186 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2B0F765D-C0E9-4171-908E-08A611B84FF6}\\ParsingName" } ], "repeated": 0, "id": 4187 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2B0F765D-C0E9-4171-908E-08A611B84FF6}\\InfoTip" } ], "repeated": 0, "id": 4188 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2B0F765D-C0E9-4171-908E-08A611B84FF6}\\LocalizedName" } ], "repeated": 0, "id": 4189 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2B0F765D-C0E9-4171-908E-08A611B84FF6}\\Icon" } ], "repeated": 0, "id": 4190 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2B0F765D-C0E9-4171-908E-08A611B84FF6}\\Security" } ], "repeated": 0, "id": 4191 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2B0F765D-C0E9-4171-908E-08A611B84FF6}\\StreamResource" } ], "repeated": 0, "id": 4192 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2B0F765D-C0E9-4171-908E-08A611B84FF6}\\StreamResourceType" } ], "repeated": 0, "id": 4193 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2B0F765D-C0E9-4171-908E-08A611B84FF6}\\LocalRedirectOnly" } ], "repeated": 0, "id": 4194 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2B0F765D-C0E9-4171-908E-08A611B84FF6}\\Roamable" } ], "repeated": 0, "id": 4195 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2B0F765D-C0E9-4171-908E-08A611B84FF6}\\PreCreate" } ], "repeated": 0, "id": 4196 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2B0F765D-C0E9-4171-908E-08A611B84FF6}\\Stream" } ], "repeated": 0, "id": 4197 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2B0F765D-C0E9-4171-908E-08A611B84FF6}\\PublishExpandedPath" } ], "repeated": 0, "id": 4198 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2B0F765D-C0E9-4171-908E-08A611B84FF6}\\DefinitionFlags" } ], "repeated": 0, "id": 4199 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2B0F765D-C0E9-4171-908E-08A611B84FF6}\\Attributes" } ], "repeated": 0, "id": 4200 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2B0F765D-C0E9-4171-908E-08A611B84FF6}\\FolderTypeID" } ], "repeated": 0, "id": 4201 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2B0F765D-C0E9-4171-908E-08A611B84FF6}\\InitFolderHandler" } ], "repeated": 0, "id": 4202 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000003d0" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2B0F765D-C0E9-4171-908E-08A611B84FF6}\\PropertyBag" } ], "repeated": 0, "id": 4203 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d0" } ], "repeated": 0, "id": 4204 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000003d0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 4205 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003d0" }, { "name": "SubKey", "value": "{2A00375E-224C-49DE-B8D1-440DF7EF3DDC}" }, { "name": "Handle", "value": "0x000003ac" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2A00375E-224C-49DE-B8D1-440DF7EF3DDC}" } ], "repeated": 0, "id": 4206 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d0" } ], "repeated": 0, "id": 4207 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2A00375E-224C-49DE-B8D1-440DF7EF3DDC}\\Category" } ], "repeated": 0, "id": 4208 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "LocalizedResourcesDir" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2A00375E-224C-49DE-B8D1-440DF7EF3DDC}\\Name" } ], "repeated": 0, "id": 4209 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2A00375E-224C-49DE-B8D1-440DF7EF3DDC}\\ParentFolder" } ], "repeated": 0, "id": 4210 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2A00375E-224C-49DE-B8D1-440DF7EF3DDC}\\Description" } ], "repeated": 0, "id": 4211 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2A00375E-224C-49DE-B8D1-440DF7EF3DDC}\\RelativePath" } ], "repeated": 0, "id": 4212 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2A00375E-224C-49DE-B8D1-440DF7EF3DDC}\\ParsingName" } ], "repeated": 0, "id": 4213 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2A00375E-224C-49DE-B8D1-440DF7EF3DDC}\\InfoTip" } ], "repeated": 0, "id": 4214 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2A00375E-224C-49DE-B8D1-440DF7EF3DDC}\\LocalizedName" } ], "repeated": 0, "id": 4215 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2A00375E-224C-49DE-B8D1-440DF7EF3DDC}\\Icon" } ], "repeated": 0, "id": 4216 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2A00375E-224C-49DE-B8D1-440DF7EF3DDC}\\Security" } ], "repeated": 0, "id": 4217 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2A00375E-224C-49DE-B8D1-440DF7EF3DDC}\\StreamResource" } ], "repeated": 0, "id": 4218 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2A00375E-224C-49DE-B8D1-440DF7EF3DDC}\\StreamResourceType" } ], "repeated": 0, "id": 4219 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2A00375E-224C-49DE-B8D1-440DF7EF3DDC}\\LocalRedirectOnly" } ], "repeated": 0, "id": 4220 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2A00375E-224C-49DE-B8D1-440DF7EF3DDC}\\Roamable" } ], "repeated": 0, "id": 4221 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2A00375E-224C-49DE-B8D1-440DF7EF3DDC}\\PreCreate" } ], "repeated": 0, "id": 4222 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2A00375E-224C-49DE-B8D1-440DF7EF3DDC}\\Stream" } ], "repeated": 0, "id": 4223 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2A00375E-224C-49DE-B8D1-440DF7EF3DDC}\\PublishExpandedPath" } ], "repeated": 0, "id": 4224 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2A00375E-224C-49DE-B8D1-440DF7EF3DDC}\\DefinitionFlags" } ], "repeated": 0, "id": 4225 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2A00375E-224C-49DE-B8D1-440DF7EF3DDC}\\Attributes" } ], "repeated": 0, "id": 4226 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2A00375E-224C-49DE-B8D1-440DF7EF3DDC}\\FolderTypeID" } ], "repeated": 0, "id": 4227 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2A00375E-224C-49DE-B8D1-440DF7EF3DDC}\\InitFolderHandler" } ], "repeated": 0, "id": 4228 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000003ac" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2A00375E-224C-49DE-B8D1-440DF7EF3DDC}\\PropertyBag" } ], "repeated": 0, "id": 4229 }, { "timestamp": "2026-05-29 01:05:17,712", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" } ], "repeated": 0, "id": 4230 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000003ac" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 4231 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003ac" }, { "name": "SubKey", "value": "{E555AB60-153B-4D17-9F04-A5FE99FC15EC}" }, { "name": "Handle", "value": "0x000003d0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{E555AB60-153B-4D17-9F04-A5FE99FC15EC}" } ], "repeated": 0, "id": 4232 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" } ], "repeated": 0, "id": 4233 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "3" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{E555AB60-153B-4D17-9F04-A5FE99FC15EC}\\Category" } ], "repeated": 0, "id": 4234 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "CommonRingtones" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{E555AB60-153B-4D17-9F04-A5FE99FC15EC}\\Name" } ], "repeated": 0, "id": 4235 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "Data", "value": "{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{E555AB60-153B-4D17-9F04-A5FE99FC15EC}\\ParentFolder" } ], "repeated": 0, "id": 4236 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{E555AB60-153B-4D17-9F04-A5FE99FC15EC}\\Description" } ], "repeated": 0, "id": 4237 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "Microsoft\\Windows\\Ringtones" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{E555AB60-153B-4D17-9F04-A5FE99FC15EC}\\RelativePath" } ], "repeated": 0, "id": 4238 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{E555AB60-153B-4D17-9F04-A5FE99FC15EC}\\ParsingName" } ], "repeated": 0, "id": 4239 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{E555AB60-153B-4D17-9F04-A5FE99FC15EC}\\InfoTip" } ], "repeated": 0, "id": 4240 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{E555AB60-153B-4D17-9F04-A5FE99FC15EC}\\LocalizedName" } ], "repeated": 0, "id": 4241 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{E555AB60-153B-4D17-9F04-A5FE99FC15EC}\\Icon" } ], "repeated": 0, "id": 4242 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{E555AB60-153B-4D17-9F04-A5FE99FC15EC}\\Security" } ], "repeated": 0, "id": 4243 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{E555AB60-153B-4D17-9F04-A5FE99FC15EC}\\StreamResource" } ], "repeated": 0, "id": 4244 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{E555AB60-153B-4D17-9F04-A5FE99FC15EC}\\StreamResourceType" } ], "repeated": 0, "id": 4245 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{E555AB60-153B-4D17-9F04-A5FE99FC15EC}\\LocalRedirectOnly" } ], "repeated": 0, "id": 4246 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{E555AB60-153B-4D17-9F04-A5FE99FC15EC}\\Roamable" } ], "repeated": 0, "id": 4247 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{E555AB60-153B-4D17-9F04-A5FE99FC15EC}\\PreCreate" } ], "repeated": 0, "id": 4248 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{E555AB60-153B-4D17-9F04-A5FE99FC15EC}\\Stream" } ], "repeated": 0, "id": 4249 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{E555AB60-153B-4D17-9F04-A5FE99FC15EC}\\PublishExpandedPath" } ], "repeated": 0, "id": 4250 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{E555AB60-153B-4D17-9F04-A5FE99FC15EC}\\DefinitionFlags" } ], "repeated": 0, "id": 4251 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{E555AB60-153B-4D17-9F04-A5FE99FC15EC}\\Attributes" } ], "repeated": 0, "id": 4252 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{E555AB60-153B-4D17-9F04-A5FE99FC15EC}\\FolderTypeID" } ], "repeated": 0, "id": 4253 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{E555AB60-153B-4D17-9F04-A5FE99FC15EC}\\InitFolderHandler" } ], "repeated": 0, "id": 4254 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000003d0" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{E555AB60-153B-4D17-9F04-A5FE99FC15EC}\\PropertyBag" } ], "repeated": 0, "id": 4255 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d0" } ], "repeated": 0, "id": 4256 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000003d0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 4257 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003d0" }, { "name": "SubKey", "value": "{054FAE61-4DD8-4787-80B6-090220C4B700}" }, { "name": "Handle", "value": "0x000003ac" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{054FAE61-4DD8-4787-80B6-090220C4B700}" } ], "repeated": 0, "id": 4258 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d0" } ], "repeated": 0, "id": 4259 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{054FAE61-4DD8-4787-80B6-090220C4B700}\\Category" } ], "repeated": 0, "id": 4260 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "GameTasks" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{054FAE61-4DD8-4787-80B6-090220C4B700}\\Name" } ], "repeated": 0, "id": 4261 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "Data", "value": "{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{054FAE61-4DD8-4787-80B6-090220C4B700}\\ParentFolder" } ], "repeated": 0, "id": 4262 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{054FAE61-4DD8-4787-80B6-090220C4B700}\\Description" } ], "repeated": 0, "id": 4263 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "Microsoft\\Windows\\GameExplorer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{054FAE61-4DD8-4787-80B6-090220C4B700}\\RelativePath" } ], "repeated": 0, "id": 4264 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{054FAE61-4DD8-4787-80B6-090220C4B700}\\ParsingName" } ], "repeated": 0, "id": 4265 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{054FAE61-4DD8-4787-80B6-090220C4B700}\\InfoTip" } ], "repeated": 0, "id": 4266 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{054FAE61-4DD8-4787-80B6-090220C4B700}\\LocalizedName" } ], "repeated": 0, "id": 4267 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{054FAE61-4DD8-4787-80B6-090220C4B700}\\Icon" } ], "repeated": 0, "id": 4268 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{054FAE61-4DD8-4787-80B6-090220C4B700}\\Security" } ], "repeated": 0, "id": 4269 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{054FAE61-4DD8-4787-80B6-090220C4B700}\\StreamResource" } ], "repeated": 0, "id": 4270 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{054FAE61-4DD8-4787-80B6-090220C4B700}\\StreamResourceType" } ], "repeated": 0, "id": 4271 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{054FAE61-4DD8-4787-80B6-090220C4B700}\\LocalRedirectOnly" } ], "repeated": 0, "id": 4272 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{054FAE61-4DD8-4787-80B6-090220C4B700}\\Roamable" } ], "repeated": 0, "id": 4273 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{054FAE61-4DD8-4787-80B6-090220C4B700}\\PreCreate" } ], "repeated": 0, "id": 4274 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{054FAE61-4DD8-4787-80B6-090220C4B700}\\Stream" } ], "repeated": 0, "id": 4275 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{054FAE61-4DD8-4787-80B6-090220C4B700}\\PublishExpandedPath" } ], "repeated": 0, "id": 4276 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{054FAE61-4DD8-4787-80B6-090220C4B700}\\DefinitionFlags" } ], "repeated": 0, "id": 4277 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{054FAE61-4DD8-4787-80B6-090220C4B700}\\Attributes" } ], "repeated": 0, "id": 4278 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{054FAE61-4DD8-4787-80B6-090220C4B700}\\FolderTypeID" } ], "repeated": 0, "id": 4279 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{054FAE61-4DD8-4787-80B6-090220C4B700}\\InitFolderHandler" } ], "repeated": 0, "id": 4280 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000003ac" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{054FAE61-4DD8-4787-80B6-090220C4B700}\\PropertyBag" } ], "repeated": 0, "id": 4281 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" } ], "repeated": 0, "id": 4282 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000003ac" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 4283 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003ac" }, { "name": "SubKey", "value": "{1777F761-68AD-4D8A-87BD-30B759FA33DD}" }, { "name": "Handle", "value": "0x000003d0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1777F761-68AD-4D8A-87BD-30B759FA33DD}" } ], "repeated": 0, "id": 4284 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" } ], "repeated": 0, "id": 4285 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1777F761-68AD-4D8A-87BD-30B759FA33DD}\\Category" } ], "repeated": 0, "id": 4286 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "Favorites" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1777F761-68AD-4D8A-87BD-30B759FA33DD}\\Name" } ], "repeated": 0, "id": 4287 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1777F761-68AD-4D8A-87BD-30B759FA33DD}\\ParentFolder" } ], "repeated": 0, "id": 4288 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1777F761-68AD-4D8A-87BD-30B759FA33DD}\\Description" } ], "repeated": 0, "id": 4289 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "Favorites" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1777F761-68AD-4D8A-87BD-30B759FA33DD}\\RelativePath" } ], "repeated": 0, "id": 4290 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1777F761-68AD-4D8A-87BD-30B759FA33DD}\\ParsingName" } ], "repeated": 0, "id": 4291 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1777F761-68AD-4D8A-87BD-30B759FA33DD}\\InfoTip" } ], "repeated": 0, "id": 4292 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "Data", "value": "@%SystemRoot%\\system32\\shell32.dll,-21796" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1777F761-68AD-4D8A-87BD-30B759FA33DD}\\LocalizedName" } ], "repeated": 0, "id": 4293 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "Icon" }, { "name": "Data", "value": "%SystemRoot%\\system32\\imageres.dll,-115" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1777F761-68AD-4D8A-87BD-30B759FA33DD}\\Icon" } ], "repeated": 0, "id": 4294 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1777F761-68AD-4D8A-87BD-30B759FA33DD}\\Security" } ], "repeated": 0, "id": 4295 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1777F761-68AD-4D8A-87BD-30B759FA33DD}\\StreamResource" } ], "repeated": 0, "id": 4296 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1777F761-68AD-4D8A-87BD-30B759FA33DD}\\StreamResourceType" } ], "repeated": 0, "id": 4297 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1777F761-68AD-4D8A-87BD-30B759FA33DD}\\LocalRedirectOnly" } ], "repeated": 0, "id": 4298 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "Roamable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1777F761-68AD-4D8A-87BD-30B759FA33DD}\\Roamable" } ], "repeated": 0, "id": 4299 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1777F761-68AD-4D8A-87BD-30B759FA33DD}\\PreCreate" } ], "repeated": 0, "id": 4300 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1777F761-68AD-4D8A-87BD-30B759FA33DD}\\Stream" } ], "repeated": 0, "id": 4301 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1777F761-68AD-4D8A-87BD-30B759FA33DD}\\PublishExpandedPath" } ], "repeated": 0, "id": 4302 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1777F761-68AD-4D8A-87BD-30B759FA33DD}\\DefinitionFlags" } ], "repeated": 0, "id": 4303 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "Attributes" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1777F761-68AD-4D8A-87BD-30B759FA33DD}\\Attributes" } ], "repeated": 0, "id": 4304 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1777F761-68AD-4D8A-87BD-30B759FA33DD}\\FolderTypeID" } ], "repeated": 0, "id": 4305 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1777F761-68AD-4D8A-87BD-30B759FA33DD}\\InitFolderHandler" } ], "repeated": 0, "id": 4306 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000003d0" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1777F761-68AD-4D8A-87BD-30B759FA33DD}\\PropertyBag" } ], "repeated": 0, "id": 4307 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d0" } ], "repeated": 0, "id": 4308 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" } ], "repeated": 0, "id": 4309 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 4310 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 4311 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000003d0" } ], "repeated": 0, "id": 4312 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4313 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "`\\xa7\\xec\\x11l\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4314 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000002e4" }, { "name": "SubKey", "value": "SessionInfo\\1" }, { "name": "Handle", "value": "0x000003ac" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1" } ], "repeated": 0, "id": 4315 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000003ac" }, { "name": "SubKey", "value": "KnownFolders" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1\\KnownFolders" } ], "repeated": 0, "id": 4316 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" } ], "repeated": 0, "id": 4317 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xa3\\xec\\x11l\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x80\\xac\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4318 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003ac" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 4319 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003ac" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" }, { "name": "Handle", "value": "0x000003d4" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" } ], "repeated": 0, "id": 4320 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" } ], "repeated": 0, "id": 4321 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d4" }, { "name": "ValueName", "value": "Favorites" }, { "name": "Data", "value": "%USERPROFILE%\\Favorites" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Favorites" } ], "repeated": 0, "id": 4322 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d0" } ], "repeated": 0, "id": 4323 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d4" } ], "repeated": 0, "id": 4324 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000038c" }, { "name": "ValueName", "value": "ThisPCPolicy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\\PropertyBag\\ThisPCPolicy" } ], "repeated": 0, "id": 4325 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000038c" }, { "name": "ValueName", "value": "ThisPCPolicy" }, { "name": "Data", "value": "Show" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\\PropertyBag\\ThisPCPolicy" } ], "repeated": 0, "id": 4326 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000038c" }, { "name": "ValueName", "value": "BaseFolderId" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\\PropertyBag\\BaseFolderId" } ], "repeated": 0, "id": 4327 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000038c" }, { "name": "ValueName", "value": "BaseFolderId" }, { "name": "Data", "value": "{18989B1D-99B5-455B-841C-AB7C74E4DDFC}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\\PropertyBag\\BaseFolderId" } ], "repeated": 0, "id": 4328 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000003d4" } ], "repeated": 0, "id": 4329 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4330 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d4" } ], "repeated": 0, "id": 4331 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x10\\xc9\\xec\\x11l\\x00\\x00\\x00\\x00\\x00\\x00\\x00l\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00l\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00<\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xbc\\xed?\\xc0\\xf5\\x01\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4332 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003d4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 4333 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003d4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 4334 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000003d4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 4335 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x0000000c" }, { "name": "TokenHandle", "value": "0x000003d0" } ], "repeated": 0, "id": 4336 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" }, { "name": "Handle", "value": "0x000003ac" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" } ], "repeated": 0, "id": 4337 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "RDVirtualizationPool" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\RDVirtualizationPool" } ], "repeated": 0, "id": 4338 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" } ], "repeated": 0, "id": 4339 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" }, { "name": "Handle", "value": "0x000003ac" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" } ], "repeated": 0, "id": 4340 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "RDVirtualizationPool" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\RDVirtualizationPool" } ], "repeated": 0, "id": 4341 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" } ], "repeated": 0, "id": 4342 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x90\\xc9\\xec\\x11l\\x00\\x00\\x00\\x00\\x00\\x00\\x00l\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xa0\\xbd}\\x1a\\xff\\x7f\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xf8\\x81}\\x1a" } ], "repeated": 0, "id": 4343 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\fdeploy" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\fdeploy" } ], "repeated": 0, "id": 4344 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d0" } ], "repeated": 0, "id": 4345 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003d4" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" }, { "name": "Handle", "value": "0x000003d0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" } ], "repeated": 0, "id": 4346 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d0" } ], "repeated": 0, "id": 4347 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d4" } ], "repeated": 0, "id": 4348 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" } ], "repeated": 0, "id": 4349 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 4350 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 4351 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000003d4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 4352 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000003d4" }, { "name": "SubKey", "value": "{B250C668-F57D-4EE1-A63C-290EE7D1AA1F}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B250C668-F57D-4EE1-A63C-290EE7D1AA1F}" } ], "repeated": 0, "id": 4353 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d4" } ], "repeated": 0, "id": 4354 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000003d4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 4355 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003d4" }, { "name": "SubKey", "value": "{52528A6B-B9E3-4ADD-B60D-588C2DBA842D}" }, { "name": "Handle", "value": "0x000003d8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{52528A6B-B9E3-4ADD-B60D-588C2DBA842D}" } ], "repeated": 0, "id": 4356 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d4" } ], "repeated": 0, "id": 4357 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d8" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{52528A6B-B9E3-4add-B60D-588C2DBA842D}\\Category" } ], "repeated": 0, "id": 4358 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d8" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "HomeGroupFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{52528A6B-B9E3-4add-B60D-588C2DBA842D}\\Name" } ], "repeated": 0, "id": 4359 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d8" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{52528A6B-B9E3-4add-B60D-588C2DBA842D}\\ParentFolder" } ], "repeated": 0, "id": 4360 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d8" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{52528A6B-B9E3-4add-B60D-588C2DBA842D}\\Description" } ], "repeated": 0, "id": 4361 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d8" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{52528A6B-B9E3-4add-B60D-588C2DBA842D}\\RelativePath" } ], "repeated": 0, "id": 4362 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d8" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "Data", "value": "::{B4FB3F98-C1EA-428d-A78A-D1F5659CBA93}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{52528A6B-B9E3-4add-B60D-588C2DBA842D}\\ParsingName" } ], "repeated": 0, "id": 4363 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d8" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{52528A6B-B9E3-4add-B60D-588C2DBA842D}\\InfoTip" } ], "repeated": 0, "id": 4364 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d8" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{52528A6B-B9E3-4add-B60D-588C2DBA842D}\\LocalizedName" } ], "repeated": 0, "id": 4365 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d8" }, { "name": "ValueName", "value": "Icon" }, { "name": "Data", "value": "%SystemRoot%\\system32\\imageres.dll,-1013" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{52528A6B-B9E3-4add-B60D-588C2DBA842D}\\Icon" } ], "repeated": 0, "id": 4366 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d8" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{52528A6B-B9E3-4add-B60D-588C2DBA842D}\\Security" } ], "repeated": 0, "id": 4367 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d8" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{52528A6B-B9E3-4add-B60D-588C2DBA842D}\\StreamResource" } ], "repeated": 0, "id": 4368 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d8" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{52528A6B-B9E3-4add-B60D-588C2DBA842D}\\StreamResourceType" } ], "repeated": 0, "id": 4369 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d8" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{52528A6B-B9E3-4add-B60D-588C2DBA842D}\\LocalRedirectOnly" } ], "repeated": 0, "id": 4370 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d8" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{52528A6B-B9E3-4add-B60D-588C2DBA842D}\\Roamable" } ], "repeated": 0, "id": 4371 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d8" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{52528A6B-B9E3-4add-B60D-588C2DBA842D}\\PreCreate" } ], "repeated": 0, "id": 4372 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d8" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{52528A6B-B9E3-4add-B60D-588C2DBA842D}\\Stream" } ], "repeated": 0, "id": 4373 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d8" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{52528A6B-B9E3-4add-B60D-588C2DBA842D}\\PublishExpandedPath" } ], "repeated": 0, "id": 4374 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d8" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{52528A6B-B9E3-4add-B60D-588C2DBA842D}\\DefinitionFlags" } ], "repeated": 0, "id": 4375 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d8" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{52528A6B-B9E3-4add-B60D-588C2DBA842D}\\Attributes" } ], "repeated": 0, "id": 4376 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d8" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{52528A6B-B9E3-4add-B60D-588C2DBA842D}\\FolderTypeID" } ], "repeated": 0, "id": 4377 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d8" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{52528A6B-B9E3-4add-B60D-588C2DBA842D}\\InitFolderHandler" } ], "repeated": 0, "id": 4378 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003d8" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x000003b8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{52528A6B-B9E3-4add-B60D-588C2DBA842D}\\PropertyBag" } ], "repeated": 0, "id": 4379 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d8" } ], "repeated": 0, "id": 4380 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000003d8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 4381 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003d8" }, { "name": "SubKey", "value": "{8983036C-27C0-404B-8F08-102D10DCFD74}" }, { "name": "Handle", "value": "0x000003c8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{8983036C-27C0-404B-8F08-102D10DCFD74}" } ], "repeated": 0, "id": 4382 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d8" } ], "repeated": 0, "id": 4383 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003c8" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{8983036C-27C0-404B-8F08-102D10DCFD74}\\Category" } ], "repeated": 0, "id": 4384 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003c8" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "SendTo" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{8983036C-27C0-404B-8F08-102D10DCFD74}\\Name" } ], "repeated": 0, "id": 4385 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003c8" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "Data", "value": "{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{8983036C-27C0-404B-8F08-102D10DCFD74}\\ParentFolder" } ], "repeated": 0, "id": 4386 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c8" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{8983036C-27C0-404B-8F08-102D10DCFD74}\\Description" } ], "repeated": 0, "id": 4387 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003c8" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "Microsoft\\Windows\\SendTo" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{8983036C-27C0-404B-8F08-102D10DCFD74}\\RelativePath" } ], "repeated": 0, "id": 4388 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c8" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{8983036C-27C0-404B-8F08-102D10DCFD74}\\ParsingName" } ], "repeated": 0, "id": 4389 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c8" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{8983036C-27C0-404B-8F08-102D10DCFD74}\\InfoTip" } ], "repeated": 0, "id": 4390 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c8" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{8983036C-27C0-404B-8F08-102D10DCFD74}\\LocalizedName" } ], "repeated": 0, "id": 4391 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c8" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{8983036C-27C0-404B-8F08-102D10DCFD74}\\Icon" } ], "repeated": 0, "id": 4392 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c8" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{8983036C-27C0-404B-8F08-102D10DCFD74}\\Security" } ], "repeated": 0, "id": 4393 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c8" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{8983036C-27C0-404B-8F08-102D10DCFD74}\\StreamResource" } ], "repeated": 0, "id": 4394 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c8" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{8983036C-27C0-404B-8F08-102D10DCFD74}\\StreamResourceType" } ], "repeated": 0, "id": 4395 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c8" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{8983036C-27C0-404B-8F08-102D10DCFD74}\\LocalRedirectOnly" } ], "repeated": 0, "id": 4396 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c8" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{8983036C-27C0-404B-8F08-102D10DCFD74}\\Roamable" } ], "repeated": 0, "id": 4397 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c8" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{8983036C-27C0-404B-8F08-102D10DCFD74}\\PreCreate" } ], "repeated": 0, "id": 4398 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c8" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{8983036C-27C0-404B-8F08-102D10DCFD74}\\Stream" } ], "repeated": 0, "id": 4399 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c8" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{8983036C-27C0-404B-8F08-102D10DCFD74}\\PublishExpandedPath" } ], "repeated": 0, "id": 4400 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c8" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{8983036C-27C0-404B-8F08-102D10DCFD74}\\DefinitionFlags" } ], "repeated": 0, "id": 4401 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c8" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{8983036C-27C0-404B-8F08-102D10DCFD74}\\Attributes" } ], "repeated": 0, "id": 4402 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c8" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{8983036C-27C0-404B-8F08-102D10DCFD74}\\FolderTypeID" } ], "repeated": 0, "id": 4403 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c8" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{8983036C-27C0-404B-8F08-102D10DCFD74}\\InitFolderHandler" } ], "repeated": 0, "id": 4404 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000003c8" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{8983036C-27C0-404B-8F08-102D10DCFD74}\\PropertyBag" } ], "repeated": 0, "id": 4405 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003c8" } ], "repeated": 0, "id": 4406 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000003c8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 4407 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003c8" }, { "name": "SubKey", "value": "{0482AF6C-08F1-4C34-8C90-E17EC98B1E17}" }, { "name": "Handle", "value": "0x000003dc" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0482AF6C-08F1-4C34-8C90-E17EC98B1E17}" } ], "repeated": 0, "id": 4408 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003c8" } ], "repeated": 0, "id": 4409 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0482af6c-08f1-4c34-8c90-e17ec98b1e17}\\Category" } ], "repeated": 0, "id": 4410 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "PublicAccountPictures" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0482af6c-08f1-4c34-8c90-e17ec98b1e17}\\Name" } ], "repeated": 0, "id": 4411 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "Data", "value": "{DFDF76A2-C82A-4D63-906A-5644AC457385}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0482af6c-08f1-4c34-8c90-e17ec98b1e17}\\ParentFolder" } ], "repeated": 0, "id": 4412 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0482af6c-08f1-4c34-8c90-e17ec98b1e17}\\Description" } ], "repeated": 0, "id": 4413 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "AccountPictures" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0482af6c-08f1-4c34-8c90-e17ec98b1e17}\\RelativePath" } ], "repeated": 0, "id": 4414 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0482af6c-08f1-4c34-8c90-e17ec98b1e17}\\ParsingName" } ], "repeated": 0, "id": 4415 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0482af6c-08f1-4c34-8c90-e17ec98b1e17}\\InfoTip" } ], "repeated": 0, "id": 4416 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "Data", "value": "@C:\\Windows\\System32\\Windows.UI.Immersive.dll,-38304" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0482af6c-08f1-4c34-8c90-e17ec98b1e17}\\LocalizedName" } ], "repeated": 0, "id": 4417 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0482af6c-08f1-4c34-8c90-e17ec98b1e17}\\Icon" } ], "repeated": 0, "id": 4418 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0482af6c-08f1-4c34-8c90-e17ec98b1e17}\\Security" } ], "repeated": 0, "id": 4419 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0482af6c-08f1-4c34-8c90-e17ec98b1e17}\\StreamResource" } ], "repeated": 0, "id": 4420 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0482af6c-08f1-4c34-8c90-e17ec98b1e17}\\StreamResourceType" } ], "repeated": 0, "id": 4421 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0482af6c-08f1-4c34-8c90-e17ec98b1e17}\\LocalRedirectOnly" } ], "repeated": 0, "id": 4422 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0482af6c-08f1-4c34-8c90-e17ec98b1e17}\\Roamable" } ], "repeated": 0, "id": 4423 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0482af6c-08f1-4c34-8c90-e17ec98b1e17}\\PreCreate" } ], "repeated": 0, "id": 4424 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0482af6c-08f1-4c34-8c90-e17ec98b1e17}\\Stream" } ], "repeated": 0, "id": 4425 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0482af6c-08f1-4c34-8c90-e17ec98b1e17}\\PublishExpandedPath" } ], "repeated": 0, "id": 4426 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0482af6c-08f1-4c34-8c90-e17ec98b1e17}\\DefinitionFlags" } ], "repeated": 0, "id": 4427 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "Attributes" }, { "name": "Data", "value": "3" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0482af6c-08f1-4c34-8c90-e17ec98b1e17}\\Attributes" } ], "repeated": 0, "id": 4428 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0482af6c-08f1-4c34-8c90-e17ec98b1e17}\\FolderTypeID" } ], "repeated": 0, "id": 4429 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0482af6c-08f1-4c34-8c90-e17ec98b1e17}\\InitFolderHandler" } ], "repeated": 0, "id": 4430 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000003dc" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0482af6c-08f1-4c34-8c90-e17ec98b1e17}\\PropertyBag" } ], "repeated": 0, "id": 4431 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003dc" } ], "repeated": 0, "id": 4432 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000003dc" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 4433 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003dc" }, { "name": "SubKey", "value": "{BCB5256F-79F6-4CEE-B725-DC34E402FD46}" }, { "name": "Handle", "value": "0x000003c0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{BCB5256F-79F6-4CEE-B725-DC34E402FD46}" } ], "repeated": 0, "id": 4434 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003dc" } ], "repeated": 0, "id": 4435 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{bcb5256f-79f6-4cee-b725-dc34e402fd46}\\Category" } ], "repeated": 0, "id": 4436 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "ImplicitAppShortcuts" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{bcb5256f-79f6-4cee-b725-dc34e402fd46}\\Name" } ], "repeated": 0, "id": 4437 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "Data", "value": "{9e3995ab-1f9c-4f13-b827-48b24b6c7174}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{bcb5256f-79f6-4cee-b725-dc34e402fd46}\\ParentFolder" } ], "repeated": 0, "id": 4438 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{bcb5256f-79f6-4cee-b725-dc34e402fd46}\\Description" } ], "repeated": 0, "id": 4439 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "ImplicitAppShortcuts" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{bcb5256f-79f6-4cee-b725-dc34e402fd46}\\RelativePath" } ], "repeated": 0, "id": 4440 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{bcb5256f-79f6-4cee-b725-dc34e402fd46}\\ParsingName" } ], "repeated": 0, "id": 4441 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{bcb5256f-79f6-4cee-b725-dc34e402fd46}\\InfoTip" } ], "repeated": 0, "id": 4442 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{bcb5256f-79f6-4cee-b725-dc34e402fd46}\\LocalizedName" } ], "repeated": 0, "id": 4443 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{bcb5256f-79f6-4cee-b725-dc34e402fd46}\\Icon" } ], "repeated": 0, "id": 4444 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{bcb5256f-79f6-4cee-b725-dc34e402fd46}\\Security" } ], "repeated": 0, "id": 4445 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{bcb5256f-79f6-4cee-b725-dc34e402fd46}\\StreamResource" } ], "repeated": 0, "id": 4446 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{bcb5256f-79f6-4cee-b725-dc34e402fd46}\\StreamResourceType" } ], "repeated": 0, "id": 4447 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{bcb5256f-79f6-4cee-b725-dc34e402fd46}\\LocalRedirectOnly" } ], "repeated": 0, "id": 4448 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{bcb5256f-79f6-4cee-b725-dc34e402fd46}\\Roamable" } ], "repeated": 0, "id": 4449 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{bcb5256f-79f6-4cee-b725-dc34e402fd46}\\PreCreate" } ], "repeated": 0, "id": 4450 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{bcb5256f-79f6-4cee-b725-dc34e402fd46}\\Stream" } ], "repeated": 0, "id": 4451 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{bcb5256f-79f6-4cee-b725-dc34e402fd46}\\PublishExpandedPath" } ], "repeated": 0, "id": 4452 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{bcb5256f-79f6-4cee-b725-dc34e402fd46}\\DefinitionFlags" } ], "repeated": 0, "id": 4453 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{bcb5256f-79f6-4cee-b725-dc34e402fd46}\\Attributes" } ], "repeated": 0, "id": 4454 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{bcb5256f-79f6-4cee-b725-dc34e402fd46}\\FolderTypeID" } ], "repeated": 0, "id": 4455 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{bcb5256f-79f6-4cee-b725-dc34e402fd46}\\InitFolderHandler" } ], "repeated": 0, "id": 4456 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000003c0" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{bcb5256f-79f6-4cee-b725-dc34e402fd46}\\PropertyBag" } ], "repeated": 0, "id": 4457 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003c0" } ], "repeated": 0, "id": 4458 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1f5c040c000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4459 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000003c0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 4460 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003c0" }, { "name": "SubKey", "value": "{724EF170-A42D-4FEF-9F26-B60E846FBA4F}" }, { "name": "Handle", "value": "0x000003dc" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{724EF170-A42D-4FEF-9F26-B60E846FBA4F}" } ], "repeated": 0, "id": 4461 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003c0" } ], "repeated": 0, "id": 4462 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{724EF170-A42D-4FEF-9F26-B60E846FBA4F}\\Category" } ], "repeated": 0, "id": 4463 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "Administrative Tools" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{724EF170-A42D-4FEF-9F26-B60E846FBA4F}\\Name" } ], "repeated": 0, "id": 4464 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "Data", "value": "{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{724EF170-A42D-4FEF-9F26-B60E846FBA4F}\\ParentFolder" } ], "repeated": 0, "id": 4465 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{724EF170-A42D-4FEF-9F26-B60E846FBA4F}\\Description" } ], "repeated": 0, "id": 4466 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "Administrative Tools" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{724EF170-A42D-4FEF-9F26-B60E846FBA4F}\\RelativePath" } ], "repeated": 0, "id": 4467 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{724EF170-A42D-4FEF-9F26-B60E846FBA4F}\\ParsingName" } ], "repeated": 0, "id": 4468 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{724EF170-A42D-4FEF-9F26-B60E846FBA4F}\\InfoTip" } ], "repeated": 0, "id": 4469 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "Data", "value": "@%SystemRoot%\\system32\\shell32.dll,-21762" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{724EF170-A42D-4FEF-9F26-B60E846FBA4F}\\LocalizedName" } ], "repeated": 0, "id": 4470 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{724EF170-A42D-4FEF-9F26-B60E846FBA4F}\\Icon" } ], "repeated": 0, "id": 4471 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{724EF170-A42D-4FEF-9F26-B60E846FBA4F}\\Security" } ], "repeated": 0, "id": 4472 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{724EF170-A42D-4FEF-9F26-B60E846FBA4F}\\StreamResource" } ], "repeated": 0, "id": 4473 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{724EF170-A42D-4FEF-9F26-B60E846FBA4F}\\StreamResourceType" } ], "repeated": 0, "id": 4474 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{724EF170-A42D-4FEF-9F26-B60E846FBA4F}\\LocalRedirectOnly" } ], "repeated": 0, "id": 4475 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{724EF170-A42D-4FEF-9F26-B60E846FBA4F}\\Roamable" } ], "repeated": 0, "id": 4476 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{724EF170-A42D-4FEF-9F26-B60E846FBA4F}\\PreCreate" } ], "repeated": 0, "id": 4477 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{724EF170-A42D-4FEF-9F26-B60E846FBA4F}\\Stream" } ], "repeated": 0, "id": 4478 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{724EF170-A42D-4FEF-9F26-B60E846FBA4F}\\PublishExpandedPath" } ], "repeated": 0, "id": 4479 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{724EF170-A42D-4FEF-9F26-B60E846FBA4F}\\DefinitionFlags" } ], "repeated": 0, "id": 4480 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "Attributes" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{724EF170-A42D-4FEF-9F26-B60E846FBA4F}\\Attributes" } ], "repeated": 0, "id": 4481 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{724EF170-A42D-4FEF-9F26-B60E846FBA4F}\\FolderTypeID" } ], "repeated": 0, "id": 4482 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{724EF170-A42D-4FEF-9F26-B60E846FBA4F}\\InitFolderHandler" } ], "repeated": 0, "id": 4483 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000003dc" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{724EF170-A42D-4FEF-9F26-B60E846FBA4F}\\PropertyBag" } ], "repeated": 0, "id": 4484 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003dc" } ], "repeated": 0, "id": 4485 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000003dc" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 4486 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003dc" }, { "name": "SubKey", "value": "{4BD8D571-6D19-48D3-BE97-422220080E43}" }, { "name": "Handle", "value": "0x000003c0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}" } ], "repeated": 0, "id": 4487 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003dc" } ], "repeated": 0, "id": 4488 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\Category" } ], "repeated": 0, "id": 4489 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "My Music" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\Name" } ], "repeated": 0, "id": 4490 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\ParentFolder" } ], "repeated": 0, "id": 4491 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\Description" } ], "repeated": 0, "id": 4492 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "Music" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\RelativePath" } ], "repeated": 0, "id": 4493 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "Data", "value": "shell:::{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\::{1CF1260C-4DD0-4EBB-811F-33C572699FDE}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\ParsingName" } ], "repeated": 0, "id": 4494 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "Data", "value": "@%SystemRoot%\\system32\\shell32.dll,-12689" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\InfoTip" } ], "repeated": 0, "id": 4495 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "Data", "value": "@%SystemRoot%\\system32\\windows.storage.dll,-21790" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\LocalizedName" } ], "repeated": 0, "id": 4496 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "Icon" }, { "name": "Data", "value": "%SystemRoot%\\system32\\imageres.dll,-108" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\Icon" } ], "repeated": 0, "id": 4497 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\Security" } ], "repeated": 0, "id": 4498 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\StreamResource" } ], "repeated": 0, "id": 4499 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\StreamResourceType" } ], "repeated": 0, "id": 4500 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\LocalRedirectOnly" } ], "repeated": 0, "id": 4501 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "Roamable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\Roamable" } ], "repeated": 0, "id": 4502 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\PreCreate" } ], "repeated": 0, "id": 4503 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\Stream" } ], "repeated": 0, "id": 4504 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\PublishExpandedPath" } ], "repeated": 0, "id": 4505 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\DefinitionFlags" } ], "repeated": 0, "id": 4506 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "Attributes" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\Attributes" } ], "repeated": 0, "id": 4507 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\FolderTypeID" } ], "repeated": 0, "id": 4508 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\InitFolderHandler" } ], "repeated": 0, "id": 4509 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003c0" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x000003c8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\PropertyBag" } ], "repeated": 0, "id": 4510 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003c0" } ], "repeated": 0, "id": 4511 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003c8" }, { "name": "ValueName", "value": "ThisPCPolicy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\PropertyBag\\ThisPCPolicy" } ], "repeated": 0, "id": 4512 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003c8" }, { "name": "ValueName", "value": "ThisPCPolicy" }, { "name": "Data", "value": "Hide" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\PropertyBag\\ThisPCPolicy" } ], "repeated": 0, "id": 4513 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000003c0" } ], "repeated": 0, "id": 4514 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4515 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003c0" } ], "repeated": 0, "id": 4516 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x10\\xc9\\xec\\x11l\\x00\\x00\\x00\\x00\\x00\\x00\\x00l\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00l\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00<\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xec\\xe5?\\xc0\\xf5\\x01\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4517 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003c0" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 4518 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003c0" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 4519 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000003c0" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 4520 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x0000000c" }, { "name": "TokenHandle", "value": "0x000003e0" } ], "repeated": 0, "id": 4521 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" }, { "name": "Handle", "value": "0x000003e4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" } ], "repeated": 0, "id": 4522 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e4" }, { "name": "ValueName", "value": "RDVirtualizationPool" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\RDVirtualizationPool" } ], "repeated": 0, "id": 4523 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e4" } ], "repeated": 0, "id": 4524 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" }, { "name": "Handle", "value": "0x000003e4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" } ], "repeated": 0, "id": 4525 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e4" }, { "name": "ValueName", "value": "RDVirtualizationPool" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\RDVirtualizationPool" } ], "repeated": 0, "id": 4526 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e4" } ], "repeated": 0, "id": 4527 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x90\\xc9\\xec\\x11l\\x00\\x00\\x00\\x00\\x00\\x00\\x00l\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xa0\\xbd}\\x1a\\xff\\x7f\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xf8\\x81}\\x1a" } ], "repeated": 0, "id": 4528 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\fdeploy" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\fdeploy" } ], "repeated": 0, "id": 4529 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" } ], "repeated": 0, "id": 4530 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003c0" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" }, { "name": "Handle", "value": "0x000003e0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" } ], "repeated": 0, "id": 4531 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" } ], "repeated": 0, "id": 4532 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003c0" } ], "repeated": 0, "id": 4533 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000003c0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 4534 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003c0" }, { "name": "SubKey", "value": "{DE61D971-5EBC-4F02-A3A9-6C82895E5C04}" }, { "name": "Handle", "value": "0x000003e0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DE61D971-5EBC-4F02-A3A9-6C82895E5C04}" } ], "repeated": 0, "id": 4535 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003c0" } ], "repeated": 0, "id": 4536 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{de61d971-5ebc-4f02-a3a9-6c82895e5c04}\\Category" } ], "repeated": 0, "id": 4537 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "AddNewProgramsFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{de61d971-5ebc-4f02-a3a9-6c82895e5c04}\\Name" } ], "repeated": 0, "id": 4538 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{de61d971-5ebc-4f02-a3a9-6c82895e5c04}\\ParentFolder" } ], "repeated": 0, "id": 4539 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{de61d971-5ebc-4f02-a3a9-6c82895e5c04}\\Description" } ], "repeated": 0, "id": 4540 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{de61d971-5ebc-4f02-a3a9-6c82895e5c04}\\RelativePath" } ], "repeated": 0, "id": 4541 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "Data", "value": "shell:::{26EE0668-A00A-44D7-9371-BEB064C98683}\\0\\::{15eae92e-f17a-4431-9f28-805e482dafd4}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{de61d971-5ebc-4f02-a3a9-6c82895e5c04}\\ParsingName" } ], "repeated": 0, "id": 4542 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{de61d971-5ebc-4f02-a3a9-6c82895e5c04}\\InfoTip" } ], "repeated": 0, "id": 4543 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{de61d971-5ebc-4f02-a3a9-6c82895e5c04}\\LocalizedName" } ], "repeated": 0, "id": 4544 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{de61d971-5ebc-4f02-a3a9-6c82895e5c04}\\Icon" } ], "repeated": 0, "id": 4545 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{de61d971-5ebc-4f02-a3a9-6c82895e5c04}\\Security" } ], "repeated": 0, "id": 4546 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{de61d971-5ebc-4f02-a3a9-6c82895e5c04}\\StreamResource" } ], "repeated": 0, "id": 4547 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{de61d971-5ebc-4f02-a3a9-6c82895e5c04}\\StreamResourceType" } ], "repeated": 0, "id": 4548 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{de61d971-5ebc-4f02-a3a9-6c82895e5c04}\\LocalRedirectOnly" } ], "repeated": 0, "id": 4549 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{de61d971-5ebc-4f02-a3a9-6c82895e5c04}\\Roamable" } ], "repeated": 0, "id": 4550 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{de61d971-5ebc-4f02-a3a9-6c82895e5c04}\\PreCreate" } ], "repeated": 0, "id": 4551 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{de61d971-5ebc-4f02-a3a9-6c82895e5c04}\\Stream" } ], "repeated": 0, "id": 4552 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{de61d971-5ebc-4f02-a3a9-6c82895e5c04}\\PublishExpandedPath" } ], "repeated": 0, "id": 4553 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{de61d971-5ebc-4f02-a3a9-6c82895e5c04}\\DefinitionFlags" } ], "repeated": 0, "id": 4554 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{de61d971-5ebc-4f02-a3a9-6c82895e5c04}\\Attributes" } ], "repeated": 0, "id": 4555 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{de61d971-5ebc-4f02-a3a9-6c82895e5c04}\\FolderTypeID" } ], "repeated": 0, "id": 4556 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{de61d971-5ebc-4f02-a3a9-6c82895e5c04}\\InitFolderHandler" } ], "repeated": 0, "id": 4557 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000003e0" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{de61d971-5ebc-4f02-a3a9-6c82895e5c04}\\PropertyBag" } ], "repeated": 0, "id": 4558 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" } ], "repeated": 0, "id": 4559 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000003e0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 4560 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003e0" }, { "name": "SubKey", "value": "{EDC0FE71-98D8-4F4A-B920-C8DC133CB165}" }, { "name": "Handle", "value": "0x000003c0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{EDC0FE71-98D8-4F4A-B920-C8DC133CB165}" } ], "repeated": 0, "id": 4561 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" } ], "repeated": 0, "id": 4562 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{EDC0FE71-98D8-4F4A-B920-C8DC133CB165}\\Category" } ], "repeated": 0, "id": 4563 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "Captures" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{EDC0FE71-98D8-4F4A-B920-C8DC133CB165}\\Name" } ], "repeated": 0, "id": 4564 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "Data", "value": "{18989B1D-99B5-455B-841C-AB7C74E4DDFC}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{EDC0FE71-98D8-4F4A-B920-C8DC133CB165}\\ParentFolder" } ], "repeated": 0, "id": 4565 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{EDC0FE71-98D8-4F4A-B920-C8DC133CB165}\\Description" } ], "repeated": 0, "id": 4566 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "Captures" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{EDC0FE71-98D8-4F4A-B920-C8DC133CB165}\\RelativePath" } ], "repeated": 0, "id": 4567 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{EDC0FE71-98D8-4F4A-B920-C8DC133CB165}\\ParsingName" } ], "repeated": 0, "id": 4568 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{EDC0FE71-98D8-4F4A-B920-C8DC133CB165}\\InfoTip" } ], "repeated": 0, "id": 4569 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "Data", "value": "@%SystemRoot%\\system32\\windows.storage.dll,-21826" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{EDC0FE71-98D8-4F4A-B920-C8DC133CB165}\\LocalizedName" } ], "repeated": 0, "id": 4570 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{EDC0FE71-98D8-4F4A-B920-C8DC133CB165}\\Icon" } ], "repeated": 0, "id": 4571 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{EDC0FE71-98D8-4F4A-B920-C8DC133CB165}\\Security" } ], "repeated": 0, "id": 4572 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{EDC0FE71-98D8-4F4A-B920-C8DC133CB165}\\StreamResource" } ], "repeated": 0, "id": 4573 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{EDC0FE71-98D8-4F4A-B920-C8DC133CB165}\\StreamResourceType" } ], "repeated": 0, "id": 4574 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{EDC0FE71-98D8-4F4A-B920-C8DC133CB165}\\LocalRedirectOnly" } ], "repeated": 0, "id": 4575 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{EDC0FE71-98D8-4F4A-B920-C8DC133CB165}\\Roamable" } ], "repeated": 0, "id": 4576 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{EDC0FE71-98D8-4F4A-B920-C8DC133CB165}\\PreCreate" } ], "repeated": 0, "id": 4577 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{EDC0FE71-98D8-4F4A-B920-C8DC133CB165}\\Stream" } ], "repeated": 0, "id": 4578 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{EDC0FE71-98D8-4F4A-B920-C8DC133CB165}\\PublishExpandedPath" } ], "repeated": 0, "id": 4579 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{EDC0FE71-98D8-4F4A-B920-C8DC133CB165}\\DefinitionFlags" } ], "repeated": 0, "id": 4580 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{EDC0FE71-98D8-4F4A-B920-C8DC133CB165}\\Attributes" } ], "repeated": 0, "id": 4581 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{EDC0FE71-98D8-4F4A-B920-C8DC133CB165}\\FolderTypeID" } ], "repeated": 0, "id": 4582 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{EDC0FE71-98D8-4F4A-B920-C8DC133CB165}\\InitFolderHandler" } ], "repeated": 0, "id": 4583 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000003c0" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{EDC0FE71-98D8-4F4A-B920-C8DC133CB165}\\PropertyBag" } ], "repeated": 0, "id": 4584 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003c0" } ], "repeated": 0, "id": 4585 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000003c0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 4586 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003c0" }, { "name": "SubKey", "value": "{0762D272-C50A-4BB0-A382-697DCD729B80}" }, { "name": "Handle", "value": "0x000003e0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0762D272-C50A-4BB0-A382-697DCD729B80}" } ], "repeated": 0, "id": 4587 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003c0" } ], "repeated": 0, "id": 4588 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0762D272-C50A-4BB0-A382-697DCD729B80}\\Category" } ], "repeated": 0, "id": 4589 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "UserProfiles" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0762D272-C50A-4BB0-A382-697DCD729B80}\\Name" } ], "repeated": 0, "id": 4590 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0762D272-C50A-4BB0-A382-697DCD729B80}\\ParentFolder" } ], "repeated": 0, "id": 4591 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0762D272-C50A-4BB0-A382-697DCD729B80}\\Description" } ], "repeated": 0, "id": 4592 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0762D272-C50A-4BB0-A382-697DCD729B80}\\RelativePath" } ], "repeated": 0, "id": 4593 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0762D272-C50A-4BB0-A382-697DCD729B80}\\ParsingName" } ], "repeated": 0, "id": 4594 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0762D272-C50A-4BB0-A382-697DCD729B80}\\InfoTip" } ], "repeated": 0, "id": 4595 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "Data", "value": "@%SystemRoot%\\system32\\shell32.dll,-21813" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0762D272-C50A-4BB0-A382-697DCD729B80}\\LocalizedName" } ], "repeated": 0, "id": 4596 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0762D272-C50A-4BB0-A382-697DCD729B80}\\Icon" } ], "repeated": 0, "id": 4597 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Security" }, { "name": "Data", "value": "D:P(A;OICI;FA;;;SY)(A;OICI;FA;;;BA)(A;OICI;GXGR;;;BU)(A;OICI;GXGR;;;WD)" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0762D272-C50A-4BB0-A382-697DCD729B80}\\Security" } ], "repeated": 0, "id": 4598 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0762D272-C50A-4BB0-A382-697DCD729B80}\\StreamResource" } ], "repeated": 0, "id": 4599 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0762D272-C50A-4BB0-A382-697DCD729B80}\\StreamResourceType" } ], "repeated": 0, "id": 4600 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0762D272-C50A-4BB0-A382-697DCD729B80}\\LocalRedirectOnly" } ], "repeated": 0, "id": 4601 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0762D272-C50A-4BB0-A382-697DCD729B80}\\Roamable" } ], "repeated": 0, "id": 4602 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0762D272-C50A-4BB0-A382-697DCD729B80}\\PreCreate" } ], "repeated": 0, "id": 4603 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0762D272-C50A-4BB0-A382-697DCD729B80}\\Stream" } ], "repeated": 0, "id": 4604 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0762D272-C50A-4BB0-A382-697DCD729B80}\\PublishExpandedPath" } ], "repeated": 0, "id": 4605 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0762D272-C50A-4BB0-A382-697DCD729B80}\\DefinitionFlags" } ], "repeated": 0, "id": 4606 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Attributes" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0762D272-C50A-4BB0-A382-697DCD729B80}\\Attributes" } ], "repeated": 0, "id": 4607 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0762D272-C50A-4BB0-A382-697DCD729B80}\\FolderTypeID" } ], "repeated": 0, "id": 4608 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0762D272-C50A-4BB0-A382-697DCD729B80}\\InitFolderHandler" } ], "repeated": 0, "id": 4609 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000003e0" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0762D272-C50A-4BB0-A382-697DCD729B80}\\PropertyBag" } ], "repeated": 0, "id": 4610 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" } ], "repeated": 0, "id": 4611 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000003e0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 4612 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003e0" }, { "name": "SubKey", "value": "{4D9F7874-4E0C-4904-967B-40B0D20C3E4B}" }, { "name": "Handle", "value": "0x000003c0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4D9F7874-4E0C-4904-967B-40B0D20C3E4B}" } ], "repeated": 0, "id": 4613 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" } ], "repeated": 0, "id": 4614 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4D9F7874-4E0C-4904-967B-40B0D20C3E4B}\\Category" } ], "repeated": 0, "id": 4615 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "InternetFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4D9F7874-4E0C-4904-967B-40B0D20C3E4B}\\Name" } ], "repeated": 0, "id": 4616 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4D9F7874-4E0C-4904-967B-40B0D20C3E4B}\\ParentFolder" } ], "repeated": 0, "id": 4617 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4D9F7874-4E0C-4904-967B-40B0D20C3E4B}\\Description" } ], "repeated": 0, "id": 4618 }, { "timestamp": "2026-05-29 01:05:17,727", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4D9F7874-4E0C-4904-967B-40B0D20C3E4B}\\RelativePath" } ], "repeated": 0, "id": 4619 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "Data", "value": "::{871C5380-42A0-1069-A2EA-08002B30309D}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4D9F7874-4E0C-4904-967B-40B0D20C3E4B}\\ParsingName" } ], "repeated": 0, "id": 4620 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4D9F7874-4E0C-4904-967B-40B0D20C3E4B}\\InfoTip" } ], "repeated": 0, "id": 4621 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4D9F7874-4E0C-4904-967B-40B0D20C3E4B}\\LocalizedName" } ], "repeated": 0, "id": 4622 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4D9F7874-4E0C-4904-967B-40B0D20C3E4B}\\Icon" } ], "repeated": 0, "id": 4623 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4D9F7874-4E0C-4904-967B-40B0D20C3E4B}\\Security" } ], "repeated": 0, "id": 4624 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4D9F7874-4E0C-4904-967B-40B0D20C3E4B}\\StreamResource" } ], "repeated": 0, "id": 4625 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4D9F7874-4E0C-4904-967B-40B0D20C3E4B}\\StreamResourceType" } ], "repeated": 0, "id": 4626 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4D9F7874-4E0C-4904-967B-40B0D20C3E4B}\\LocalRedirectOnly" } ], "repeated": 0, "id": 4627 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4D9F7874-4E0C-4904-967B-40B0D20C3E4B}\\Roamable" } ], "repeated": 0, "id": 4628 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4D9F7874-4E0C-4904-967B-40B0D20C3E4B}\\PreCreate" } ], "repeated": 0, "id": 4629 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4D9F7874-4E0C-4904-967B-40B0D20C3E4B}\\Stream" } ], "repeated": 0, "id": 4630 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4D9F7874-4E0C-4904-967B-40B0D20C3E4B}\\PublishExpandedPath" } ], "repeated": 0, "id": 4631 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4D9F7874-4E0C-4904-967B-40B0D20C3E4B}\\DefinitionFlags" } ], "repeated": 0, "id": 4632 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4D9F7874-4E0C-4904-967B-40B0D20C3E4B}\\Attributes" } ], "repeated": 0, "id": 4633 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4D9F7874-4E0C-4904-967B-40B0D20C3E4B}\\FolderTypeID" } ], "repeated": 0, "id": 4634 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003c0" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4D9F7874-4E0C-4904-967B-40B0D20C3E4B}\\InitFolderHandler" } ], "repeated": 0, "id": 4635 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000003c0" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4D9F7874-4E0C-4904-967B-40B0D20C3E4B}\\PropertyBag" } ], "repeated": 0, "id": 4636 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003c0" } ], "repeated": 0, "id": 4637 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000003c0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 4638 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003c0" }, { "name": "SubKey", "value": "{2B20DF75-1EDA-4039-8097-38798227D5B7}" }, { "name": "Handle", "value": "0x000003e0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2B20DF75-1EDA-4039-8097-38798227D5B7}" } ], "repeated": 0, "id": 4639 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003c0" } ], "repeated": 0, "id": 4640 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2B20DF75-1EDA-4039-8097-38798227D5B7}\\Category" } ], "repeated": 0, "id": 4641 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "CameraRollLibrary" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2B20DF75-1EDA-4039-8097-38798227D5B7}\\Name" } ], "repeated": 0, "id": 4642 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "Data", "value": "{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2B20DF75-1EDA-4039-8097-38798227D5B7}\\ParentFolder" } ], "repeated": 0, "id": 4643 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2B20DF75-1EDA-4039-8097-38798227D5B7}\\Description" } ], "repeated": 0, "id": 4644 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "CameraRoll.library-ms" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2B20DF75-1EDA-4039-8097-38798227D5B7}\\RelativePath" } ], "repeated": 0, "id": 4645 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "Data", "value": "::{031E4825-7B94-4dc3-B131-E946B44C8DD5}\\{2B20DF75-1EDA-4039-8097-38798227D5B7}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2B20DF75-1EDA-4039-8097-38798227D5B7}\\ParsingName" } ], "repeated": 0, "id": 4646 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2B20DF75-1EDA-4039-8097-38798227D5B7}\\InfoTip" } ], "repeated": 0, "id": 4647 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "Data", "value": "@%SystemRoot%\\system32\\windows.storage.dll,-34582" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2B20DF75-1EDA-4039-8097-38798227D5B7}\\LocalizedName" } ], "repeated": 0, "id": 4648 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2B20DF75-1EDA-4039-8097-38798227D5B7}\\Icon" } ], "repeated": 0, "id": 4649 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2B20DF75-1EDA-4039-8097-38798227D5B7}\\Security" } ], "repeated": 0, "id": 4650 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "Data", "value": "%SystemRoot%\\system32\\shell32.dll,-5" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2B20DF75-1EDA-4039-8097-38798227D5B7}\\StreamResource" } ], "repeated": 0, "id": 4651 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "Data", "value": "LIBRARY" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2B20DF75-1EDA-4039-8097-38798227D5B7}\\StreamResourceType" } ], "repeated": 0, "id": 4652 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2B20DF75-1EDA-4039-8097-38798227D5B7}\\LocalRedirectOnly" } ], "repeated": 0, "id": 4653 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2B20DF75-1EDA-4039-8097-38798227D5B7}\\Roamable" } ], "repeated": 0, "id": 4654 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2B20DF75-1EDA-4039-8097-38798227D5B7}\\PreCreate" } ], "repeated": 0, "id": 4655 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Stream" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2B20DF75-1EDA-4039-8097-38798227D5B7}\\Stream" } ], "repeated": 0, "id": 4656 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2B20DF75-1EDA-4039-8097-38798227D5B7}\\PublishExpandedPath" } ], "repeated": 0, "id": 4657 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2B20DF75-1EDA-4039-8097-38798227D5B7}\\DefinitionFlags" } ], "repeated": 0, "id": 4658 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2B20DF75-1EDA-4039-8097-38798227D5B7}\\Attributes" } ], "repeated": 0, "id": 4659 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2B20DF75-1EDA-4039-8097-38798227D5B7}\\FolderTypeID" } ], "repeated": 0, "id": 4660 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2B20DF75-1EDA-4039-8097-38798227D5B7}\\InitFolderHandler" } ], "repeated": 0, "id": 4661 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003e0" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x000003c0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2B20DF75-1EDA-4039-8097-38798227D5B7}\\PropertyBag" } ], "repeated": 0, "id": 4662 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" } ], "repeated": 0, "id": 4663 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000003e0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 4664 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003e0" }, { "name": "SubKey", "value": "{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}" }, { "name": "Handle", "value": "0x000003e4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}" } ], "repeated": 0, "id": 4665 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" } ], "repeated": 0, "id": 4666 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e4" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\\Category" } ], "repeated": 0, "id": 4667 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e4" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "Programs" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\\Name" } ], "repeated": 0, "id": 4668 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e4" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "Data", "value": "{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\\ParentFolder" } ], "repeated": 0, "id": 4669 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e4" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\\Description" } ], "repeated": 0, "id": 4670 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e4" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "Programs" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\\RelativePath" } ], "repeated": 0, "id": 4671 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e4" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\\ParsingName" } ], "repeated": 0, "id": 4672 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e4" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\\InfoTip" } ], "repeated": 0, "id": 4673 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e4" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "Data", "value": "@%SystemRoot%\\system32\\shell32.dll,-21782" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\\LocalizedName" } ], "repeated": 0, "id": 4674 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e4" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\\Icon" } ], "repeated": 0, "id": 4675 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e4" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\\Security" } ], "repeated": 0, "id": 4676 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e4" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\\StreamResource" } ], "repeated": 0, "id": 4677 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e4" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\\StreamResourceType" } ], "repeated": 0, "id": 4678 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e4" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\\LocalRedirectOnly" } ], "repeated": 0, "id": 4679 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e4" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\\Roamable" } ], "repeated": 0, "id": 4680 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e4" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\\PreCreate" } ], "repeated": 0, "id": 4681 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e4" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\\Stream" } ], "repeated": 0, "id": 4682 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e4" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\\PublishExpandedPath" } ], "repeated": 0, "id": 4683 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e4" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\\DefinitionFlags" } ], "repeated": 0, "id": 4684 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e4" }, { "name": "ValueName", "value": "Attributes" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\\Attributes" } ], "repeated": 0, "id": 4685 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e4" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\\FolderTypeID" } ], "repeated": 0, "id": 4686 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e4" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\\InitFolderHandler" } ], "repeated": 0, "id": 4687 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000003e4" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\\PropertyBag" } ], "repeated": 0, "id": 4688 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e4" } ], "repeated": 0, "id": 4689 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000003e4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 4690 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003e4" }, { "name": "SubKey", "value": "{B2C5E279-7ADD-439F-B28C-C41FE1BBF672}" }, { "name": "Handle", "value": "0x000003e0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B2C5E279-7ADD-439F-B28C-C41FE1BBF672}" } ], "repeated": 0, "id": 4691 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e4" } ], "repeated": 0, "id": 4692 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B2C5E279-7ADD-439F-B28C-C41FE1BBF672}\\Category" } ], "repeated": 0, "id": 4693 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "AppDataDesktop" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B2C5E279-7ADD-439F-B28C-C41FE1BBF672}\\Name" } ], "repeated": 0, "id": 4694 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "Data", "value": "{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B2C5E279-7ADD-439F-B28C-C41FE1BBF672}\\ParentFolder" } ], "repeated": 0, "id": 4695 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B2C5E279-7ADD-439F-B28C-C41FE1BBF672}\\Description" } ], "repeated": 0, "id": 4696 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "Desktop" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B2C5E279-7ADD-439F-B28C-C41FE1BBF672}\\RelativePath" } ], "repeated": 0, "id": 4697 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B2C5E279-7ADD-439F-B28C-C41FE1BBF672}\\ParsingName" } ], "repeated": 0, "id": 4698 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B2C5E279-7ADD-439F-B28C-C41FE1BBF672}\\InfoTip" } ], "repeated": 0, "id": 4699 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B2C5E279-7ADD-439F-B28C-C41FE1BBF672}\\LocalizedName" } ], "repeated": 0, "id": 4700 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B2C5E279-7ADD-439F-B28C-C41FE1BBF672}\\Icon" } ], "repeated": 0, "id": 4701 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B2C5E279-7ADD-439F-B28C-C41FE1BBF672}\\Security" } ], "repeated": 0, "id": 4702 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B2C5E279-7ADD-439F-B28C-C41FE1BBF672}\\StreamResource" } ], "repeated": 0, "id": 4703 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B2C5E279-7ADD-439F-B28C-C41FE1BBF672}\\StreamResourceType" } ], "repeated": 0, "id": 4704 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B2C5E279-7ADD-439F-B28C-C41FE1BBF672}\\LocalRedirectOnly" } ], "repeated": 0, "id": 4705 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B2C5E279-7ADD-439F-B28C-C41FE1BBF672}\\Roamable" } ], "repeated": 0, "id": 4706 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B2C5E279-7ADD-439F-B28C-C41FE1BBF672}\\PreCreate" } ], "repeated": 0, "id": 4707 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B2C5E279-7ADD-439F-B28C-C41FE1BBF672}\\Stream" } ], "repeated": 0, "id": 4708 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B2C5E279-7ADD-439F-B28C-C41FE1BBF672}\\PublishExpandedPath" } ], "repeated": 0, "id": 4709 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B2C5E279-7ADD-439F-B28C-C41FE1BBF672}\\DefinitionFlags" } ], "repeated": 0, "id": 4710 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B2C5E279-7ADD-439F-B28C-C41FE1BBF672}\\Attributes" } ], "repeated": 0, "id": 4711 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B2C5E279-7ADD-439F-B28C-C41FE1BBF672}\\FolderTypeID" } ], "repeated": 0, "id": 4712 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B2C5E279-7ADD-439F-B28C-C41FE1BBF672}\\InitFolderHandler" } ], "repeated": 0, "id": 4713 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000003e0" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B2C5E279-7ADD-439F-B28C-C41FE1BBF672}\\PropertyBag" } ], "repeated": 0, "id": 4714 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" } ], "repeated": 0, "id": 4715 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000003e0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 4716 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003e0" }, { "name": "SubKey", "value": "{AB5FB87B-7CE2-4F83-915D-550846C9537B}" }, { "name": "Handle", "value": "0x000003e4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AB5FB87B-7CE2-4F83-915D-550846C9537B}" } ], "repeated": 0, "id": 4717 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" } ], "repeated": 0, "id": 4718 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e4" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AB5FB87B-7CE2-4F83-915D-550846C9537B}\\Category" } ], "repeated": 0, "id": 4719 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e4" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "Camera Roll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AB5FB87B-7CE2-4F83-915D-550846C9537B}\\Name" } ], "repeated": 0, "id": 4720 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e4" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "Data", "value": "{33E28130-4E1E-4676-835A-98395C3BC3BB}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AB5FB87B-7CE2-4F83-915D-550846C9537B}\\ParentFolder" } ], "repeated": 0, "id": 4721 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e4" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AB5FB87B-7CE2-4F83-915D-550846C9537B}\\Description" } ], "repeated": 0, "id": 4722 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e4" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "Camera Roll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AB5FB87B-7CE2-4F83-915D-550846C9537B}\\RelativePath" } ], "repeated": 0, "id": 4723 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e4" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AB5FB87B-7CE2-4F83-915D-550846C9537B}\\ParsingName" } ], "repeated": 0, "id": 4724 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e4" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AB5FB87B-7CE2-4F83-915D-550846C9537B}\\InfoTip" } ], "repeated": 0, "id": 4725 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e4" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "Data", "value": "@%SystemRoot%\\system32\\windows.storage.dll,-21824" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AB5FB87B-7CE2-4F83-915D-550846C9537B}\\LocalizedName" } ], "repeated": 0, "id": 4726 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e4" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AB5FB87B-7CE2-4F83-915D-550846C9537B}\\Icon" } ], "repeated": 0, "id": 4727 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e4" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AB5FB87B-7CE2-4F83-915D-550846C9537B}\\Security" } ], "repeated": 0, "id": 4728 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e4" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AB5FB87B-7CE2-4F83-915D-550846C9537B}\\StreamResource" } ], "repeated": 0, "id": 4729 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e4" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AB5FB87B-7CE2-4F83-915D-550846C9537B}\\StreamResourceType" } ], "repeated": 0, "id": 4730 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e4" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AB5FB87B-7CE2-4F83-915D-550846C9537B}\\LocalRedirectOnly" } ], "repeated": 0, "id": 4731 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e4" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AB5FB87B-7CE2-4F83-915D-550846C9537B}\\Roamable" } ], "repeated": 0, "id": 4732 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e4" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AB5FB87B-7CE2-4F83-915D-550846C9537B}\\PreCreate" } ], "repeated": 0, "id": 4733 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e4" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AB5FB87B-7CE2-4F83-915D-550846C9537B}\\Stream" } ], "repeated": 0, "id": 4734 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e4" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AB5FB87B-7CE2-4F83-915D-550846C9537B}\\PublishExpandedPath" } ], "repeated": 0, "id": 4735 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e4" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AB5FB87B-7CE2-4F83-915D-550846C9537B}\\DefinitionFlags" } ], "repeated": 0, "id": 4736 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e4" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AB5FB87B-7CE2-4F83-915D-550846C9537B}\\Attributes" } ], "repeated": 0, "id": 4737 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e4" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AB5FB87B-7CE2-4F83-915D-550846C9537B}\\FolderTypeID" } ], "repeated": 0, "id": 4738 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e4" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "Data", "value": "{B26388EA-AD62-430f-AF5C-CFA63BFE94A6}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AB5FB87B-7CE2-4F83-915D-550846C9537B}\\InitFolderHandler" } ], "repeated": 0, "id": 4739 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000003e4" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AB5FB87B-7CE2-4F83-915D-550846C9537B}\\PropertyBag" } ], "repeated": 0, "id": 4740 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e4" } ], "repeated": 0, "id": 4741 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000003e4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 4742 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003e4" }, { "name": "SubKey", "value": "{0AC0837C-BBF8-452A-850D-79D08E667CA7}" }, { "name": "Handle", "value": "0x000003e0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0AC0837C-BBF8-452A-850D-79D08E667CA7}" } ], "repeated": 0, "id": 4743 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e4" } ], "repeated": 0, "id": 4744 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0AC0837C-BBF8-452A-850D-79D08E667CA7}\\Category" } ], "repeated": 0, "id": 4745 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "MyComputerFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0AC0837C-BBF8-452A-850D-79D08E667CA7}\\Name" } ], "repeated": 0, "id": 4746 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0AC0837C-BBF8-452A-850D-79D08E667CA7}\\ParentFolder" } ], "repeated": 0, "id": 4747 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0AC0837C-BBF8-452A-850D-79D08E667CA7}\\Description" } ], "repeated": 0, "id": 4748 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0AC0837C-BBF8-452A-850D-79D08E667CA7}\\RelativePath" } ], "repeated": 0, "id": 4749 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "Data", "value": "::{20D04FE0-3AEA-1069-A2D8-08002B30309D}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0AC0837C-BBF8-452A-850D-79D08E667CA7}\\ParsingName" } ], "repeated": 0, "id": 4750 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0AC0837C-BBF8-452A-850D-79D08E667CA7}\\InfoTip" } ], "repeated": 0, "id": 4751 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0AC0837C-BBF8-452A-850D-79D08E667CA7}\\LocalizedName" } ], "repeated": 0, "id": 4752 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0AC0837C-BBF8-452A-850D-79D08E667CA7}\\Icon" } ], "repeated": 0, "id": 4753 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0AC0837C-BBF8-452A-850D-79D08E667CA7}\\Security" } ], "repeated": 0, "id": 4754 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0AC0837C-BBF8-452A-850D-79D08E667CA7}\\StreamResource" } ], "repeated": 0, "id": 4755 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0AC0837C-BBF8-452A-850D-79D08E667CA7}\\StreamResourceType" } ], "repeated": 0, "id": 4756 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0AC0837C-BBF8-452A-850D-79D08E667CA7}\\LocalRedirectOnly" } ], "repeated": 0, "id": 4757 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0AC0837C-BBF8-452A-850D-79D08E667CA7}\\Roamable" } ], "repeated": 0, "id": 4758 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0AC0837C-BBF8-452A-850D-79D08E667CA7}\\PreCreate" } ], "repeated": 0, "id": 4759 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0AC0837C-BBF8-452A-850D-79D08E667CA7}\\Stream" } ], "repeated": 0, "id": 4760 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0AC0837C-BBF8-452A-850D-79D08E667CA7}\\PublishExpandedPath" } ], "repeated": 0, "id": 4761 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0AC0837C-BBF8-452A-850D-79D08E667CA7}\\DefinitionFlags" } ], "repeated": 0, "id": 4762 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0AC0837C-BBF8-452A-850D-79D08E667CA7}\\Attributes" } ], "repeated": 0, "id": 4763 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0AC0837C-BBF8-452A-850D-79D08E667CA7}\\FolderTypeID" } ], "repeated": 0, "id": 4764 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0AC0837C-BBF8-452A-850D-79D08E667CA7}\\InitFolderHandler" } ], "repeated": 0, "id": 4765 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000003e0" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0AC0837C-BBF8-452A-850D-79D08E667CA7}\\PropertyBag" } ], "repeated": 0, "id": 4766 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" } ], "repeated": 0, "id": 4767 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000003e0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 4768 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003e0" }, { "name": "SubKey", "value": "{D0384E7D-BAC3-4797-8F14-CBA229B392B5}" }, { "name": "Handle", "value": "0x000003e4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D0384E7D-BAC3-4797-8F14-CBA229B392B5}" } ], "repeated": 0, "id": 4769 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" } ], "repeated": 0, "id": 4770 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e4" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "3" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D0384E7D-BAC3-4797-8F14-CBA229B392B5}\\Category" } ], "repeated": 0, "id": 4771 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e4" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "Common Administrative Tools" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D0384E7D-BAC3-4797-8F14-CBA229B392B5}\\Name" } ], "repeated": 0, "id": 4772 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e4" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "Data", "value": "{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D0384E7D-BAC3-4797-8F14-CBA229B392B5}\\ParentFolder" } ], "repeated": 0, "id": 4773 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e4" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D0384E7D-BAC3-4797-8F14-CBA229B392B5}\\Description" } ], "repeated": 0, "id": 4774 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e4" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "Administrative Tools" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D0384E7D-BAC3-4797-8F14-CBA229B392B5}\\RelativePath" } ], "repeated": 0, "id": 4775 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e4" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D0384E7D-BAC3-4797-8F14-CBA229B392B5}\\ParsingName" } ], "repeated": 0, "id": 4776 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e4" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D0384E7D-BAC3-4797-8F14-CBA229B392B5}\\InfoTip" } ], "repeated": 0, "id": 4777 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e4" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "Data", "value": "@%SystemRoot%\\system32\\shell32.dll,-21762" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D0384E7D-BAC3-4797-8F14-CBA229B392B5}\\LocalizedName" } ], "repeated": 0, "id": 4778 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e4" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D0384E7D-BAC3-4797-8F14-CBA229B392B5}\\Icon" } ], "repeated": 0, "id": 4779 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e4" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D0384E7D-BAC3-4797-8F14-CBA229B392B5}\\Security" } ], "repeated": 0, "id": 4780 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e4" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D0384E7D-BAC3-4797-8F14-CBA229B392B5}\\StreamResource" } ], "repeated": 0, "id": 4781 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e4" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D0384E7D-BAC3-4797-8F14-CBA229B392B5}\\StreamResourceType" } ], "repeated": 0, "id": 4782 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e4" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D0384E7D-BAC3-4797-8F14-CBA229B392B5}\\LocalRedirectOnly" } ], "repeated": 0, "id": 4783 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e4" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D0384E7D-BAC3-4797-8F14-CBA229B392B5}\\Roamable" } ], "repeated": 0, "id": 4784 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e4" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D0384E7D-BAC3-4797-8F14-CBA229B392B5}\\PreCreate" } ], "repeated": 0, "id": 4785 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e4" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D0384E7D-BAC3-4797-8F14-CBA229B392B5}\\Stream" } ], "repeated": 0, "id": 4786 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e4" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D0384E7D-BAC3-4797-8F14-CBA229B392B5}\\PublishExpandedPath" } ], "repeated": 0, "id": 4787 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e4" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D0384E7D-BAC3-4797-8F14-CBA229B392B5}\\DefinitionFlags" } ], "repeated": 0, "id": 4788 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e4" }, { "name": "ValueName", "value": "Attributes" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D0384E7D-BAC3-4797-8F14-CBA229B392B5}\\Attributes" } ], "repeated": 0, "id": 4789 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e4" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D0384E7D-BAC3-4797-8F14-CBA229B392B5}\\FolderTypeID" } ], "repeated": 0, "id": 4790 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e4" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D0384E7D-BAC3-4797-8F14-CBA229B392B5}\\InitFolderHandler" } ], "repeated": 0, "id": 4791 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000003e4" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D0384E7D-BAC3-4797-8F14-CBA229B392B5}\\PropertyBag" } ], "repeated": 0, "id": 4792 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e4" } ], "repeated": 0, "id": 4793 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000003e4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 4794 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003e4" }, { "name": "SubKey", "value": "{7B0DB17D-9CD2-4A93-9733-46CC89022E7C}" }, { "name": "Handle", "value": "0x000003e0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7B0DB17D-9CD2-4A93-9733-46CC89022E7C}" } ], "repeated": 0, "id": 4795 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e4" } ], "repeated": 0, "id": 4796 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7b0db17d-9cd2-4a93-9733-46cc89022e7c}\\Category" } ], "repeated": 0, "id": 4797 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "DocumentsLibrary" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7b0db17d-9cd2-4a93-9733-46cc89022e7c}\\Name" } ], "repeated": 0, "id": 4798 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "Data", "value": "{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7b0db17d-9cd2-4a93-9733-46cc89022e7c}\\ParentFolder" } ], "repeated": 0, "id": 4799 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7b0db17d-9cd2-4a93-9733-46cc89022e7c}\\Description" } ], "repeated": 0, "id": 4800 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "Documents.library-ms" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7b0db17d-9cd2-4a93-9733-46cc89022e7c}\\RelativePath" } ], "repeated": 0, "id": 4801 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "Data", "value": "::{031E4825-7B94-4dc3-B131-E946B44C8DD5}\\{7b0db17d-9cd2-4a93-9733-46cc89022e7c}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7b0db17d-9cd2-4a93-9733-46cc89022e7c}\\ParsingName" } ], "repeated": 0, "id": 4802 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7b0db17d-9cd2-4a93-9733-46cc89022e7c}\\InfoTip" } ], "repeated": 0, "id": 4803 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "Data", "value": "@%SystemRoot%\\system32\\windows.storage.dll,-34575" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7b0db17d-9cd2-4a93-9733-46cc89022e7c}\\LocalizedName" } ], "repeated": 0, "id": 4804 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Icon" }, { "name": "Data", "value": "%SystemRoot%\\system32\\imageres.dll,-1002" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7b0db17d-9cd2-4a93-9733-46cc89022e7c}\\Icon" } ], "repeated": 0, "id": 4805 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7b0db17d-9cd2-4a93-9733-46cc89022e7c}\\Security" } ], "repeated": 0, "id": 4806 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "Data", "value": "%SystemRoot%\\system32\\shell32.dll,-1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7b0db17d-9cd2-4a93-9733-46cc89022e7c}\\StreamResource" } ], "repeated": 0, "id": 4807 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "Data", "value": "LIBRARY" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7b0db17d-9cd2-4a93-9733-46cc89022e7c}\\StreamResourceType" } ], "repeated": 0, "id": 4808 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7b0db17d-9cd2-4a93-9733-46cc89022e7c}\\LocalRedirectOnly" } ], "repeated": 0, "id": 4809 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7b0db17d-9cd2-4a93-9733-46cc89022e7c}\\Roamable" } ], "repeated": 0, "id": 4810 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7b0db17d-9cd2-4a93-9733-46cc89022e7c}\\PreCreate" } ], "repeated": 0, "id": 4811 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Stream" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7b0db17d-9cd2-4a93-9733-46cc89022e7c}\\Stream" } ], "repeated": 0, "id": 4812 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7b0db17d-9cd2-4a93-9733-46cc89022e7c}\\PublishExpandedPath" } ], "repeated": 0, "id": 4813 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7b0db17d-9cd2-4a93-9733-46cc89022e7c}\\DefinitionFlags" } ], "repeated": 0, "id": 4814 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7b0db17d-9cd2-4a93-9733-46cc89022e7c}\\Attributes" } ], "repeated": 0, "id": 4815 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7b0db17d-9cd2-4a93-9733-46cc89022e7c}\\FolderTypeID" } ], "repeated": 0, "id": 4816 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7b0db17d-9cd2-4a93-9733-46cc89022e7c}\\InitFolderHandler" } ], "repeated": 0, "id": 4817 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003e0" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x000003e4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7b0db17d-9cd2-4a93-9733-46cc89022e7c}\\PropertyBag" } ], "repeated": 0, "id": 4818 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" } ], "repeated": 0, "id": 4819 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000003e0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 4820 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003e0" }, { "name": "SubKey", "value": "{A3918781-E5F2-4890-B3D9-A7E54332328C}" }, { "name": "Handle", "value": "0x000003e8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A3918781-E5F2-4890-B3D9-A7E54332328C}" } ], "repeated": 0, "id": 4821 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" } ], "repeated": 0, "id": 4822 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A3918781-E5F2-4890-B3D9-A7E54332328C}\\Category" } ], "repeated": 0, "id": 4823 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "Application Shortcuts" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A3918781-E5F2-4890-B3D9-A7E54332328C}\\Name" } ], "repeated": 0, "id": 4824 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "Data", "value": "{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A3918781-E5F2-4890-B3D9-A7E54332328C}\\ParentFolder" } ], "repeated": 0, "id": 4825 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A3918781-E5F2-4890-B3D9-A7E54332328C}\\Description" } ], "repeated": 0, "id": 4826 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "Microsoft\\Windows\\Application Shortcuts" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A3918781-E5F2-4890-B3D9-A7E54332328C}\\RelativePath" } ], "repeated": 0, "id": 4827 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A3918781-E5F2-4890-B3D9-A7E54332328C}\\ParsingName" } ], "repeated": 0, "id": 4828 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A3918781-E5F2-4890-B3D9-A7E54332328C}\\InfoTip" } ], "repeated": 0, "id": 4829 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "Data", "value": "@%SystemRoot%\\system32\\shell32.dll,-50704" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A3918781-E5F2-4890-B3D9-A7E54332328C}\\LocalizedName" } ], "repeated": 0, "id": 4830 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A3918781-E5F2-4890-B3D9-A7E54332328C}\\Icon" } ], "repeated": 0, "id": 4831 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A3918781-E5F2-4890-B3D9-A7E54332328C}\\Security" } ], "repeated": 0, "id": 4832 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A3918781-E5F2-4890-B3D9-A7E54332328C}\\StreamResource" } ], "repeated": 0, "id": 4833 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A3918781-E5F2-4890-B3D9-A7E54332328C}\\StreamResourceType" } ], "repeated": 0, "id": 4834 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A3918781-E5F2-4890-B3D9-A7E54332328C}\\LocalRedirectOnly" } ], "repeated": 0, "id": 4835 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A3918781-E5F2-4890-B3D9-A7E54332328C}\\Roamable" } ], "repeated": 0, "id": 4836 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A3918781-E5F2-4890-B3D9-A7E54332328C}\\PreCreate" } ], "repeated": 0, "id": 4837 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A3918781-E5F2-4890-B3D9-A7E54332328C}\\Stream" } ], "repeated": 0, "id": 4838 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A3918781-E5F2-4890-B3D9-A7E54332328C}\\PublishExpandedPath" } ], "repeated": 0, "id": 4839 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A3918781-E5F2-4890-B3D9-A7E54332328C}\\DefinitionFlags" } ], "repeated": 0, "id": 4840 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "Attributes" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A3918781-E5F2-4890-B3D9-A7E54332328C}\\Attributes" } ], "repeated": 0, "id": 4841 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A3918781-E5F2-4890-B3D9-A7E54332328C}\\FolderTypeID" } ], "repeated": 0, "id": 4842 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A3918781-E5F2-4890-B3D9-A7E54332328C}\\InitFolderHandler" } ], "repeated": 0, "id": 4843 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000003e8" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A3918781-E5F2-4890-B3D9-A7E54332328C}\\PropertyBag" } ], "repeated": 0, "id": 4844 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e8" } ], "repeated": 0, "id": 4845 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000003e8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 4846 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003e8" }, { "name": "SubKey", "value": "{B7BEDE81-DF94-4682-A7D8-57A52620B86F}" }, { "name": "Handle", "value": "0x000003e0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B7BEDE81-DF94-4682-A7D8-57A52620B86F}" } ], "repeated": 0, "id": 4847 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e8" } ], "repeated": 0, "id": 4848 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{b7bede81-df94-4682-a7d8-57a52620b86f}\\Category" } ], "repeated": 0, "id": 4849 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "Screenshots" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{b7bede81-df94-4682-a7d8-57a52620b86f}\\Name" } ], "repeated": 0, "id": 4850 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "Data", "value": "{33E28130-4E1E-4676-835A-98395C3BC3BB}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{b7bede81-df94-4682-a7d8-57a52620b86f}\\ParentFolder" } ], "repeated": 0, "id": 4851 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{b7bede81-df94-4682-a7d8-57a52620b86f}\\Description" } ], "repeated": 0, "id": 4852 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "Screenshots" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{b7bede81-df94-4682-a7d8-57a52620b86f}\\RelativePath" } ], "repeated": 0, "id": 4853 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{b7bede81-df94-4682-a7d8-57a52620b86f}\\ParsingName" } ], "repeated": 0, "id": 4854 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{b7bede81-df94-4682-a7d8-57a52620b86f}\\InfoTip" } ], "repeated": 0, "id": 4855 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "Data", "value": "@%SystemRoot%\\system32\\windows.storage.dll,-21823" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{b7bede81-df94-4682-a7d8-57a52620b86f}\\LocalizedName" } ], "repeated": 0, "id": 4856 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{b7bede81-df94-4682-a7d8-57a52620b86f}\\Icon" } ], "repeated": 0, "id": 4857 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{b7bede81-df94-4682-a7d8-57a52620b86f}\\Security" } ], "repeated": 0, "id": 4858 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{b7bede81-df94-4682-a7d8-57a52620b86f}\\StreamResource" } ], "repeated": 0, "id": 4859 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{b7bede81-df94-4682-a7d8-57a52620b86f}\\StreamResourceType" } ], "repeated": 0, "id": 4860 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{b7bede81-df94-4682-a7d8-57a52620b86f}\\LocalRedirectOnly" } ], "repeated": 0, "id": 4861 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{b7bede81-df94-4682-a7d8-57a52620b86f}\\Roamable" } ], "repeated": 0, "id": 4862 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{b7bede81-df94-4682-a7d8-57a52620b86f}\\PreCreate" } ], "repeated": 0, "id": 4863 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{b7bede81-df94-4682-a7d8-57a52620b86f}\\Stream" } ], "repeated": 0, "id": 4864 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{b7bede81-df94-4682-a7d8-57a52620b86f}\\PublishExpandedPath" } ], "repeated": 0, "id": 4865 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{b7bede81-df94-4682-a7d8-57a52620b86f}\\DefinitionFlags" } ], "repeated": 0, "id": 4866 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{b7bede81-df94-4682-a7d8-57a52620b86f}\\Attributes" } ], "repeated": 0, "id": 4867 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{b7bede81-df94-4682-a7d8-57a52620b86f}\\FolderTypeID" } ], "repeated": 0, "id": 4868 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{b7bede81-df94-4682-a7d8-57a52620b86f}\\InitFolderHandler" } ], "repeated": 0, "id": 4869 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000003e0" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{b7bede81-df94-4682-a7d8-57a52620b86f}\\PropertyBag" } ], "repeated": 0, "id": 4870 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" } ], "repeated": 0, "id": 4871 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000003e0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 4872 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003e0" }, { "name": "SubKey", "value": "{3B193882-D3AD-4EAB-965A-69829D1FB59F}" }, { "name": "Handle", "value": "0x000003e8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3B193882-D3AD-4EAB-965A-69829D1FB59F}" } ], "repeated": 0, "id": 4873 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" } ], "repeated": 0, "id": 4874 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3B193882-D3AD-4eab-965A-69829D1FB59F}\\Category" } ], "repeated": 0, "id": 4875 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "SavedPictures" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3B193882-D3AD-4eab-965A-69829D1FB59F}\\Name" } ], "repeated": 0, "id": 4876 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "Data", "value": "{33E28130-4E1E-4676-835A-98395C3BC3BB}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3B193882-D3AD-4eab-965A-69829D1FB59F}\\ParentFolder" } ], "repeated": 0, "id": 4877 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3B193882-D3AD-4eab-965A-69829D1FB59F}\\Description" } ], "repeated": 0, "id": 4878 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "Saved Pictures" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3B193882-D3AD-4eab-965A-69829D1FB59F}\\RelativePath" } ], "repeated": 0, "id": 4879 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3B193882-D3AD-4eab-965A-69829D1FB59F}\\ParsingName" } ], "repeated": 0, "id": 4880 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3B193882-D3AD-4eab-965A-69829D1FB59F}\\InfoTip" } ], "repeated": 0, "id": 4881 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "Data", "value": "@%SystemRoot%\\system32\\windows.storage.dll,-34583" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3B193882-D3AD-4eab-965A-69829D1FB59F}\\LocalizedName" } ], "repeated": 0, "id": 4882 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3B193882-D3AD-4eab-965A-69829D1FB59F}\\Icon" } ], "repeated": 0, "id": 4883 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3B193882-D3AD-4eab-965A-69829D1FB59F}\\Security" } ], "repeated": 0, "id": 4884 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3B193882-D3AD-4eab-965A-69829D1FB59F}\\StreamResource" } ], "repeated": 0, "id": 4885 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3B193882-D3AD-4eab-965A-69829D1FB59F}\\StreamResourceType" } ], "repeated": 0, "id": 4886 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3B193882-D3AD-4eab-965A-69829D1FB59F}\\LocalRedirectOnly" } ], "repeated": 0, "id": 4887 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3B193882-D3AD-4eab-965A-69829D1FB59F}\\Roamable" } ], "repeated": 0, "id": 4888 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3B193882-D3AD-4eab-965A-69829D1FB59F}\\PreCreate" } ], "repeated": 0, "id": 4889 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3B193882-D3AD-4eab-965A-69829D1FB59F}\\Stream" } ], "repeated": 0, "id": 4890 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3B193882-D3AD-4eab-965A-69829D1FB59F}\\PublishExpandedPath" } ], "repeated": 0, "id": 4891 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3B193882-D3AD-4eab-965A-69829D1FB59F}\\DefinitionFlags" } ], "repeated": 0, "id": 4892 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3B193882-D3AD-4eab-965A-69829D1FB59F}\\Attributes" } ], "repeated": 0, "id": 4893 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3B193882-D3AD-4eab-965A-69829D1FB59F}\\FolderTypeID" } ], "repeated": 0, "id": 4894 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3B193882-D3AD-4eab-965A-69829D1FB59F}\\InitFolderHandler" } ], "repeated": 0, "id": 4895 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000003e8" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3B193882-D3AD-4eab-965A-69829D1FB59F}\\PropertyBag" } ], "repeated": 0, "id": 4896 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e8" } ], "repeated": 0, "id": 4897 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000003e8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 4898 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003e8" }, { "name": "SubKey", "value": "{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}" }, { "name": "Handle", "value": "0x000003e0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}" } ], "repeated": 0, "id": 4899 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e8" } ], "repeated": 0, "id": 4900 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}\\Category" } ], "repeated": 0, "id": 4901 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "Common AppData" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}\\Name" } ], "repeated": 0, "id": 4902 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}\\ParentFolder" } ], "repeated": 0, "id": 4903 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}\\Description" } ], "repeated": 0, "id": 4904 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}\\RelativePath" } ], "repeated": 0, "id": 4905 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}\\ParsingName" } ], "repeated": 0, "id": 4906 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}\\InfoTip" } ], "repeated": 0, "id": 4907 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}\\LocalizedName" } ], "repeated": 0, "id": 4908 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}\\Icon" } ], "repeated": 0, "id": 4909 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}\\Security" } ], "repeated": 0, "id": 4910 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}\\StreamResource" } ], "repeated": 0, "id": 4911 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}\\StreamResourceType" } ], "repeated": 0, "id": 4912 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}\\LocalRedirectOnly" } ], "repeated": 0, "id": 4913 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}\\Roamable" } ], "repeated": 0, "id": 4914 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}\\PreCreate" } ], "repeated": 0, "id": 4915 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}\\Stream" } ], "repeated": 0, "id": 4916 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}\\PublishExpandedPath" } ], "repeated": 0, "id": 4917 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}\\DefinitionFlags" } ], "repeated": 0, "id": 4918 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}\\Attributes" } ], "repeated": 0, "id": 4919 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}\\FolderTypeID" } ], "repeated": 0, "id": 4920 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}\\InitFolderHandler" } ], "repeated": 0, "id": 4921 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000003e0" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}\\PropertyBag" } ], "repeated": 0, "id": 4922 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" } ], "repeated": 0, "id": 4923 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000003e0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 4924 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003e0" }, { "name": "SubKey", "value": "{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}" }, { "name": "Handle", "value": "0x000003e8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}" } ], "repeated": 0, "id": 4925 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" } ], "repeated": 0, "id": 4926 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}\\Category" } ], "repeated": 0, "id": 4927 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "Local AppData" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}\\Name" } ], "repeated": 0, "id": 4928 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}\\ParentFolder" } ], "repeated": 0, "id": 4929 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}\\Description" } ], "repeated": 0, "id": 4930 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "AppData\\Local" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}\\RelativePath" } ], "repeated": 0, "id": 4931 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}\\ParsingName" } ], "repeated": 0, "id": 4932 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}\\InfoTip" } ], "repeated": 0, "id": 4933 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}\\LocalizedName" } ], "repeated": 0, "id": 4934 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}\\Icon" } ], "repeated": 0, "id": 4935 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}\\Security" } ], "repeated": 0, "id": 4936 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}\\StreamResource" } ], "repeated": 0, "id": 4937 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}\\StreamResourceType" } ], "repeated": 0, "id": 4938 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}\\LocalRedirectOnly" } ], "repeated": 0, "id": 4939 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}\\Roamable" } ], "repeated": 0, "id": 4940 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}\\PreCreate" } ], "repeated": 0, "id": 4941 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}\\Stream" } ], "repeated": 0, "id": 4942 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}\\PublishExpandedPath" } ], "repeated": 0, "id": 4943 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}\\DefinitionFlags" } ], "repeated": 0, "id": 4944 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}\\Attributes" } ], "repeated": 0, "id": 4945 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}\\FolderTypeID" } ], "repeated": 0, "id": 4946 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}\\InitFolderHandler" } ], "repeated": 0, "id": 4947 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000003e8" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}\\PropertyBag" } ], "repeated": 0, "id": 4948 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e8" } ], "repeated": 0, "id": 4949 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000003e8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 4950 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003e8" }, { "name": "SubKey", "value": "{754AC886-DF64-4CBA-86B5-F7FBF4FBCEF5}" }, { "name": "Handle", "value": "0x000003e0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{754AC886-DF64-4CBA-86B5-F7FBF4FBCEF5}" } ], "repeated": 0, "id": 4951 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e8" } ], "repeated": 0, "id": 4952 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{754AC886-DF64-4CBA-86B5-F7FBF4FBCEF5}\\Category" } ], "repeated": 0, "id": 4953 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "ThisPCDesktopFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{754AC886-DF64-4CBA-86B5-F7FBF4FBCEF5}\\Name" } ], "repeated": 0, "id": 4954 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{754AC886-DF64-4CBA-86B5-F7FBF4FBCEF5}\\ParentFolder" } ], "repeated": 0, "id": 4955 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{754AC886-DF64-4CBA-86B5-F7FBF4FBCEF5}\\Description" } ], "repeated": 0, "id": 4956 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "Desktop" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{754AC886-DF64-4CBA-86B5-F7FBF4FBCEF5}\\RelativePath" } ], "repeated": 0, "id": 4957 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "Data", "value": "shell:::{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\::{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{754AC886-DF64-4CBA-86B5-F7FBF4FBCEF5}\\ParsingName" } ], "repeated": 0, "id": 4958 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{754AC886-DF64-4CBA-86B5-F7FBF4FBCEF5}\\InfoTip" } ], "repeated": 0, "id": 4959 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "Data", "value": "@%SystemRoot%\\system32\\shell32.dll,-21769" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{754AC886-DF64-4CBA-86B5-F7FBF4FBCEF5}\\LocalizedName" } ], "repeated": 0, "id": 4960 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Icon" }, { "name": "Data", "value": "%SystemRoot%\\system32\\imageres.dll,-183" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{754AC886-DF64-4CBA-86B5-F7FBF4FBCEF5}\\Icon" } ], "repeated": 0, "id": 4961 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{754AC886-DF64-4CBA-86B5-F7FBF4FBCEF5}\\Security" } ], "repeated": 0, "id": 4962 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{754AC886-DF64-4CBA-86B5-F7FBF4FBCEF5}\\StreamResource" } ], "repeated": 0, "id": 4963 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{754AC886-DF64-4CBA-86B5-F7FBF4FBCEF5}\\StreamResourceType" } ], "repeated": 0, "id": 4964 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{754AC886-DF64-4CBA-86B5-F7FBF4FBCEF5}\\LocalRedirectOnly" } ], "repeated": 0, "id": 4965 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Roamable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{754AC886-DF64-4CBA-86B5-F7FBF4FBCEF5}\\Roamable" } ], "repeated": 0, "id": 4966 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{754AC886-DF64-4CBA-86B5-F7FBF4FBCEF5}\\PreCreate" } ], "repeated": 0, "id": 4967 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{754AC886-DF64-4CBA-86B5-F7FBF4FBCEF5}\\Stream" } ], "repeated": 0, "id": 4968 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{754AC886-DF64-4CBA-86B5-F7FBF4FBCEF5}\\PublishExpandedPath" } ], "repeated": 0, "id": 4969 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{754AC886-DF64-4CBA-86B5-F7FBF4FBCEF5}\\DefinitionFlags" } ], "repeated": 0, "id": 4970 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Attributes" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{754AC886-DF64-4CBA-86B5-F7FBF4FBCEF5}\\Attributes" } ], "repeated": 0, "id": 4971 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{754AC886-DF64-4CBA-86B5-F7FBF4FBCEF5}\\FolderTypeID" } ], "repeated": 0, "id": 4972 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{754AC886-DF64-4CBA-86B5-F7FBF4FBCEF5}\\InitFolderHandler" } ], "repeated": 0, "id": 4973 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000003e0" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{754AC886-DF64-4CBA-86B5-F7FBF4FBCEF5}\\PropertyBag" } ], "repeated": 0, "id": 4974 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" } ], "repeated": 0, "id": 4975 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" } ], "repeated": 0, "id": 4976 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 4977 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 4978 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000003e0" } ], "repeated": 0, "id": 4979 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4980 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "`\\xa7\\xec\\x11l\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4981 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000002e4" }, { "name": "SubKey", "value": "SessionInfo\\1" }, { "name": "Handle", "value": "0x000003e8" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1" } ], "repeated": 0, "id": 4982 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000003e8" }, { "name": "SubKey", "value": "KnownFolders" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1\\KnownFolders" } ], "repeated": 0, "id": 4983 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e8" } ], "repeated": 0, "id": 4984 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xa3\\xec\\x11l\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x80\\xe8\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4985 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003e8" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 4986 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003e8" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" }, { "name": "Handle", "value": "0x000003ec" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" } ], "repeated": 0, "id": 4987 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e8" } ], "repeated": 0, "id": 4988 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ec" }, { "name": "ValueName", "value": "{754AC886-DF64-4CBA-86B5-F7FBF4FBCEF5}" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\{754AC886-DF64-4CBA-86B5-F7FBF4FBCEF5}" } ], "repeated": 0, "id": 4989 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000003e8" } ], "repeated": 0, "id": 4990 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x90\\xea?\\xc0\\xf5\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4991 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "Handle", "value": "0x000003f0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 4992 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f0" }, { "name": "ValueName", "value": "ProfileImagePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath" } ], "repeated": 0, "id": 4993 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f0" }, { "name": "ValueName", "value": "ProfileImagePath" }, { "name": "Data", "value": "C:\\Users\\admin" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath" } ], "repeated": 0, "id": 4994 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f0" } ], "repeated": 0, "id": 4995 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e8" } ], "repeated": 0, "id": 4996 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" } ], "repeated": 0, "id": 4997 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ec" } ], "repeated": 0, "id": 4998 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000003ec" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 4999 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003ec" }, { "name": "SubKey", "value": "{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}" }, { "name": "Handle", "value": "0x000003e0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}" } ], "repeated": 0, "id": 5000 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ec" } ], "repeated": 0, "id": 5001 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "3" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}\\Category" } ], "repeated": 0, "id": 5002 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "CommonPictures" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}\\Name" } ], "repeated": 0, "id": 5003 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "Data", "value": "{DFDF76A2-C82A-4D63-906A-5644AC457385}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}\\ParentFolder" } ], "repeated": 0, "id": 5004 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}\\Description" } ], "repeated": 0, "id": 5005 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "Pictures" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}\\RelativePath" } ], "repeated": 0, "id": 5006 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}\\ParsingName" } ], "repeated": 0, "id": 5007 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "Data", "value": "@%SystemRoot%\\system32\\shell32.dll,-12688" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}\\InfoTip" } ], "repeated": 0, "id": 5008 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "Data", "value": "@%SystemRoot%\\system32\\shell32.dll,-21802" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}\\LocalizedName" } ], "repeated": 0, "id": 5009 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Icon" }, { "name": "Data", "value": "%SystemRoot%\\system32\\imageres.dll,-3" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}\\Icon" } ], "repeated": 0, "id": 5010 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}\\Security" } ], "repeated": 0, "id": 5011 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}\\StreamResource" } ], "repeated": 0, "id": 5012 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}\\StreamResourceType" } ], "repeated": 0, "id": 5013 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}\\LocalRedirectOnly" } ], "repeated": 0, "id": 5014 }, { "timestamp": "2026-05-29 01:05:17,743", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}\\Roamable" } ], "repeated": 0, "id": 5015 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}\\PreCreate" } ], "repeated": 0, "id": 5016 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}\\Stream" } ], "repeated": 0, "id": 5017 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}\\PublishExpandedPath" } ], "repeated": 0, "id": 5018 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}\\DefinitionFlags" } ], "repeated": 0, "id": 5019 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Attributes" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}\\Attributes" } ], "repeated": 0, "id": 5020 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}\\FolderTypeID" } ], "repeated": 0, "id": 5021 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}\\InitFolderHandler" } ], "repeated": 0, "id": 5022 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003e0" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x000003ec" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}\\PropertyBag" } ], "repeated": 0, "id": 5023 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" } ], "repeated": 0, "id": 5024 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000003e0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 5025 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003e0" }, { "name": "SubKey", "value": "{1E87508D-89C2-42F0-8A7E-645A0F50CA58}" }, { "name": "Handle", "value": "0x000003e8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1E87508D-89C2-42F0-8A7E-645A0F50CA58}" } ], "repeated": 0, "id": 5026 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" } ], "repeated": 0, "id": 5027 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1e87508d-89c2-42f0-8a7e-645a0f50ca58}\\Category" } ], "repeated": 0, "id": 5028 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "AppsFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1e87508d-89c2-42f0-8a7e-645a0f50ca58}\\Name" } ], "repeated": 0, "id": 5029 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1e87508d-89c2-42f0-8a7e-645a0f50ca58}\\ParentFolder" } ], "repeated": 0, "id": 5030 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1e87508d-89c2-42f0-8a7e-645a0f50ca58}\\Description" } ], "repeated": 0, "id": 5031 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1e87508d-89c2-42f0-8a7e-645a0f50ca58}\\RelativePath" } ], "repeated": 0, "id": 5032 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "Data", "value": "shell:::{4234d49b-0245-4df3-b780-3893943456e1}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1e87508d-89c2-42f0-8a7e-645a0f50ca58}\\ParsingName" } ], "repeated": 0, "id": 5033 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1e87508d-89c2-42f0-8a7e-645a0f50ca58}\\InfoTip" } ], "repeated": 0, "id": 5034 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1e87508d-89c2-42f0-8a7e-645a0f50ca58}\\LocalizedName" } ], "repeated": 0, "id": 5035 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1e87508d-89c2-42f0-8a7e-645a0f50ca58}\\Icon" } ], "repeated": 0, "id": 5036 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1e87508d-89c2-42f0-8a7e-645a0f50ca58}\\Security" } ], "repeated": 0, "id": 5037 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1e87508d-89c2-42f0-8a7e-645a0f50ca58}\\StreamResource" } ], "repeated": 0, "id": 5038 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1e87508d-89c2-42f0-8a7e-645a0f50ca58}\\StreamResourceType" } ], "repeated": 0, "id": 5039 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1e87508d-89c2-42f0-8a7e-645a0f50ca58}\\LocalRedirectOnly" } ], "repeated": 0, "id": 5040 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1e87508d-89c2-42f0-8a7e-645a0f50ca58}\\Roamable" } ], "repeated": 0, "id": 5041 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1e87508d-89c2-42f0-8a7e-645a0f50ca58}\\PreCreate" } ], "repeated": 0, "id": 5042 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1e87508d-89c2-42f0-8a7e-645a0f50ca58}\\Stream" } ], "repeated": 0, "id": 5043 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1e87508d-89c2-42f0-8a7e-645a0f50ca58}\\PublishExpandedPath" } ], "repeated": 0, "id": 5044 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1e87508d-89c2-42f0-8a7e-645a0f50ca58}\\DefinitionFlags" } ], "repeated": 0, "id": 5045 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1e87508d-89c2-42f0-8a7e-645a0f50ca58}\\Attributes" } ], "repeated": 0, "id": 5046 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1e87508d-89c2-42f0-8a7e-645a0f50ca58}\\FolderTypeID" } ], "repeated": 0, "id": 5047 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1e87508d-89c2-42f0-8a7e-645a0f50ca58}\\InitFolderHandler" } ], "repeated": 0, "id": 5048 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000003e8" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1e87508d-89c2-42f0-8a7e-645a0f50ca58}\\PropertyBag" } ], "repeated": 0, "id": 5049 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e8" } ], "repeated": 0, "id": 5050 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000003e8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 5051 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003e8" }, { "name": "SubKey", "value": "{9274BD8D-CFD1-41C3-B35E-B13F55A758F4}" }, { "name": "Handle", "value": "0x000003d4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9274BD8D-CFD1-41C3-B35E-B13F55A758F4}" } ], "repeated": 0, "id": 5052 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e8" } ], "repeated": 0, "id": 5053 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d4" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9274BD8D-CFD1-41C3-B35E-B13F55A758F4}\\Category" } ], "repeated": 0, "id": 5054 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d4" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "PrintHood" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9274BD8D-CFD1-41C3-B35E-B13F55A758F4}\\Name" } ], "repeated": 0, "id": 5055 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d4" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "Data", "value": "{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9274BD8D-CFD1-41C3-B35E-B13F55A758F4}\\ParentFolder" } ], "repeated": 0, "id": 5056 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d4" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9274BD8D-CFD1-41C3-B35E-B13F55A758F4}\\Description" } ], "repeated": 0, "id": 5057 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d4" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "Microsoft\\Windows\\Printer Shortcuts" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9274BD8D-CFD1-41C3-B35E-B13F55A758F4}\\RelativePath" } ], "repeated": 0, "id": 5058 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d4" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9274BD8D-CFD1-41C3-B35E-B13F55A758F4}\\ParsingName" } ], "repeated": 0, "id": 5059 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d4" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9274BD8D-CFD1-41C3-B35E-B13F55A758F4}\\InfoTip" } ], "repeated": 0, "id": 5060 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d4" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9274BD8D-CFD1-41C3-B35E-B13F55A758F4}\\LocalizedName" } ], "repeated": 0, "id": 5061 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d4" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9274BD8D-CFD1-41C3-B35E-B13F55A758F4}\\Icon" } ], "repeated": 0, "id": 5062 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d4" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9274BD8D-CFD1-41C3-B35E-B13F55A758F4}\\Security" } ], "repeated": 0, "id": 5063 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d4" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9274BD8D-CFD1-41C3-B35E-B13F55A758F4}\\StreamResource" } ], "repeated": 0, "id": 5064 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d4" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9274BD8D-CFD1-41C3-B35E-B13F55A758F4}\\StreamResourceType" } ], "repeated": 0, "id": 5065 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d4" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9274BD8D-CFD1-41C3-B35E-B13F55A758F4}\\LocalRedirectOnly" } ], "repeated": 0, "id": 5066 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d4" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9274BD8D-CFD1-41C3-B35E-B13F55A758F4}\\Roamable" } ], "repeated": 0, "id": 5067 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d4" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9274BD8D-CFD1-41C3-B35E-B13F55A758F4}\\PreCreate" } ], "repeated": 0, "id": 5068 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d4" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9274BD8D-CFD1-41C3-B35E-B13F55A758F4}\\Stream" } ], "repeated": 0, "id": 5069 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d4" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9274BD8D-CFD1-41C3-B35E-B13F55A758F4}\\PublishExpandedPath" } ], "repeated": 0, "id": 5070 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d4" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9274BD8D-CFD1-41C3-B35E-B13F55A758F4}\\DefinitionFlags" } ], "repeated": 0, "id": 5071 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d4" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9274BD8D-CFD1-41C3-B35E-B13F55A758F4}\\Attributes" } ], "repeated": 0, "id": 5072 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d4" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9274BD8D-CFD1-41C3-B35E-B13F55A758F4}\\FolderTypeID" } ], "repeated": 0, "id": 5073 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d4" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9274BD8D-CFD1-41C3-B35E-B13F55A758F4}\\InitFolderHandler" } ], "repeated": 0, "id": 5074 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000003d4" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9274BD8D-CFD1-41C3-B35E-B13F55A758F4}\\PropertyBag" } ], "repeated": 0, "id": 5075 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d4" } ], "repeated": 0, "id": 5076 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000003d4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 5077 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003d4" }, { "name": "SubKey", "value": "{DBE8E08E-3053-4BBC-B183-2A7B2B191E59}" }, { "name": "Handle", "value": "0x000003e8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DBE8E08E-3053-4BBC-B183-2A7B2B191E59}" } ], "repeated": 0, "id": 5078 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d4" } ], "repeated": 0, "id": 5079 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DBE8E08E-3053-4BBC-B183-2A7B2B191E59}\\Category" } ], "repeated": 0, "id": 5080 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "Development Files" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DBE8E08E-3053-4BBC-B183-2A7B2B191E59}\\Name" } ], "repeated": 0, "id": 5081 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "Data", "value": "{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DBE8E08E-3053-4BBC-B183-2A7B2B191E59}\\ParentFolder" } ], "repeated": 0, "id": 5082 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DBE8E08E-3053-4BBC-B183-2A7B2B191E59}\\Description" } ], "repeated": 0, "id": 5083 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "DevelopmentFiles" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DBE8E08E-3053-4BBC-B183-2A7B2B191E59}\\RelativePath" } ], "repeated": 0, "id": 5084 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DBE8E08E-3053-4BBC-B183-2A7B2B191E59}\\ParsingName" } ], "repeated": 0, "id": 5085 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DBE8E08E-3053-4BBC-B183-2A7B2B191E59}\\InfoTip" } ], "repeated": 0, "id": 5086 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DBE8E08E-3053-4BBC-B183-2A7B2B191E59}\\LocalizedName" } ], "repeated": 0, "id": 5087 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DBE8E08E-3053-4BBC-B183-2A7B2B191E59}\\Icon" } ], "repeated": 0, "id": 5088 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DBE8E08E-3053-4BBC-B183-2A7B2B191E59}\\Security" } ], "repeated": 0, "id": 5089 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DBE8E08E-3053-4BBC-B183-2A7B2B191E59}\\StreamResource" } ], "repeated": 0, "id": 5090 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DBE8E08E-3053-4BBC-B183-2A7B2B191E59}\\StreamResourceType" } ], "repeated": 0, "id": 5091 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DBE8E08E-3053-4BBC-B183-2A7B2B191E59}\\LocalRedirectOnly" } ], "repeated": 0, "id": 5092 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DBE8E08E-3053-4BBC-B183-2A7B2B191E59}\\Roamable" } ], "repeated": 0, "id": 5093 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DBE8E08E-3053-4BBC-B183-2A7B2B191E59}\\PreCreate" } ], "repeated": 0, "id": 5094 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DBE8E08E-3053-4BBC-B183-2A7B2B191E59}\\Stream" } ], "repeated": 0, "id": 5095 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DBE8E08E-3053-4BBC-B183-2A7B2B191E59}\\PublishExpandedPath" } ], "repeated": 0, "id": 5096 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DBE8E08E-3053-4BBC-B183-2A7B2B191E59}\\DefinitionFlags" } ], "repeated": 0, "id": 5097 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DBE8E08E-3053-4BBC-B183-2A7B2B191E59}\\Attributes" } ], "repeated": 0, "id": 5098 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DBE8E08E-3053-4BBC-B183-2A7B2B191E59}\\FolderTypeID" } ], "repeated": 0, "id": 5099 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DBE8E08E-3053-4BBC-B183-2A7B2B191E59}\\InitFolderHandler" } ], "repeated": 0, "id": 5100 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000003e8" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DBE8E08E-3053-4BBC-B183-2A7B2B191E59}\\PropertyBag" } ], "repeated": 0, "id": 5101 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e8" } ], "repeated": 0, "id": 5102 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000003e8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 5103 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003e8" }, { "name": "SubKey", "value": "{69D2CF90-FC33-4FB7-9A0C-EBB0F0FCB43C}" }, { "name": "Handle", "value": "0x000003d4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{69D2CF90-FC33-4FB7-9A0C-EBB0F0FCB43C}" } ], "repeated": 0, "id": 5104 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e8" } ], "repeated": 0, "id": 5105 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d4" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{69D2CF90-FC33-4FB7-9A0C-EBB0F0FCB43C}\\Category" } ], "repeated": 0, "id": 5106 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d4" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "PhotoAlbums" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{69D2CF90-FC33-4FB7-9A0C-EBB0F0FCB43C}\\Name" } ], "repeated": 0, "id": 5107 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d4" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "Data", "value": "{33E28130-4E1E-4676-835A-98395C3BC3BB}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{69D2CF90-FC33-4FB7-9A0C-EBB0F0FCB43C}\\ParentFolder" } ], "repeated": 0, "id": 5108 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d4" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{69D2CF90-FC33-4FB7-9A0C-EBB0F0FCB43C}\\Description" } ], "repeated": 0, "id": 5109 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d4" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "Slide Shows" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{69D2CF90-FC33-4FB7-9A0C-EBB0F0FCB43C}\\RelativePath" } ], "repeated": 0, "id": 5110 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d4" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{69D2CF90-FC33-4FB7-9A0C-EBB0F0FCB43C}\\ParsingName" } ], "repeated": 0, "id": 5111 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d4" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{69D2CF90-FC33-4FB7-9A0C-EBB0F0FCB43C}\\InfoTip" } ], "repeated": 0, "id": 5112 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d4" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "Data", "value": "@%SystemRoot%\\system32\\shell32.dll,-21819" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{69D2CF90-FC33-4FB7-9A0C-EBB0F0FCB43C}\\LocalizedName" } ], "repeated": 0, "id": 5113 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d4" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{69D2CF90-FC33-4FB7-9A0C-EBB0F0FCB43C}\\Icon" } ], "repeated": 0, "id": 5114 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d4" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{69D2CF90-FC33-4FB7-9A0C-EBB0F0FCB43C}\\Security" } ], "repeated": 0, "id": 5115 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d4" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{69D2CF90-FC33-4FB7-9A0C-EBB0F0FCB43C}\\StreamResource" } ], "repeated": 0, "id": 5116 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d4" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{69D2CF90-FC33-4FB7-9A0C-EBB0F0FCB43C}\\StreamResourceType" } ], "repeated": 0, "id": 5117 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d4" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{69D2CF90-FC33-4FB7-9A0C-EBB0F0FCB43C}\\LocalRedirectOnly" } ], "repeated": 0, "id": 5118 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d4" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{69D2CF90-FC33-4FB7-9A0C-EBB0F0FCB43C}\\Roamable" } ], "repeated": 0, "id": 5119 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d4" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{69D2CF90-FC33-4FB7-9A0C-EBB0F0FCB43C}\\PreCreate" } ], "repeated": 0, "id": 5120 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d4" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{69D2CF90-FC33-4FB7-9A0C-EBB0F0FCB43C}\\Stream" } ], "repeated": 0, "id": 5121 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d4" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{69D2CF90-FC33-4FB7-9A0C-EBB0F0FCB43C}\\PublishExpandedPath" } ], "repeated": 0, "id": 5122 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d4" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{69D2CF90-FC33-4FB7-9A0C-EBB0F0FCB43C}\\DefinitionFlags" } ], "repeated": 0, "id": 5123 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d4" }, { "name": "ValueName", "value": "Attributes" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{69D2CF90-FC33-4FB7-9A0C-EBB0F0FCB43C}\\Attributes" } ], "repeated": 0, "id": 5124 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d4" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{69D2CF90-FC33-4FB7-9A0C-EBB0F0FCB43C}\\FolderTypeID" } ], "repeated": 0, "id": 5125 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d4" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{69D2CF90-FC33-4FB7-9A0C-EBB0F0FCB43C}\\InitFolderHandler" } ], "repeated": 0, "id": 5126 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000003d4" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{69D2CF90-FC33-4FB7-9A0C-EBB0F0FCB43C}\\PropertyBag" } ], "repeated": 0, "id": 5127 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d4" } ], "repeated": 0, "id": 5128 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000003d4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 5129 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003d4" }, { "name": "SubKey", "value": "{374DE290-123F-4565-9164-39C4925E467B}" }, { "name": "Handle", "value": "0x000003e8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{374DE290-123F-4565-9164-39C4925E467B}" } ], "repeated": 0, "id": 5130 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d4" } ], "repeated": 0, "id": 5131 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{374DE290-123F-4565-9164-39C4925E467B}\\Category" } ], "repeated": 0, "id": 5132 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "Downloads" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{374DE290-123F-4565-9164-39C4925E467B}\\Name" } ], "repeated": 0, "id": 5133 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{374DE290-123F-4565-9164-39C4925E467B}\\ParentFolder" } ], "repeated": 0, "id": 5134 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{374DE290-123F-4565-9164-39C4925E467B}\\Description" } ], "repeated": 0, "id": 5135 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "Downloads" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{374DE290-123F-4565-9164-39C4925E467B}\\RelativePath" } ], "repeated": 0, "id": 5136 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "Data", "value": "shell:::{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\::{374DE290-123F-4565-9164-39C4925E467B}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{374DE290-123F-4565-9164-39C4925E467B}\\ParsingName" } ], "repeated": 0, "id": 5137 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{374DE290-123F-4565-9164-39C4925E467B}\\InfoTip" } ], "repeated": 0, "id": 5138 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "Data", "value": "@%SystemRoot%\\system32\\windows.storage.dll,-21798" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{374DE290-123F-4565-9164-39C4925E467B}\\LocalizedName" } ], "repeated": 0, "id": 5139 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "Icon" }, { "name": "Data", "value": "%SystemRoot%\\system32\\imageres.dll,-184" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{374DE290-123F-4565-9164-39C4925E467B}\\Icon" } ], "repeated": 0, "id": 5140 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "Security" }, { "name": "Data", "value": "S:AI(RA;IOOICI;;;;WD;(\"IMAGELOAD\",TU,0x0,0x01))" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{374DE290-123F-4565-9164-39C4925E467B}\\Security" } ], "repeated": 0, "id": 5141 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{374DE290-123F-4565-9164-39C4925E467B}\\StreamResource" } ], "repeated": 0, "id": 5142 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{374DE290-123F-4565-9164-39C4925E467B}\\StreamResourceType" } ], "repeated": 0, "id": 5143 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{374DE290-123F-4565-9164-39C4925E467B}\\LocalRedirectOnly" } ], "repeated": 0, "id": 5144 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "Roamable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{374DE290-123F-4565-9164-39C4925E467B}\\Roamable" } ], "repeated": 0, "id": 5145 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{374DE290-123F-4565-9164-39C4925E467B}\\PreCreate" } ], "repeated": 0, "id": 5146 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{374DE290-123F-4565-9164-39C4925E467B}\\Stream" } ], "repeated": 0, "id": 5147 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{374DE290-123F-4565-9164-39C4925E467B}\\PublishExpandedPath" } ], "repeated": 0, "id": 5148 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{374DE290-123F-4565-9164-39C4925E467B}\\DefinitionFlags" } ], "repeated": 0, "id": 5149 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "Attributes" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{374DE290-123F-4565-9164-39C4925E467B}\\Attributes" } ], "repeated": 0, "id": 5150 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "Data", "value": "{885A186E-A440-4ADA-812B-DB871B942259}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{374DE290-123F-4565-9164-39C4925E467B}\\FolderTypeID" } ], "repeated": 0, "id": 5151 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{374DE290-123F-4565-9164-39C4925E467B}\\InitFolderHandler" } ], "repeated": 0, "id": 5152 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003e8" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x000003d4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{374DE290-123F-4565-9164-39C4925E467B}\\PropertyBag" } ], "repeated": 0, "id": 5153 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e8" } ], "repeated": 0, "id": 5154 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d4" }, { "name": "ValueName", "value": "ThisPCPolicy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{374DE290-123F-4565-9164-39C4925E467B}\\PropertyBag\\ThisPCPolicy" } ], "repeated": 0, "id": 5155 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d4" }, { "name": "ValueName", "value": "ThisPCPolicy" }, { "name": "Data", "value": "Hide" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{374DE290-123F-4565-9164-39C4925E467B}\\PropertyBag\\ThisPCPolicy" } ], "repeated": 0, "id": 5156 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000003e8" } ], "repeated": 0, "id": 5157 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5158 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e8" } ], "repeated": 0, "id": 5159 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x10\\xc9\\xec\\x11l\\x00\\x00\\x00\\x00\\x00\\x00\\x00l\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00l\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00<\\x00\\x00\\x00\\x00\\x00\\x00\\x00<\\xe6?\\xc0\\xf5\\x01\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5160 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003e8" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 5161 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003e8" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5162 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000003e8" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 5163 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x0000000c" }, { "name": "TokenHandle", "value": "0x000003f0" } ], "repeated": 0, "id": 5164 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" }, { "name": "Handle", "value": "0x000003f4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" } ], "repeated": 0, "id": 5165 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f4" }, { "name": "ValueName", "value": "RDVirtualizationPool" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\RDVirtualizationPool" } ], "repeated": 0, "id": 5166 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f4" } ], "repeated": 0, "id": 5167 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" }, { "name": "Handle", "value": "0x000003f4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" } ], "repeated": 0, "id": 5168 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f4" }, { "name": "ValueName", "value": "RDVirtualizationPool" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\RDVirtualizationPool" } ], "repeated": 0, "id": 5169 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f4" } ], "repeated": 0, "id": 5170 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x90\\xc9\\xec\\x11l\\x00\\x00\\x00\\x00\\x00\\x00\\x00l\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xa0\\xbd}\\x1a\\xff\\x7f\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xf8\\x81}\\x1a" } ], "repeated": 0, "id": 5171 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\fdeploy" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\fdeploy" } ], "repeated": 0, "id": 5172 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f0" } ], "repeated": 0, "id": 5173 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003e8" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" }, { "name": "Handle", "value": "0x000003f0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" } ], "repeated": 0, "id": 5174 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f0" } ], "repeated": 0, "id": 5175 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e8" } ], "repeated": 0, "id": 5176 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000003e8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 5177 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000003e8" }, { "name": "SubKey", "value": "{859EAD94-2E85-48AD-A71A-0969CB56A6CD}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{859EAD94-2E85-48AD-A71A-0969CB56A6CD}" } ], "repeated": 0, "id": 5178 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e8" } ], "repeated": 0, "id": 5179 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000003e8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 5180 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003e8" }, { "name": "SubKey", "value": "{7AD67899-66AF-43BA-9156-6AAD42E6C596}" }, { "name": "Handle", "value": "0x000003f0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7AD67899-66AF-43BA-9156-6AAD42E6C596}" } ], "repeated": 0, "id": 5181 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e8" } ], "repeated": 0, "id": 5182 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f0" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7AD67899-66AF-43BA-9156-6AAD42E6C596}\\Category" } ], "repeated": 0, "id": 5183 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f0" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "AppMods" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7AD67899-66AF-43BA-9156-6AAD42E6C596}\\Name" } ], "repeated": 0, "id": 5184 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f0" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "Data", "value": "{5E6C858F-0E22-4760-9AFE-EA3317B67173}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7AD67899-66AF-43BA-9156-6AAD42E6C596}\\ParentFolder" } ], "repeated": 0, "id": 5185 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f0" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7AD67899-66AF-43BA-9156-6AAD42E6C596}\\Description" } ], "repeated": 0, "id": 5186 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f0" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "AppMods" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7AD67899-66AF-43BA-9156-6AAD42E6C596}\\RelativePath" } ], "repeated": 0, "id": 5187 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f0" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7AD67899-66AF-43BA-9156-6AAD42E6C596}\\ParsingName" } ], "repeated": 0, "id": 5188 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f0" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7AD67899-66AF-43BA-9156-6AAD42E6C596}\\InfoTip" } ], "repeated": 0, "id": 5189 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f0" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "Data", "value": "@%SystemRoot%\\system32\\windows.storage.dll,-21829" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7AD67899-66AF-43BA-9156-6AAD42E6C596}\\LocalizedName" } ], "repeated": 0, "id": 5190 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f0" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7AD67899-66AF-43BA-9156-6AAD42E6C596}\\Icon" } ], "repeated": 0, "id": 5191 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f0" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7AD67899-66AF-43BA-9156-6AAD42E6C596}\\Security" } ], "repeated": 0, "id": 5192 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f0" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7AD67899-66AF-43BA-9156-6AAD42E6C596}\\StreamResource" } ], "repeated": 0, "id": 5193 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f0" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7AD67899-66AF-43BA-9156-6AAD42E6C596}\\StreamResourceType" } ], "repeated": 0, "id": 5194 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f0" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7AD67899-66AF-43BA-9156-6AAD42E6C596}\\LocalRedirectOnly" } ], "repeated": 0, "id": 5195 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f0" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7AD67899-66AF-43BA-9156-6AAD42E6C596}\\Roamable" } ], "repeated": 0, "id": 5196 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f0" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7AD67899-66AF-43BA-9156-6AAD42E6C596}\\PreCreate" } ], "repeated": 0, "id": 5197 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f0" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7AD67899-66AF-43BA-9156-6AAD42E6C596}\\Stream" } ], "repeated": 0, "id": 5198 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f0" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7AD67899-66AF-43BA-9156-6AAD42E6C596}\\PublishExpandedPath" } ], "repeated": 0, "id": 5199 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f0" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7AD67899-66AF-43BA-9156-6AAD42E6C596}\\DefinitionFlags" } ], "repeated": 0, "id": 5200 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f0" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7AD67899-66AF-43BA-9156-6AAD42E6C596}\\Attributes" } ], "repeated": 0, "id": 5201 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f0" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "Data", "value": "{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7AD67899-66AF-43BA-9156-6AAD42E6C596}\\FolderTypeID" } ], "repeated": 0, "id": 5202 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f0" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7AD67899-66AF-43BA-9156-6AAD42E6C596}\\InitFolderHandler" } ], "repeated": 0, "id": 5203 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000003f0" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7AD67899-66AF-43BA-9156-6AAD42E6C596}\\PropertyBag" } ], "repeated": 0, "id": 5204 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f0" } ], "repeated": 0, "id": 5205 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" } ], "repeated": 0, "id": 5206 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 5207 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 5208 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000003f0" } ], "repeated": 0, "id": 5209 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5210 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "`\\xa7\\xec\\x11l\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5211 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000002e4" }, { "name": "SubKey", "value": "SessionInfo\\1" }, { "name": "Handle", "value": "0x000003d8" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1" } ], "repeated": 0, "id": 5212 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000003d8" }, { "name": "SubKey", "value": "KnownFolders" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1\\KnownFolders" } ], "repeated": 0, "id": 5213 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d8" } ], "repeated": 0, "id": 5214 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xa3\\xec\\x11l\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x80\\xd8\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5215 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003e0" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 5216 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003e0" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" }, { "name": "Handle", "value": "0x00000398" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" } ], "repeated": 0, "id": 5217 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" } ], "repeated": 0, "id": 5218 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "{7AD67899-66AF-43BA-9156-6AAD42E6C596}" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\{7AD67899-66AF-43BA-9156-6AAD42E6C596}" } ], "repeated": 0, "id": 5219 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000003f8" } ], "repeated": 0, "id": 5220 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xc0\\xec?\\xc0\\xf5\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5221 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "Handle", "value": "0x000003fc" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 5222 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003fc" }, { "name": "ValueName", "value": "ProfileImagePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath" } ], "repeated": 0, "id": 5223 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003fc" }, { "name": "ValueName", "value": "ProfileImagePath" }, { "name": "Data", "value": "C:\\Users\\admin" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath" } ], "repeated": 0, "id": 5224 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003fc" } ], "repeated": 0, "id": 5225 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f8" } ], "repeated": 0, "id": 5226 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f0" } ], "repeated": 0, "id": 5227 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" } ], "repeated": 0, "id": 5228 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000388" }, { "name": "ValueName", "value": "ThisPCPolicy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{a0c69a99-21c8-4671-8703-7934162fcf1d}\\PropertyBag\\ThisPCPolicy" } ], "repeated": 0, "id": 5229 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000388" }, { "name": "ValueName", "value": "ThisPCPolicy" }, { "name": "Data", "value": "Show" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{a0c69a99-21c8-4671-8703-7934162fcf1d}\\PropertyBag\\ThisPCPolicy" } ], "repeated": 0, "id": 5230 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000388" }, { "name": "ValueName", "value": "BaseFolderId" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{a0c69a99-21c8-4671-8703-7934162fcf1d}\\PropertyBag\\BaseFolderId" } ], "repeated": 0, "id": 5231 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000388" }, { "name": "ValueName", "value": "BaseFolderId" }, { "name": "Data", "value": "{4BD8D571-6D19-48D3-BE97-422220080E43}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{a0c69a99-21c8-4671-8703-7934162fcf1d}\\PropertyBag\\BaseFolderId" } ], "repeated": 0, "id": 5232 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000398" } ], "repeated": 0, "id": 5233 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5234 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" } ], "repeated": 0, "id": 5235 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x10\\xc9\\xec\\x11l\\x00\\x00\\x00\\x00\\x00\\x00\\x00l\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00l\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00<\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\xe9?\\xc0\\xf5\\x01\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5236 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000398" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 5237 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000398" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5238 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000398" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 5239 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x0000000c" }, { "name": "TokenHandle", "value": "0x000003f8" } ], "repeated": 0, "id": 5240 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" }, { "name": "Handle", "value": "0x000003fc" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" } ], "repeated": 0, "id": 5241 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003fc" }, { "name": "ValueName", "value": "RDVirtualizationPool" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\RDVirtualizationPool" } ], "repeated": 0, "id": 5242 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003fc" } ], "repeated": 0, "id": 5243 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" }, { "name": "Handle", "value": "0x000003fc" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" } ], "repeated": 0, "id": 5244 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003fc" }, { "name": "ValueName", "value": "RDVirtualizationPool" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\RDVirtualizationPool" } ], "repeated": 0, "id": 5245 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003fc" } ], "repeated": 0, "id": 5246 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x90\\xc9\\xec\\x11l\\x00\\x00\\x00\\x00\\x00\\x00\\x00l\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xa0\\xbd}\\x1a\\xff\\x7f\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xf8\\x81}\\x1a" } ], "repeated": 0, "id": 5247 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\fdeploy" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\fdeploy" } ], "repeated": 0, "id": 5248 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f8" } ], "repeated": 0, "id": 5249 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000398" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" }, { "name": "Handle", "value": "0x000003f8" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" } ], "repeated": 0, "id": 5250 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f8" } ], "repeated": 0, "id": 5251 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" } ], "repeated": 0, "id": 5252 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" } ], "repeated": 0, "id": 5253 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 5254 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 5255 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x00000398" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 5256 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000398" }, { "name": "SubKey", "value": "{A305CE99-F527-492B-8B1A-7E76FA98D6E4}" }, { "name": "Handle", "value": "0x000003f8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A305CE99-F527-492B-8B1A-7E76FA98D6E4}" } ], "repeated": 0, "id": 5257 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" } ], "repeated": 0, "id": 5258 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f8" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{a305ce99-f527-492b-8b1a-7e76fa98d6e4}\\Category" } ], "repeated": 0, "id": 5259 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f8" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "AppUpdatesFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{a305ce99-f527-492b-8b1a-7e76fa98d6e4}\\Name" } ], "repeated": 0, "id": 5260 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f8" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{a305ce99-f527-492b-8b1a-7e76fa98d6e4}\\ParentFolder" } ], "repeated": 0, "id": 5261 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f8" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{a305ce99-f527-492b-8b1a-7e76fa98d6e4}\\Description" } ], "repeated": 0, "id": 5262 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f8" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{a305ce99-f527-492b-8b1a-7e76fa98d6e4}\\RelativePath" } ], "repeated": 0, "id": 5263 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f8" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "Data", "value": "::{26EE0668-A00A-44D7-9371-BEB064C98683}\\0\\::{7b81be6a-ce2b-4676-a29e-eb907a5126c5}\\::{d450a8a1-9568-45c7-9c0e-b4f9fb4537bd}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{a305ce99-f527-492b-8b1a-7e76fa98d6e4}\\ParsingName" } ], "repeated": 0, "id": 5264 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f8" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{a305ce99-f527-492b-8b1a-7e76fa98d6e4}\\InfoTip" } ], "repeated": 0, "id": 5265 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f8" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{a305ce99-f527-492b-8b1a-7e76fa98d6e4}\\LocalizedName" } ], "repeated": 0, "id": 5266 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f8" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{a305ce99-f527-492b-8b1a-7e76fa98d6e4}\\Icon" } ], "repeated": 0, "id": 5267 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f8" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{a305ce99-f527-492b-8b1a-7e76fa98d6e4}\\Security" } ], "repeated": 0, "id": 5268 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f8" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{a305ce99-f527-492b-8b1a-7e76fa98d6e4}\\StreamResource" } ], "repeated": 0, "id": 5269 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f8" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{a305ce99-f527-492b-8b1a-7e76fa98d6e4}\\StreamResourceType" } ], "repeated": 0, "id": 5270 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f8" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{a305ce99-f527-492b-8b1a-7e76fa98d6e4}\\LocalRedirectOnly" } ], "repeated": 0, "id": 5271 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f8" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{a305ce99-f527-492b-8b1a-7e76fa98d6e4}\\Roamable" } ], "repeated": 0, "id": 5272 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f8" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{a305ce99-f527-492b-8b1a-7e76fa98d6e4}\\PreCreate" } ], "repeated": 0, "id": 5273 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f8" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{a305ce99-f527-492b-8b1a-7e76fa98d6e4}\\Stream" } ], "repeated": 0, "id": 5274 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f8" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{a305ce99-f527-492b-8b1a-7e76fa98d6e4}\\PublishExpandedPath" } ], "repeated": 0, "id": 5275 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f8" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{a305ce99-f527-492b-8b1a-7e76fa98d6e4}\\DefinitionFlags" } ], "repeated": 0, "id": 5276 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f8" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{a305ce99-f527-492b-8b1a-7e76fa98d6e4}\\Attributes" } ], "repeated": 0, "id": 5277 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f8" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{a305ce99-f527-492b-8b1a-7e76fa98d6e4}\\FolderTypeID" } ], "repeated": 0, "id": 5278 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f8" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{a305ce99-f527-492b-8b1a-7e76fa98d6e4}\\InitFolderHandler" } ], "repeated": 0, "id": 5279 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000003f8" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{a305ce99-f527-492b-8b1a-7e76fa98d6e4}\\PropertyBag" } ], "repeated": 0, "id": 5280 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f8" } ], "repeated": 0, "id": 5281 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000003f8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 5282 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003f8" }, { "name": "SubKey", "value": "{3D644C9B-1FB8-4F30-9B45-F670235F79C0}" }, { "name": "Handle", "value": "0x00000398" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3D644C9B-1FB8-4F30-9B45-F670235F79C0}" } ], "repeated": 0, "id": 5283 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f8" } ], "repeated": 0, "id": 5284 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "3" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3D644C9B-1FB8-4f30-9B45-F670235F79C0}\\Category" } ], "repeated": 0, "id": 5285 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "CommonDownloads" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3D644C9B-1FB8-4f30-9B45-F670235F79C0}\\Name" } ], "repeated": 0, "id": 5286 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "Data", "value": "{DFDF76A2-C82A-4D63-906A-5644AC457385}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3D644C9B-1FB8-4f30-9B45-F670235F79C0}\\ParentFolder" } ], "repeated": 0, "id": 5287 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3D644C9B-1FB8-4f30-9B45-F670235F79C0}\\Description" } ], "repeated": 0, "id": 5288 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "Downloads" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3D644C9B-1FB8-4f30-9B45-F670235F79C0}\\RelativePath" } ], "repeated": 0, "id": 5289 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3D644C9B-1FB8-4f30-9B45-F670235F79C0}\\ParsingName" } ], "repeated": 0, "id": 5290 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3D644C9B-1FB8-4f30-9B45-F670235F79C0}\\InfoTip" } ], "repeated": 0, "id": 5291 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "Data", "value": "@%SystemRoot%\\system32\\shell32.dll,-21808" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3D644C9B-1FB8-4f30-9B45-F670235F79C0}\\LocalizedName" } ], "repeated": 0, "id": 5292 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3D644C9B-1FB8-4f30-9B45-F670235F79C0}\\Icon" } ], "repeated": 0, "id": 5293 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3D644C9B-1FB8-4f30-9B45-F670235F79C0}\\Security" } ], "repeated": 0, "id": 5294 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3D644C9B-1FB8-4f30-9B45-F670235F79C0}\\StreamResource" } ], "repeated": 0, "id": 5295 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3D644C9B-1FB8-4f30-9B45-F670235F79C0}\\StreamResourceType" } ], "repeated": 0, "id": 5296 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3D644C9B-1FB8-4f30-9B45-F670235F79C0}\\LocalRedirectOnly" } ], "repeated": 0, "id": 5297 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3D644C9B-1FB8-4f30-9B45-F670235F79C0}\\Roamable" } ], "repeated": 0, "id": 5298 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3D644C9B-1FB8-4f30-9B45-F670235F79C0}\\PreCreate" } ], "repeated": 0, "id": 5299 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3D644C9B-1FB8-4f30-9B45-F670235F79C0}\\Stream" } ], "repeated": 0, "id": 5300 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3D644C9B-1FB8-4f30-9B45-F670235F79C0}\\PublishExpandedPath" } ], "repeated": 0, "id": 5301 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3D644C9B-1FB8-4f30-9B45-F670235F79C0}\\DefinitionFlags" } ], "repeated": 0, "id": 5302 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "Attributes" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3D644C9B-1FB8-4f30-9B45-F670235F79C0}\\Attributes" } ], "repeated": 0, "id": 5303 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3D644C9B-1FB8-4f30-9B45-F670235F79C0}\\FolderTypeID" } ], "repeated": 0, "id": 5304 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3D644C9B-1FB8-4f30-9B45-F670235F79C0}\\InitFolderHandler" } ], "repeated": 0, "id": 5305 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000398" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3D644C9B-1FB8-4f30-9B45-F670235F79C0}\\PropertyBag" } ], "repeated": 0, "id": 5306 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" } ], "repeated": 0, "id": 5307 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000370" }, { "name": "ValueName", "value": "ThisPCPolicy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7d83ee9b-2244-4e70-b1f5-5393042af1e4}\\PropertyBag\\ThisPCPolicy" } ], "repeated": 0, "id": 5308 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000370" }, { "name": "ValueName", "value": "ThisPCPolicy" }, { "name": "Data", "value": "Show" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7d83ee9b-2244-4e70-b1f5-5393042af1e4}\\PropertyBag\\ThisPCPolicy" } ], "repeated": 0, "id": 5309 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000370" }, { "name": "ValueName", "value": "BaseFolderId" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7d83ee9b-2244-4e70-b1f5-5393042af1e4}\\PropertyBag\\BaseFolderId" } ], "repeated": 0, "id": 5310 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000370" }, { "name": "ValueName", "value": "BaseFolderId" }, { "name": "Data", "value": "{374DE290-123F-4565-9164-39C4925E467B}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7d83ee9b-2244-4e70-b1f5-5393042af1e4}\\PropertyBag\\BaseFolderId" } ], "repeated": 0, "id": 5311 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000398" } ], "repeated": 0, "id": 5312 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5313 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" } ], "repeated": 0, "id": 5314 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x10\\xc9\\xec\\x11l\\x00\\x00\\x00\\x00\\x00\\x00\\x00l\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00l\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00<\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xbc\\xde?\\xc0\\xf5\\x01\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5315 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000398" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 5316 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000398" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5317 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000398" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 5318 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x0000000c" }, { "name": "TokenHandle", "value": "0x000003d0" } ], "repeated": 0, "id": 5319 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" }, { "name": "Handle", "value": "0x000003ac" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" } ], "repeated": 0, "id": 5320 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "RDVirtualizationPool" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\RDVirtualizationPool" } ], "repeated": 0, "id": 5321 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" } ], "repeated": 0, "id": 5322 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" }, { "name": "Handle", "value": "0x000003f0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" } ], "repeated": 0, "id": 5323 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f0" }, { "name": "ValueName", "value": "RDVirtualizationPool" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\RDVirtualizationPool" } ], "repeated": 0, "id": 5324 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f0" } ], "repeated": 0, "id": 5325 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x90\\xc9\\xec\\x11l\\x00\\x00\\x00\\x00\\x00\\x00\\x00l\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xa0\\xbd}\\x1a\\xff\\x7f\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xf8\\x81}\\x1a" } ], "repeated": 0, "id": 5326 }, { "timestamp": "2026-05-29 01:05:17,758", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\fdeploy" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\fdeploy" } ], "repeated": 0, "id": 5327 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d0" } ], "repeated": 0, "id": 5328 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000398" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" }, { "name": "Handle", "value": "0x000003d0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" } ], "repeated": 0, "id": 5329 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d0" } ], "repeated": 0, "id": 5330 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" } ], "repeated": 0, "id": 5331 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" } ], "repeated": 0, "id": 5332 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 5333 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 5334 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x00000398" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 5335 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000398" }, { "name": "SubKey", "value": "{C3F2459E-80D6-45DC-BFEF-1F769F2BE730}" }, { "name": "Handle", "value": "0x000003d0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C3F2459E-80D6-45DC-BFEF-1F769F2BE730}" } ], "repeated": 0, "id": 5336 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" } ], "repeated": 0, "id": 5337 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C3F2459E-80D6-45DC-BFEF-1F769F2BE730}\\Category" } ], "repeated": 0, "id": 5338 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "OneDriveMusic" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C3F2459E-80D6-45DC-BFEF-1F769F2BE730}\\Name" } ], "repeated": 0, "id": 5339 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "Data", "value": "{A52BBA46-E9E1-435f-B3D9-28DAA648C0F6}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C3F2459E-80D6-45DC-BFEF-1F769F2BE730}\\ParentFolder" } ], "repeated": 0, "id": 5340 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C3F2459E-80D6-45DC-BFEF-1F769F2BE730}\\Description" } ], "repeated": 0, "id": 5341 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "Music" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C3F2459E-80D6-45DC-BFEF-1F769F2BE730}\\RelativePath" } ], "repeated": 0, "id": 5342 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C3F2459E-80D6-45DC-BFEF-1F769F2BE730}\\ParsingName" } ], "repeated": 0, "id": 5343 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C3F2459E-80D6-45DC-BFEF-1F769F2BE730}\\InfoTip" } ], "repeated": 0, "id": 5344 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C3F2459E-80D6-45DC-BFEF-1F769F2BE730}\\LocalizedName" } ], "repeated": 0, "id": 5345 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C3F2459E-80D6-45DC-BFEF-1F769F2BE730}\\Icon" } ], "repeated": 0, "id": 5346 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C3F2459E-80D6-45DC-BFEF-1F769F2BE730}\\Security" } ], "repeated": 0, "id": 5347 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C3F2459E-80D6-45DC-BFEF-1F769F2BE730}\\StreamResource" } ], "repeated": 0, "id": 5348 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C3F2459E-80D6-45DC-BFEF-1F769F2BE730}\\StreamResourceType" } ], "repeated": 0, "id": 5349 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C3F2459E-80D6-45DC-BFEF-1F769F2BE730}\\LocalRedirectOnly" } ], "repeated": 0, "id": 5350 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C3F2459E-80D6-45DC-BFEF-1F769F2BE730}\\Roamable" } ], "repeated": 0, "id": 5351 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C3F2459E-80D6-45DC-BFEF-1F769F2BE730}\\PreCreate" } ], "repeated": 0, "id": 5352 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C3F2459E-80D6-45DC-BFEF-1F769F2BE730}\\Stream" } ], "repeated": 0, "id": 5353 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C3F2459E-80D6-45DC-BFEF-1F769F2BE730}\\PublishExpandedPath" } ], "repeated": 0, "id": 5354 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "Data", "value": "64" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C3F2459E-80D6-45DC-BFEF-1F769F2BE730}\\DefinitionFlags" } ], "repeated": 0, "id": 5355 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "Attributes" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C3F2459E-80D6-45DC-BFEF-1F769F2BE730}\\Attributes" } ], "repeated": 0, "id": 5356 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "Data", "value": "{672ECD7E-AF04-4399-875C-0290845B6247}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C3F2459E-80D6-45DC-BFEF-1F769F2BE730}\\FolderTypeID" } ], "repeated": 0, "id": 5357 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C3F2459E-80D6-45DC-BFEF-1F769F2BE730}\\InitFolderHandler" } ], "repeated": 0, "id": 5358 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003d0" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x000003f0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C3F2459E-80D6-45DC-BFEF-1F769F2BE730}\\PropertyBag" } ], "repeated": 0, "id": 5359 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d0" } ], "repeated": 0, "id": 5360 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000003d0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 5361 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003d0" }, { "name": "SubKey", "value": "{12D4C69E-24AD-4923-BE19-31321C43A767}" }, { "name": "Handle", "value": "0x000003ac" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{12D4C69E-24AD-4923-BE19-31321C43A767}" } ], "repeated": 0, "id": 5362 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d0" } ], "repeated": 0, "id": 5363 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "3" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{12D4C69E-24AD-4923-BE19-31321C43A767}\\Category" } ], "repeated": 0, "id": 5364 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "Retail Demo" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{12D4C69E-24AD-4923-BE19-31321C43A767}\\Name" } ], "repeated": 0, "id": 5365 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "Data", "value": "{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{12D4C69E-24AD-4923-BE19-31321C43A767}\\ParentFolder" } ], "repeated": 0, "id": 5366 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{12D4C69E-24AD-4923-BE19-31321C43A767}\\Description" } ], "repeated": 0, "id": 5367 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "Microsoft\\Windows\\RetailDemo" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{12D4C69E-24AD-4923-BE19-31321C43A767}\\RelativePath" } ], "repeated": 0, "id": 5368 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{12D4C69E-24AD-4923-BE19-31321C43A767}\\ParsingName" } ], "repeated": 0, "id": 5369 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{12D4C69E-24AD-4923-BE19-31321C43A767}\\InfoTip" } ], "repeated": 0, "id": 5370 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{12D4C69E-24AD-4923-BE19-31321C43A767}\\LocalizedName" } ], "repeated": 0, "id": 5371 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{12D4C69E-24AD-4923-BE19-31321C43A767}\\Icon" } ], "repeated": 0, "id": 5372 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{12D4C69E-24AD-4923-BE19-31321C43A767}\\Security" } ], "repeated": 0, "id": 5373 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{12D4C69E-24AD-4923-BE19-31321C43A767}\\StreamResource" } ], "repeated": 0, "id": 5374 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{12D4C69E-24AD-4923-BE19-31321C43A767}\\StreamResourceType" } ], "repeated": 0, "id": 5375 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{12D4C69E-24AD-4923-BE19-31321C43A767}\\LocalRedirectOnly" } ], "repeated": 0, "id": 5376 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{12D4C69E-24AD-4923-BE19-31321C43A767}\\Roamable" } ], "repeated": 0, "id": 5377 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{12D4C69E-24AD-4923-BE19-31321C43A767}\\PreCreate" } ], "repeated": 0, "id": 5378 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{12D4C69E-24AD-4923-BE19-31321C43A767}\\Stream" } ], "repeated": 0, "id": 5379 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{12D4C69E-24AD-4923-BE19-31321C43A767}\\PublishExpandedPath" } ], "repeated": 0, "id": 5380 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{12D4C69E-24AD-4923-BE19-31321C43A767}\\DefinitionFlags" } ], "repeated": 0, "id": 5381 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{12D4C69E-24AD-4923-BE19-31321C43A767}\\Attributes" } ], "repeated": 0, "id": 5382 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{12D4C69E-24AD-4923-BE19-31321C43A767}\\FolderTypeID" } ], "repeated": 0, "id": 5383 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{12D4C69E-24AD-4923-BE19-31321C43A767}\\InitFolderHandler" } ], "repeated": 0, "id": 5384 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000003ac" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{12D4C69E-24AD-4923-BE19-31321C43A767}\\PropertyBag" } ], "repeated": 0, "id": 5385 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" } ], "repeated": 0, "id": 5386 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000003ac" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 5387 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003ac" }, { "name": "SubKey", "value": "{A440879F-87A0-4F7D-B700-0207B966194A}" }, { "name": "Handle", "value": "0x000003e8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A440879F-87A0-4F7D-B700-0207B966194A}" } ], "repeated": 0, "id": 5388 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" } ], "repeated": 0, "id": 5389 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "3" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A440879F-87A0-4F7D-B700-0207B966194A}\\Category" } ], "repeated": 0, "id": 5390 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "Common Start Menu Places" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A440879F-87A0-4F7D-B700-0207B966194A}\\Name" } ], "repeated": 0, "id": 5391 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "Data", "value": "{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A440879F-87A0-4F7D-B700-0207B966194A}\\ParentFolder" } ], "repeated": 0, "id": 5392 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A440879F-87A0-4F7D-B700-0207B966194A}\\Description" } ], "repeated": 0, "id": 5393 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "Microsoft\\Windows\\Start Menu Places" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A440879F-87A0-4F7D-B700-0207B966194A}\\RelativePath" } ], "repeated": 0, "id": 5394 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A440879F-87A0-4F7D-B700-0207B966194A}\\ParsingName" } ], "repeated": 0, "id": 5395 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A440879F-87A0-4F7D-B700-0207B966194A}\\InfoTip" } ], "repeated": 0, "id": 5396 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "Data", "value": "@%SystemRoot%\\system32\\shell32.dll,-21786" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A440879F-87A0-4F7D-B700-0207B966194A}\\LocalizedName" } ], "repeated": 0, "id": 5397 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A440879F-87A0-4F7D-B700-0207B966194A}\\Icon" } ], "repeated": 0, "id": 5398 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A440879F-87A0-4F7D-B700-0207B966194A}\\Security" } ], "repeated": 0, "id": 5399 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A440879F-87A0-4F7D-B700-0207B966194A}\\StreamResource" } ], "repeated": 0, "id": 5400 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A440879F-87A0-4F7D-B700-0207B966194A}\\StreamResourceType" } ], "repeated": 0, "id": 5401 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A440879F-87A0-4F7D-B700-0207B966194A}\\LocalRedirectOnly" } ], "repeated": 0, "id": 5402 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A440879F-87A0-4F7D-B700-0207B966194A}\\Roamable" } ], "repeated": 0, "id": 5403 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A440879F-87A0-4F7D-B700-0207B966194A}\\PreCreate" } ], "repeated": 0, "id": 5404 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A440879F-87A0-4F7D-B700-0207B966194A}\\Stream" } ], "repeated": 0, "id": 5405 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A440879F-87A0-4F7D-B700-0207B966194A}\\PublishExpandedPath" } ], "repeated": 0, "id": 5406 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A440879F-87A0-4F7D-B700-0207B966194A}\\DefinitionFlags" } ], "repeated": 0, "id": 5407 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "Attributes" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A440879F-87A0-4F7D-B700-0207B966194A}\\Attributes" } ], "repeated": 0, "id": 5408 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A440879F-87A0-4F7D-B700-0207B966194A}\\FolderTypeID" } ], "repeated": 0, "id": 5409 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e8" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A440879F-87A0-4F7D-B700-0207B966194A}\\InitFolderHandler" } ], "repeated": 0, "id": 5410 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000003e8" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A440879F-87A0-4F7D-B700-0207B966194A}\\PropertyBag" } ], "repeated": 0, "id": 5411 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e8" } ], "repeated": 0, "id": 5412 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000003e8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 5413 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003e8" }, { "name": "SubKey", "value": "{A990AE9F-A03B-4E80-94BC-9912D7504104}" }, { "name": "Handle", "value": "0x000003ac" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A990AE9F-A03B-4E80-94BC-9912D7504104}" } ], "repeated": 0, "id": 5414 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e8" } ], "repeated": 0, "id": 5415 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A990AE9F-A03B-4e80-94BC-9912D7504104}\\Category" } ], "repeated": 0, "id": 5416 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "PicturesLibrary" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A990AE9F-A03B-4e80-94BC-9912D7504104}\\Name" } ], "repeated": 0, "id": 5417 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "Data", "value": "{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A990AE9F-A03B-4e80-94BC-9912D7504104}\\ParentFolder" } ], "repeated": 0, "id": 5418 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A990AE9F-A03B-4e80-94BC-9912D7504104}\\Description" } ], "repeated": 0, "id": 5419 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "Pictures.library-ms" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A990AE9F-A03B-4e80-94BC-9912D7504104}\\RelativePath" } ], "repeated": 0, "id": 5420 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "Data", "value": "::{031E4825-7B94-4dc3-B131-E946B44C8DD5}\\{A990AE9F-A03B-4e80-94BC-9912D7504104}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A990AE9F-A03B-4e80-94BC-9912D7504104}\\ParsingName" } ], "repeated": 0, "id": 5421 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "Data", "value": "@%SystemRoot%\\system32\\shell32.dll,-12688" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A990AE9F-A03B-4e80-94BC-9912D7504104}\\InfoTip" } ], "repeated": 0, "id": 5422 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "Data", "value": "@%SystemRoot%\\system32\\windows.storage.dll,-34595" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A990AE9F-A03B-4e80-94BC-9912D7504104}\\LocalizedName" } ], "repeated": 0, "id": 5423 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Icon" }, { "name": "Data", "value": "%SystemRoot%\\system32\\imageres.dll,-1003" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A990AE9F-A03B-4e80-94BC-9912D7504104}\\Icon" } ], "repeated": 0, "id": 5424 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A990AE9F-A03B-4e80-94BC-9912D7504104}\\Security" } ], "repeated": 0, "id": 5425 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "Data", "value": "%SystemRoot%\\system32\\shell32.dll,-3" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A990AE9F-A03B-4e80-94BC-9912D7504104}\\StreamResource" } ], "repeated": 0, "id": 5426 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "Data", "value": "LIBRARY" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A990AE9F-A03B-4e80-94BC-9912D7504104}\\StreamResourceType" } ], "repeated": 0, "id": 5427 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A990AE9F-A03B-4e80-94BC-9912D7504104}\\LocalRedirectOnly" } ], "repeated": 0, "id": 5428 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A990AE9F-A03B-4e80-94BC-9912D7504104}\\Roamable" } ], "repeated": 0, "id": 5429 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A990AE9F-A03B-4e80-94BC-9912D7504104}\\PreCreate" } ], "repeated": 0, "id": 5430 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Stream" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A990AE9F-A03B-4e80-94BC-9912D7504104}\\Stream" } ], "repeated": 0, "id": 5431 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A990AE9F-A03B-4e80-94BC-9912D7504104}\\PublishExpandedPath" } ], "repeated": 0, "id": 5432 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A990AE9F-A03B-4e80-94BC-9912D7504104}\\DefinitionFlags" } ], "repeated": 0, "id": 5433 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A990AE9F-A03B-4e80-94BC-9912D7504104}\\Attributes" } ], "repeated": 0, "id": 5434 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A990AE9F-A03B-4e80-94BC-9912D7504104}\\FolderTypeID" } ], "repeated": 0, "id": 5435 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A990AE9F-A03B-4e80-94BC-9912D7504104}\\InitFolderHandler" } ], "repeated": 0, "id": 5436 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003ac" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x000003e8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A990AE9F-A03B-4e80-94BC-9912D7504104}\\PropertyBag" } ], "repeated": 0, "id": 5437 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" } ], "repeated": 0, "id": 5438 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000003ac" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 5439 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003ac" }, { "name": "SubKey", "value": "{DFDF76A2-C82A-4D63-906A-5644AC457385}" }, { "name": "Handle", "value": "0x000003f4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DFDF76A2-C82A-4D63-906A-5644AC457385}" } ], "repeated": 0, "id": 5440 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" } ], "repeated": 0, "id": 5441 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f4" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DFDF76A2-C82A-4D63-906A-5644AC457385}\\Category" } ], "repeated": 0, "id": 5442 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f4" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "Public" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DFDF76A2-C82A-4D63-906A-5644AC457385}\\Name" } ], "repeated": 0, "id": 5443 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f4" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DFDF76A2-C82A-4D63-906A-5644AC457385}\\ParentFolder" } ], "repeated": 0, "id": 5444 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f4" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DFDF76A2-C82A-4D63-906A-5644AC457385}\\Description" } ], "repeated": 0, "id": 5445 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f4" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DFDF76A2-C82A-4D63-906A-5644AC457385}\\RelativePath" } ], "repeated": 0, "id": 5446 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f4" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DFDF76A2-C82A-4D63-906A-5644AC457385}\\ParsingName" } ], "repeated": 0, "id": 5447 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f4" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DFDF76A2-C82A-4D63-906A-5644AC457385}\\InfoTip" } ], "repeated": 0, "id": 5448 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f4" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "Data", "value": "@%SystemRoot%\\system32\\shell32.dll,-21816" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DFDF76A2-C82A-4D63-906A-5644AC457385}\\LocalizedName" } ], "repeated": 0, "id": 5449 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f4" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DFDF76A2-C82A-4D63-906A-5644AC457385}\\Icon" } ], "repeated": 0, "id": 5450 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f4" }, { "name": "ValueName", "value": "Security" }, { "name": "Data", "value": "D:PAI(A;OICI;FA;;;BA)(A;OICIIO;FA;;;CO)(A;OICI;FA;;;SY)(A;OICIIO;0x1301ff;;;IU)(A;;0x1200af;;;IU)(A;OICIIO;0x1301ff;;;SU)(A;;0x1200af;;;SU)(A;OICIIO;0x1301ff;;;S-1-5-3)(A;;0x1200af;;;S-1-5-3)" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DFDF76A2-C82A-4D63-906A-5644AC457385}\\Security" } ], "repeated": 0, "id": 5451 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f4" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DFDF76A2-C82A-4D63-906A-5644AC457385}\\StreamResource" } ], "repeated": 0, "id": 5452 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f4" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DFDF76A2-C82A-4D63-906A-5644AC457385}\\StreamResourceType" } ], "repeated": 0, "id": 5453 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f4" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DFDF76A2-C82A-4D63-906A-5644AC457385}\\LocalRedirectOnly" } ], "repeated": 0, "id": 5454 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f4" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DFDF76A2-C82A-4D63-906A-5644AC457385}\\Roamable" } ], "repeated": 0, "id": 5455 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f4" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DFDF76A2-C82A-4D63-906A-5644AC457385}\\PreCreate" } ], "repeated": 0, "id": 5456 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f4" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DFDF76A2-C82A-4D63-906A-5644AC457385}\\Stream" } ], "repeated": 0, "id": 5457 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f4" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DFDF76A2-C82A-4D63-906A-5644AC457385}\\PublishExpandedPath" } ], "repeated": 0, "id": 5458 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f4" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DFDF76A2-C82A-4D63-906A-5644AC457385}\\DefinitionFlags" } ], "repeated": 0, "id": 5459 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f4" }, { "name": "ValueName", "value": "Attributes" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DFDF76A2-C82A-4D63-906A-5644AC457385}\\Attributes" } ], "repeated": 0, "id": 5460 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f4" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DFDF76A2-C82A-4D63-906A-5644AC457385}\\FolderTypeID" } ], "repeated": 0, "id": 5461 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f4" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DFDF76A2-C82A-4D63-906A-5644AC457385}\\InitFolderHandler" } ], "repeated": 0, "id": 5462 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000003f4" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DFDF76A2-C82A-4D63-906A-5644AC457385}\\PropertyBag" } ], "repeated": 0, "id": 5463 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f4" } ], "repeated": 0, "id": 5464 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000003f4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 5465 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003f4" }, { "name": "SubKey", "value": "{1A6FDBA2-F42D-4358-A798-B74D745926C5}" }, { "name": "Handle", "value": "0x000003ac" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1A6FDBA2-F42D-4358-A798-B74D745926C5}" } ], "repeated": 0, "id": 5466 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f4" } ], "repeated": 0, "id": 5467 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "3" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1A6FDBA2-F42D-4358-A798-B74D745926C5}\\Category" } ], "repeated": 0, "id": 5468 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "RecordedTVLibrary" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1A6FDBA2-F42D-4358-A798-B74D745926C5}\\Name" } ], "repeated": 0, "id": 5469 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "Data", "value": "{48daf80b-e6cf-4f4e-b800-0e69d84ee384}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1A6FDBA2-F42D-4358-A798-B74D745926C5}\\ParentFolder" } ], "repeated": 0, "id": 5470 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1A6FDBA2-F42D-4358-A798-B74D745926C5}\\Description" } ], "repeated": 0, "id": 5471 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "RecordedTV.library-ms" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1A6FDBA2-F42D-4358-A798-B74D745926C5}\\RelativePath" } ], "repeated": 0, "id": 5472 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1A6FDBA2-F42D-4358-A798-B74D745926C5}\\ParsingName" } ], "repeated": 0, "id": 5473 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1A6FDBA2-F42D-4358-A798-B74D745926C5}\\InfoTip" } ], "repeated": 0, "id": 5474 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "Data", "value": "@%SystemRoot%\\system32\\shell32.dll,-34615" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1A6FDBA2-F42D-4358-A798-B74D745926C5}\\LocalizedName" } ], "repeated": 0, "id": 5475 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Icon" }, { "name": "Data", "value": "%SystemRoot%\\system32\\imageres.dll,-1008" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1A6FDBA2-F42D-4358-A798-B74D745926C5}\\Icon" } ], "repeated": 0, "id": 5476 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1A6FDBA2-F42D-4358-A798-B74D745926C5}\\Security" } ], "repeated": 0, "id": 5477 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "Data", "value": "%SystemRoot%\\system32\\shell32.dll,-8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1A6FDBA2-F42D-4358-A798-B74D745926C5}\\StreamResource" } ], "repeated": 0, "id": 5478 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "Data", "value": "LIBRARY" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1A6FDBA2-F42D-4358-A798-B74D745926C5}\\StreamResourceType" } ], "repeated": 0, "id": 5479 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1A6FDBA2-F42D-4358-A798-B74D745926C5}\\LocalRedirectOnly" } ], "repeated": 0, "id": 5480 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1A6FDBA2-F42D-4358-A798-B74D745926C5}\\Roamable" } ], "repeated": 0, "id": 5481 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1A6FDBA2-F42D-4358-A798-B74D745926C5}\\PreCreate" } ], "repeated": 0, "id": 5482 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Stream" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1A6FDBA2-F42D-4358-A798-B74D745926C5}\\Stream" } ], "repeated": 0, "id": 5483 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1A6FDBA2-F42D-4358-A798-B74D745926C5}\\PublishExpandedPath" } ], "repeated": 0, "id": 5484 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1A6FDBA2-F42D-4358-A798-B74D745926C5}\\DefinitionFlags" } ], "repeated": 0, "id": 5485 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1A6FDBA2-F42D-4358-A798-B74D745926C5}\\Attributes" } ], "repeated": 0, "id": 5486 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1A6FDBA2-F42D-4358-A798-B74D745926C5}\\FolderTypeID" } ], "repeated": 0, "id": 5487 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003ac" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1A6FDBA2-F42D-4358-A798-B74D745926C5}\\InitFolderHandler" } ], "repeated": 0, "id": 5488 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000003ac" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1A6FDBA2-F42D-4358-A798-B74D745926C5}\\PropertyBag" } ], "repeated": 0, "id": 5489 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" } ], "repeated": 0, "id": 5490 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000003ac" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 5491 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003ac" }, { "name": "SubKey", "value": "{559D40A3-A036-40FA-AF61-84CB430A4D34}" }, { "name": "Handle", "value": "0x000003f8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{559D40A3-A036-40FA-AF61-84CB430A4D34}" } ], "repeated": 0, "id": 5492 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" } ], "repeated": 0, "id": 5493 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f8" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{559D40A3-A036-40FA-AF61-84CB430A4D34}\\Category" } ], "repeated": 0, "id": 5494 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f8" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "AppDataProgramData" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{559D40A3-A036-40FA-AF61-84CB430A4D34}\\Name" } ], "repeated": 0, "id": 5495 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f8" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "Data", "value": "{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{559D40A3-A036-40FA-AF61-84CB430A4D34}\\ParentFolder" } ], "repeated": 0, "id": 5496 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f8" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{559D40A3-A036-40FA-AF61-84CB430A4D34}\\Description" } ], "repeated": 0, "id": 5497 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f8" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "ProgramData" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{559D40A3-A036-40FA-AF61-84CB430A4D34}\\RelativePath" } ], "repeated": 0, "id": 5498 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f8" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{559D40A3-A036-40FA-AF61-84CB430A4D34}\\ParsingName" } ], "repeated": 0, "id": 5499 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f8" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{559D40A3-A036-40FA-AF61-84CB430A4D34}\\InfoTip" } ], "repeated": 0, "id": 5500 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f8" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{559D40A3-A036-40FA-AF61-84CB430A4D34}\\LocalizedName" } ], "repeated": 0, "id": 5501 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f8" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{559D40A3-A036-40FA-AF61-84CB430A4D34}\\Icon" } ], "repeated": 0, "id": 5502 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f8" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{559D40A3-A036-40FA-AF61-84CB430A4D34}\\Security" } ], "repeated": 0, "id": 5503 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f8" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{559D40A3-A036-40FA-AF61-84CB430A4D34}\\StreamResource" } ], "repeated": 0, "id": 5504 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f8" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{559D40A3-A036-40FA-AF61-84CB430A4D34}\\StreamResourceType" } ], "repeated": 0, "id": 5505 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f8" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{559D40A3-A036-40FA-AF61-84CB430A4D34}\\LocalRedirectOnly" } ], "repeated": 0, "id": 5506 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f8" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{559D40A3-A036-40FA-AF61-84CB430A4D34}\\Roamable" } ], "repeated": 0, "id": 5507 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f8" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{559D40A3-A036-40FA-AF61-84CB430A4D34}\\PreCreate" } ], "repeated": 0, "id": 5508 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f8" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{559D40A3-A036-40FA-AF61-84CB430A4D34}\\Stream" } ], "repeated": 0, "id": 5509 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f8" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{559D40A3-A036-40FA-AF61-84CB430A4D34}\\PublishExpandedPath" } ], "repeated": 0, "id": 5510 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f8" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{559D40A3-A036-40FA-AF61-84CB430A4D34}\\DefinitionFlags" } ], "repeated": 0, "id": 5511 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f8" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{559D40A3-A036-40FA-AF61-84CB430A4D34}\\Attributes" } ], "repeated": 0, "id": 5512 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f8" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{559D40A3-A036-40FA-AF61-84CB430A4D34}\\FolderTypeID" } ], "repeated": 0, "id": 5513 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f8" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{559D40A3-A036-40FA-AF61-84CB430A4D34}\\InitFolderHandler" } ], "repeated": 0, "id": 5514 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000003f8" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{559D40A3-A036-40FA-AF61-84CB430A4D34}\\PropertyBag" } ], "repeated": 0, "id": 5515 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f8" } ], "repeated": 0, "id": 5516 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000003f8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 5517 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003f8" }, { "name": "SubKey", "value": "{9B74B6A3-0DFD-4F11-9E78-5F7800F2E772}" }, { "name": "Handle", "value": "0x000003f4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9B74B6A3-0DFD-4F11-9E78-5F7800F2E772}" } ], "repeated": 0, "id": 5518 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f8" } ], "repeated": 0, "id": 5519 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f4" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9B74B6A3-0DFD-4f11-9E78-5F7800F2E772}\\Category" } ], "repeated": 0, "id": 5520 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f4" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "HomeGroupCurrentUserFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9B74B6A3-0DFD-4f11-9E78-5F7800F2E772}\\Name" } ], "repeated": 0, "id": 5521 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f4" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9B74B6A3-0DFD-4f11-9E78-5F7800F2E772}\\ParentFolder" } ], "repeated": 0, "id": 5522 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f4" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9B74B6A3-0DFD-4f11-9E78-5F7800F2E772}\\Description" } ], "repeated": 0, "id": 5523 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f4" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9B74B6A3-0DFD-4f11-9E78-5F7800F2E772}\\RelativePath" } ], "repeated": 0, "id": 5524 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f4" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "Data", "value": "::{B4FB3F98-C1EA-428d-A78A-D1F5659CBA93}\\$CurrentUser$" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9B74B6A3-0DFD-4f11-9E78-5F7800F2E772}\\ParsingName" } ], "repeated": 0, "id": 5525 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f4" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9B74B6A3-0DFD-4f11-9E78-5F7800F2E772}\\InfoTip" } ], "repeated": 0, "id": 5526 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f4" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9B74B6A3-0DFD-4f11-9E78-5F7800F2E772}\\LocalizedName" } ], "repeated": 0, "id": 5527 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f4" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9B74B6A3-0DFD-4f11-9E78-5F7800F2E772}\\Icon" } ], "repeated": 0, "id": 5528 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f4" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9B74B6A3-0DFD-4f11-9E78-5F7800F2E772}\\Security" } ], "repeated": 0, "id": 5529 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f4" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9B74B6A3-0DFD-4f11-9E78-5F7800F2E772}\\StreamResource" } ], "repeated": 0, "id": 5530 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f4" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9B74B6A3-0DFD-4f11-9E78-5F7800F2E772}\\StreamResourceType" } ], "repeated": 0, "id": 5531 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f4" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9B74B6A3-0DFD-4f11-9E78-5F7800F2E772}\\LocalRedirectOnly" } ], "repeated": 0, "id": 5532 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f4" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9B74B6A3-0DFD-4f11-9E78-5F7800F2E772}\\Roamable" } ], "repeated": 0, "id": 5533 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f4" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9B74B6A3-0DFD-4f11-9E78-5F7800F2E772}\\PreCreate" } ], "repeated": 0, "id": 5534 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f4" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9B74B6A3-0DFD-4f11-9E78-5F7800F2E772}\\Stream" } ], "repeated": 0, "id": 5535 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f4" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9B74B6A3-0DFD-4f11-9E78-5F7800F2E772}\\PublishExpandedPath" } ], "repeated": 0, "id": 5536 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f4" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9B74B6A3-0DFD-4f11-9E78-5F7800F2E772}\\DefinitionFlags" } ], "repeated": 0, "id": 5537 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f4" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9B74B6A3-0DFD-4f11-9E78-5F7800F2E772}\\Attributes" } ], "repeated": 0, "id": 5538 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f4" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9B74B6A3-0DFD-4f11-9E78-5F7800F2E772}\\FolderTypeID" } ], "repeated": 0, "id": 5539 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f4" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9B74B6A3-0DFD-4f11-9E78-5F7800F2E772}\\InitFolderHandler" } ], "repeated": 0, "id": 5540 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003f4" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x000003ac" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9B74B6A3-0DFD-4f11-9E78-5F7800F2E772}\\PropertyBag" } ], "repeated": 0, "id": 5541 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f4" } ], "repeated": 0, "id": 5542 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000003f4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 5543 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003f4" }, { "name": "SubKey", "value": "{A520A1A4-1780-4FF6-BD18-167343C5AF16}" }, { "name": "Handle", "value": "0x000003fc" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}" } ], "repeated": 0, "id": 5544 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f4" } ], "repeated": 0, "id": 5545 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003fc" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\Category" } ], "repeated": 0, "id": 5546 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003fc" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "LocalAppDataLow" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\Name" } ], "repeated": 0, "id": 5547 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003fc" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\ParentFolder" } ], "repeated": 0, "id": 5548 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003fc" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\Description" } ], "repeated": 0, "id": 5549 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003fc" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "AppData\\LocalLow" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\RelativePath" } ], "repeated": 0, "id": 5550 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003fc" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\ParsingName" } ], "repeated": 0, "id": 5551 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003fc" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\InfoTip" } ], "repeated": 0, "id": 5552 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003fc" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\LocalizedName" } ], "repeated": 0, "id": 5553 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003fc" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\Icon" } ], "repeated": 0, "id": 5554 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003fc" }, { "name": "ValueName", "value": "Security" }, { "name": "Data", "value": "S:(ML;OICI;NW;;;LW)" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\Security" } ], "repeated": 0, "id": 5555 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003fc" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\StreamResource" } ], "repeated": 0, "id": 5556 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003fc" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\StreamResourceType" } ], "repeated": 0, "id": 5557 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003fc" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\LocalRedirectOnly" } ], "repeated": 0, "id": 5558 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003fc" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\Roamable" } ], "repeated": 0, "id": 5559 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003fc" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\PreCreate" } ], "repeated": 0, "id": 5560 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003fc" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\Stream" } ], "repeated": 0, "id": 5561 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003fc" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\PublishExpandedPath" } ], "repeated": 0, "id": 5562 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003fc" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\DefinitionFlags" } ], "repeated": 0, "id": 5563 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003fc" }, { "name": "ValueName", "value": "Attributes" }, { "name": "Data", "value": "8192" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\Attributes" } ], "repeated": 0, "id": 5564 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003fc" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\FolderTypeID" } ], "repeated": 0, "id": 5565 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003fc" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\InitFolderHandler" } ], "repeated": 0, "id": 5566 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000003fc" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\PropertyBag" } ], "repeated": 0, "id": 5567 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003fc" } ], "repeated": 0, "id": 5568 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000003fc" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 5569 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003fc" }, { "name": "SubKey", "value": "{AAA8D5A5-F1D6-4259-BAA8-78E7EF60835E}" }, { "name": "Handle", "value": "0x000003d0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AAA8D5A5-F1D6-4259-BAA8-78E7EF60835E}" } ], "repeated": 0, "id": 5570 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003fc" } ], "repeated": 0, "id": 5571 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AAA8D5A5-F1D6-4259-BAA8-78E7EF60835E}\\Category" } ], "repeated": 0, "id": 5572 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "Roamed Tile Images" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AAA8D5A5-F1D6-4259-BAA8-78E7EF60835E}\\Name" } ], "repeated": 0, "id": 5573 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "Data", "value": "{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AAA8D5A5-F1D6-4259-BAA8-78E7EF60835E}\\ParentFolder" } ], "repeated": 0, "id": 5574 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AAA8D5A5-F1D6-4259-BAA8-78E7EF60835E}\\Description" } ], "repeated": 0, "id": 5575 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "Microsoft\\Windows\\RoamedTileImages" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AAA8D5A5-F1D6-4259-BAA8-78E7EF60835E}\\RelativePath" } ], "repeated": 0, "id": 5576 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AAA8D5A5-F1D6-4259-BAA8-78E7EF60835E}\\ParsingName" } ], "repeated": 0, "id": 5577 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AAA8D5A5-F1D6-4259-BAA8-78E7EF60835E}\\InfoTip" } ], "repeated": 0, "id": 5578 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AAA8D5A5-F1D6-4259-BAA8-78E7EF60835E}\\LocalizedName" } ], "repeated": 0, "id": 5579 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AAA8D5A5-F1D6-4259-BAA8-78E7EF60835E}\\Icon" } ], "repeated": 0, "id": 5580 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AAA8D5A5-F1D6-4259-BAA8-78E7EF60835E}\\Security" } ], "repeated": 0, "id": 5581 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AAA8D5A5-F1D6-4259-BAA8-78E7EF60835E}\\StreamResource" } ], "repeated": 0, "id": 5582 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AAA8D5A5-F1D6-4259-BAA8-78E7EF60835E}\\StreamResourceType" } ], "repeated": 0, "id": 5583 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AAA8D5A5-F1D6-4259-BAA8-78E7EF60835E}\\LocalRedirectOnly" } ], "repeated": 0, "id": 5584 }, { "timestamp": "2026-05-29 01:05:17,774", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AAA8D5A5-F1D6-4259-BAA8-78E7EF60835E}\\Roamable" } ], "repeated": 0, "id": 5585 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AAA8D5A5-F1D6-4259-BAA8-78E7EF60835E}\\PreCreate" } ], "repeated": 0, "id": 5586 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AAA8D5A5-F1D6-4259-BAA8-78E7EF60835E}\\Stream" } ], "repeated": 0, "id": 5587 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AAA8D5A5-F1D6-4259-BAA8-78E7EF60835E}\\PublishExpandedPath" } ], "repeated": 0, "id": 5588 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AAA8D5A5-F1D6-4259-BAA8-78E7EF60835E}\\DefinitionFlags" } ], "repeated": 0, "id": 5589 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AAA8D5A5-F1D6-4259-BAA8-78E7EF60835E}\\Attributes" } ], "repeated": 0, "id": 5590 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AAA8D5A5-F1D6-4259-BAA8-78E7EF60835E}\\FolderTypeID" } ], "repeated": 0, "id": 5591 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AAA8D5A5-F1D6-4259-BAA8-78E7EF60835E}\\InitFolderHandler" } ], "repeated": 0, "id": 5592 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000003d0" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AAA8D5A5-F1D6-4259-BAA8-78E7EF60835E}\\PropertyBag" } ], "repeated": 0, "id": 5593 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d0" } ], "repeated": 0, "id": 5594 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1f5c040f000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 5595 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000003d0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 5596 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003d0" }, { "name": "SubKey", "value": "{6365D5A7-0F0D-45E5-87F6-0DA56B6A4F7D}" }, { "name": "Handle", "value": "0x000003fc" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{6365D5A7-0F0D-45E5-87F6-0DA56B6A4F7D}" } ], "repeated": 0, "id": 5597 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d0" } ], "repeated": 0, "id": 5598 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003fc" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{6365D5A7-0F0D-45e5-87F6-0DA56B6A4F7D}\\Category" } ], "repeated": 0, "id": 5599 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003fc" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "ProgramFilesCommonX64" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{6365D5A7-0F0D-45e5-87F6-0DA56B6A4F7D}\\Name" } ], "repeated": 0, "id": 5600 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003fc" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{6365D5A7-0F0D-45e5-87F6-0DA56B6A4F7D}\\ParentFolder" } ], "repeated": 0, "id": 5601 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003fc" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{6365D5A7-0F0D-45e5-87F6-0DA56B6A4F7D}\\Description" } ], "repeated": 0, "id": 5602 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003fc" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{6365D5A7-0F0D-45e5-87F6-0DA56B6A4F7D}\\RelativePath" } ], "repeated": 0, "id": 5603 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003fc" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{6365D5A7-0F0D-45e5-87F6-0DA56B6A4F7D}\\ParsingName" } ], "repeated": 0, "id": 5604 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003fc" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{6365D5A7-0F0D-45e5-87F6-0DA56B6A4F7D}\\InfoTip" } ], "repeated": 0, "id": 5605 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003fc" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{6365D5A7-0F0D-45e5-87F6-0DA56B6A4F7D}\\LocalizedName" } ], "repeated": 0, "id": 5606 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003fc" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{6365D5A7-0F0D-45e5-87F6-0DA56B6A4F7D}\\Icon" } ], "repeated": 0, "id": 5607 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003fc" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{6365D5A7-0F0D-45e5-87F6-0DA56B6A4F7D}\\Security" } ], "repeated": 0, "id": 5608 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003fc" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{6365D5A7-0F0D-45e5-87F6-0DA56B6A4F7D}\\StreamResource" } ], "repeated": 0, "id": 5609 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003fc" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{6365D5A7-0F0D-45e5-87F6-0DA56B6A4F7D}\\StreamResourceType" } ], "repeated": 0, "id": 5610 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003fc" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{6365D5A7-0F0D-45e5-87F6-0DA56B6A4F7D}\\LocalRedirectOnly" } ], "repeated": 0, "id": 5611 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003fc" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{6365D5A7-0F0D-45e5-87F6-0DA56B6A4F7D}\\Roamable" } ], "repeated": 0, "id": 5612 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003fc" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{6365D5A7-0F0D-45e5-87F6-0DA56B6A4F7D}\\PreCreate" } ], "repeated": 0, "id": 5613 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003fc" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{6365D5A7-0F0D-45e5-87F6-0DA56B6A4F7D}\\Stream" } ], "repeated": 0, "id": 5614 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003fc" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{6365D5A7-0F0D-45e5-87F6-0DA56B6A4F7D}\\PublishExpandedPath" } ], "repeated": 0, "id": 5615 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003fc" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{6365D5A7-0F0D-45e5-87F6-0DA56B6A4F7D}\\DefinitionFlags" } ], "repeated": 0, "id": 5616 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003fc" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{6365D5A7-0F0D-45e5-87F6-0DA56B6A4F7D}\\Attributes" } ], "repeated": 0, "id": 5617 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003fc" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{6365D5A7-0F0D-45e5-87F6-0DA56B6A4F7D}\\FolderTypeID" } ], "repeated": 0, "id": 5618 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003fc" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{6365D5A7-0F0D-45e5-87F6-0DA56B6A4F7D}\\InitFolderHandler" } ], "repeated": 0, "id": 5619 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000003fc" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{6365D5A7-0F0D-45e5-87F6-0DA56B6A4F7D}\\PropertyBag" } ], "repeated": 0, "id": 5620 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003fc" } ], "repeated": 0, "id": 5621 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000003fc" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 5622 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003fc" }, { "name": "SubKey", "value": "{B88F4DAA-E7BD-49A9-B74D-02885A5DC765}" }, { "name": "Handle", "value": "0x000003d0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B88F4DAA-E7BD-49A9-B74D-02885A5DC765}" } ], "repeated": 0, "id": 5623 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003fc" } ], "repeated": 0, "id": 5624 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B88F4DAA-E7BD-49a9-B74D-02885A5DC765}\\Category" } ], "repeated": 0, "id": 5625 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "CryptoKeys" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B88F4DAA-E7BD-49a9-B74D-02885A5DC765}\\Name" } ], "repeated": 0, "id": 5626 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B88F4DAA-E7BD-49a9-B74D-02885A5DC765}\\ParentFolder" } ], "repeated": 0, "id": 5627 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B88F4DAA-E7BD-49a9-B74D-02885A5DC765}\\Description" } ], "repeated": 0, "id": 5628 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B88F4DAA-E7BD-49a9-B74D-02885A5DC765}\\RelativePath" } ], "repeated": 0, "id": 5629 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B88F4DAA-E7BD-49a9-B74D-02885A5DC765}\\ParsingName" } ], "repeated": 0, "id": 5630 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B88F4DAA-E7BD-49a9-B74D-02885A5DC765}\\InfoTip" } ], "repeated": 0, "id": 5631 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B88F4DAA-E7BD-49a9-B74D-02885A5DC765}\\LocalizedName" } ], "repeated": 0, "id": 5632 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B88F4DAA-E7BD-49a9-B74D-02885A5DC765}\\Icon" } ], "repeated": 0, "id": 5633 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B88F4DAA-E7BD-49a9-B74D-02885A5DC765}\\Security" } ], "repeated": 0, "id": 5634 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B88F4DAA-E7BD-49a9-B74D-02885A5DC765}\\StreamResource" } ], "repeated": 0, "id": 5635 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B88F4DAA-E7BD-49a9-B74D-02885A5DC765}\\StreamResourceType" } ], "repeated": 0, "id": 5636 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B88F4DAA-E7BD-49a9-B74D-02885A5DC765}\\LocalRedirectOnly" } ], "repeated": 0, "id": 5637 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B88F4DAA-E7BD-49a9-B74D-02885A5DC765}\\Roamable" } ], "repeated": 0, "id": 5638 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B88F4DAA-E7BD-49a9-B74D-02885A5DC765}\\PreCreate" } ], "repeated": 0, "id": 5639 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B88F4DAA-E7BD-49a9-B74D-02885A5DC765}\\Stream" } ], "repeated": 0, "id": 5640 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B88F4DAA-E7BD-49a9-B74D-02885A5DC765}\\PublishExpandedPath" } ], "repeated": 0, "id": 5641 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B88F4DAA-E7BD-49a9-B74D-02885A5DC765}\\DefinitionFlags" } ], "repeated": 0, "id": 5642 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B88F4DAA-E7BD-49a9-B74D-02885A5DC765}\\Attributes" } ], "repeated": 0, "id": 5643 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B88F4DAA-E7BD-49a9-B74D-02885A5DC765}\\FolderTypeID" } ], "repeated": 0, "id": 5644 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B88F4DAA-E7BD-49a9-B74D-02885A5DC765}\\InitFolderHandler" } ], "repeated": 0, "id": 5645 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000003d0" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B88F4DAA-E7BD-49a9-B74D-02885A5DC765}\\PropertyBag" } ], "repeated": 0, "id": 5646 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d0" } ], "repeated": 0, "id": 5647 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000003d0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 5648 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003d0" }, { "name": "SubKey", "value": "{2C36C0AA-5812-4B87-BFD0-4CD0DFB19B39}" }, { "name": "Handle", "value": "0x000003f8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2C36C0AA-5812-4B87-BFD0-4CD0DFB19B39}" } ], "repeated": 0, "id": 5649 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d0" } ], "repeated": 0, "id": 5650 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f8" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2C36C0AA-5812-4b87-BFD0-4CD0DFB19B39}\\Category" } ], "repeated": 0, "id": 5651 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f8" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "Original Images" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2C36C0AA-5812-4b87-BFD0-4CD0DFB19B39}\\Name" } ], "repeated": 0, "id": 5652 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f8" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "Data", "value": "{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2C36C0AA-5812-4b87-BFD0-4CD0DFB19B39}\\ParentFolder" } ], "repeated": 0, "id": 5653 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f8" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2C36C0AA-5812-4b87-BFD0-4CD0DFB19B39}\\Description" } ], "repeated": 0, "id": 5654 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f8" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "Microsoft\\Windows Photo Gallery\\Original Images" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2C36C0AA-5812-4b87-BFD0-4CD0DFB19B39}\\RelativePath" } ], "repeated": 0, "id": 5655 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f8" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2C36C0AA-5812-4b87-BFD0-4CD0DFB19B39}\\ParsingName" } ], "repeated": 0, "id": 5656 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f8" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2C36C0AA-5812-4b87-BFD0-4CD0DFB19B39}\\InfoTip" } ], "repeated": 0, "id": 5657 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f8" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2C36C0AA-5812-4b87-BFD0-4CD0DFB19B39}\\LocalizedName" } ], "repeated": 0, "id": 5658 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f8" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2C36C0AA-5812-4b87-BFD0-4CD0DFB19B39}\\Icon" } ], "repeated": 0, "id": 5659 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f8" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2C36C0AA-5812-4b87-BFD0-4CD0DFB19B39}\\Security" } ], "repeated": 0, "id": 5660 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f8" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2C36C0AA-5812-4b87-BFD0-4CD0DFB19B39}\\StreamResource" } ], "repeated": 0, "id": 5661 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f8" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2C36C0AA-5812-4b87-BFD0-4CD0DFB19B39}\\StreamResourceType" } ], "repeated": 0, "id": 5662 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f8" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2C36C0AA-5812-4b87-BFD0-4CD0DFB19B39}\\LocalRedirectOnly" } ], "repeated": 0, "id": 5663 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f8" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2C36C0AA-5812-4b87-BFD0-4CD0DFB19B39}\\Roamable" } ], "repeated": 0, "id": 5664 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f8" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2C36C0AA-5812-4b87-BFD0-4CD0DFB19B39}\\PreCreate" } ], "repeated": 0, "id": 5665 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f8" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2C36C0AA-5812-4b87-BFD0-4CD0DFB19B39}\\Stream" } ], "repeated": 0, "id": 5666 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f8" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2C36C0AA-5812-4b87-BFD0-4CD0DFB19B39}\\PublishExpandedPath" } ], "repeated": 0, "id": 5667 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f8" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2C36C0AA-5812-4b87-BFD0-4CD0DFB19B39}\\DefinitionFlags" } ], "repeated": 0, "id": 5668 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f8" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2C36C0AA-5812-4b87-BFD0-4CD0DFB19B39}\\Attributes" } ], "repeated": 0, "id": 5669 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f8" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2C36C0AA-5812-4b87-BFD0-4CD0DFB19B39}\\FolderTypeID" } ], "repeated": 0, "id": 5670 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f8" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2C36C0AA-5812-4b87-BFD0-4CD0DFB19B39}\\InitFolderHandler" } ], "repeated": 0, "id": 5671 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000003f8" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2C36C0AA-5812-4b87-BFD0-4CD0DFB19B39}\\PropertyBag" } ], "repeated": 0, "id": 5672 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f8" } ], "repeated": 0, "id": 5673 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000003f8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 5674 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003f8" }, { "name": "SubKey", "value": "{9E3995AB-1F9C-4F13-B827-48B24B6C7174}" }, { "name": "Handle", "value": "0x000003dc" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}" } ], "repeated": 0, "id": 5675 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f8" } ], "repeated": 0, "id": 5676 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9e3995ab-1f9c-4f13-b827-48b24b6c7174}\\Category" } ], "repeated": 0, "id": 5677 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "User Pinned" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9e3995ab-1f9c-4f13-b827-48b24b6c7174}\\Name" } ], "repeated": 0, "id": 5678 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "Data", "value": "{52a4f021-7b75-48a9-9f6b-4b87a210bc8f}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9e3995ab-1f9c-4f13-b827-48b24b6c7174}\\ParentFolder" } ], "repeated": 0, "id": 5679 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9e3995ab-1f9c-4f13-b827-48b24b6c7174}\\Description" } ], "repeated": 0, "id": 5680 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "User Pinned" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9e3995ab-1f9c-4f13-b827-48b24b6c7174}\\RelativePath" } ], "repeated": 0, "id": 5681 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9e3995ab-1f9c-4f13-b827-48b24b6c7174}\\ParsingName" } ], "repeated": 0, "id": 5682 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9e3995ab-1f9c-4f13-b827-48b24b6c7174}\\InfoTip" } ], "repeated": 0, "id": 5683 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9e3995ab-1f9c-4f13-b827-48b24b6c7174}\\LocalizedName" } ], "repeated": 0, "id": 5684 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9e3995ab-1f9c-4f13-b827-48b24b6c7174}\\Icon" } ], "repeated": 0, "id": 5685 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9e3995ab-1f9c-4f13-b827-48b24b6c7174}\\Security" } ], "repeated": 0, "id": 5686 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9e3995ab-1f9c-4f13-b827-48b24b6c7174}\\StreamResource" } ], "repeated": 0, "id": 5687 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9e3995ab-1f9c-4f13-b827-48b24b6c7174}\\StreamResourceType" } ], "repeated": 0, "id": 5688 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9e3995ab-1f9c-4f13-b827-48b24b6c7174}\\LocalRedirectOnly" } ], "repeated": 0, "id": 5689 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9e3995ab-1f9c-4f13-b827-48b24b6c7174}\\Roamable" } ], "repeated": 0, "id": 5690 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9e3995ab-1f9c-4f13-b827-48b24b6c7174}\\PreCreate" } ], "repeated": 0, "id": 5691 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9e3995ab-1f9c-4f13-b827-48b24b6c7174}\\Stream" } ], "repeated": 0, "id": 5692 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9e3995ab-1f9c-4f13-b827-48b24b6c7174}\\PublishExpandedPath" } ], "repeated": 0, "id": 5693 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9e3995ab-1f9c-4f13-b827-48b24b6c7174}\\DefinitionFlags" } ], "repeated": 0, "id": 5694 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "Attributes" }, { "name": "Data", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9e3995ab-1f9c-4f13-b827-48b24b6c7174}\\Attributes" } ], "repeated": 0, "id": 5695 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9e3995ab-1f9c-4f13-b827-48b24b6c7174}\\FolderTypeID" } ], "repeated": 0, "id": 5696 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9e3995ab-1f9c-4f13-b827-48b24b6c7174}\\InitFolderHandler" } ], "repeated": 0, "id": 5697 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000003dc" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{9e3995ab-1f9c-4f13-b827-48b24b6c7174}\\PropertyBag" } ], "repeated": 0, "id": 5698 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003dc" } ], "repeated": 0, "id": 5699 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000003dc" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 5700 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003dc" }, { "name": "SubKey", "value": "{DF7266AC-9274-4867-8D55-3BD661DE872D}" }, { "name": "Handle", "value": "0x000003f8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DF7266AC-9274-4867-8D55-3BD661DE872D}" } ], "repeated": 0, "id": 5701 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003dc" } ], "repeated": 0, "id": 5702 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f8" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{df7266ac-9274-4867-8d55-3bd661de872d}\\Category" } ], "repeated": 0, "id": 5703 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f8" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "ChangeRemoveProgramsFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{df7266ac-9274-4867-8d55-3bd661de872d}\\Name" } ], "repeated": 0, "id": 5704 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f8" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{df7266ac-9274-4867-8d55-3bd661de872d}\\ParentFolder" } ], "repeated": 0, "id": 5705 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f8" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{df7266ac-9274-4867-8d55-3bd661de872d}\\Description" } ], "repeated": 0, "id": 5706 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f8" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{df7266ac-9274-4867-8d55-3bd661de872d}\\RelativePath" } ], "repeated": 0, "id": 5707 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f8" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "Data", "value": "::{26EE0668-A00A-44D7-9371-BEB064C98683}\\0\\::{7b81be6a-ce2b-4676-a29e-eb907a5126c5}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{df7266ac-9274-4867-8d55-3bd661de872d}\\ParsingName" } ], "repeated": 0, "id": 5708 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f8" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{df7266ac-9274-4867-8d55-3bd661de872d}\\InfoTip" } ], "repeated": 0, "id": 5709 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f8" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{df7266ac-9274-4867-8d55-3bd661de872d}\\LocalizedName" } ], "repeated": 0, "id": 5710 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f8" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{df7266ac-9274-4867-8d55-3bd661de872d}\\Icon" } ], "repeated": 0, "id": 5711 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f8" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{df7266ac-9274-4867-8d55-3bd661de872d}\\Security" } ], "repeated": 0, "id": 5712 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f8" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{df7266ac-9274-4867-8d55-3bd661de872d}\\StreamResource" } ], "repeated": 0, "id": 5713 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f8" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{df7266ac-9274-4867-8d55-3bd661de872d}\\StreamResourceType" } ], "repeated": 0, "id": 5714 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f8" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{df7266ac-9274-4867-8d55-3bd661de872d}\\LocalRedirectOnly" } ], "repeated": 0, "id": 5715 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f8" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{df7266ac-9274-4867-8d55-3bd661de872d}\\Roamable" } ], "repeated": 0, "id": 5716 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f8" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{df7266ac-9274-4867-8d55-3bd661de872d}\\PreCreate" } ], "repeated": 0, "id": 5717 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f8" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{df7266ac-9274-4867-8d55-3bd661de872d}\\Stream" } ], "repeated": 0, "id": 5718 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f8" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{df7266ac-9274-4867-8d55-3bd661de872d}\\PublishExpandedPath" } ], "repeated": 0, "id": 5719 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f8" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{df7266ac-9274-4867-8d55-3bd661de872d}\\DefinitionFlags" } ], "repeated": 0, "id": 5720 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f8" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{df7266ac-9274-4867-8d55-3bd661de872d}\\Attributes" } ], "repeated": 0, "id": 5721 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f8" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{df7266ac-9274-4867-8d55-3bd661de872d}\\FolderTypeID" } ], "repeated": 0, "id": 5722 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f8" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{df7266ac-9274-4867-8d55-3bd661de872d}\\InitFolderHandler" } ], "repeated": 0, "id": 5723 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000003f8" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{df7266ac-9274-4867-8d55-3bd661de872d}\\PropertyBag" } ], "repeated": 0, "id": 5724 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f8" } ], "repeated": 0, "id": 5725 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000003f8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 5726 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003f8" }, { "name": "SubKey", "value": "{ED4824AF-DCE4-45A8-81E2-FC7965083634}" }, { "name": "Handle", "value": "0x000003f4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{ED4824AF-DCE4-45A8-81E2-FC7965083634}" } ], "repeated": 0, "id": 5727 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f8" } ], "repeated": 0, "id": 5728 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f4" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "3" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{ED4824AF-DCE4-45A8-81E2-FC7965083634}\\Category" } ], "repeated": 0, "id": 5729 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f4" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "Common Documents" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{ED4824AF-DCE4-45A8-81E2-FC7965083634}\\Name" } ], "repeated": 0, "id": 5730 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f4" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "Data", "value": "{DFDF76A2-C82A-4D63-906A-5644AC457385}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{ED4824AF-DCE4-45A8-81E2-FC7965083634}\\ParentFolder" } ], "repeated": 0, "id": 5731 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f4" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{ED4824AF-DCE4-45A8-81E2-FC7965083634}\\Description" } ], "repeated": 0, "id": 5732 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f4" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "Documents" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{ED4824AF-DCE4-45A8-81E2-FC7965083634}\\RelativePath" } ], "repeated": 0, "id": 5733 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f4" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{ED4824AF-DCE4-45A8-81E2-FC7965083634}\\ParsingName" } ], "repeated": 0, "id": 5734 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f4" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{ED4824AF-DCE4-45A8-81E2-FC7965083634}\\InfoTip" } ], "repeated": 0, "id": 5735 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f4" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "Data", "value": "@%SystemRoot%\\system32\\shell32.dll,-21801" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{ED4824AF-DCE4-45A8-81E2-FC7965083634}\\LocalizedName" } ], "repeated": 0, "id": 5736 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f4" }, { "name": "ValueName", "value": "Icon" }, { "name": "Data", "value": "%SystemRoot%\\system32\\imageres.dll,-3" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{ED4824AF-DCE4-45A8-81E2-FC7965083634}\\Icon" } ], "repeated": 0, "id": 5737 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f4" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{ED4824AF-DCE4-45A8-81E2-FC7965083634}\\Security" } ], "repeated": 0, "id": 5738 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f4" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{ED4824AF-DCE4-45A8-81E2-FC7965083634}\\StreamResource" } ], "repeated": 0, "id": 5739 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f4" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{ED4824AF-DCE4-45A8-81E2-FC7965083634}\\StreamResourceType" } ], "repeated": 0, "id": 5740 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f4" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{ED4824AF-DCE4-45A8-81E2-FC7965083634}\\LocalRedirectOnly" } ], "repeated": 0, "id": 5741 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f4" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{ED4824AF-DCE4-45A8-81E2-FC7965083634}\\Roamable" } ], "repeated": 0, "id": 5742 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f4" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{ED4824AF-DCE4-45A8-81E2-FC7965083634}\\PreCreate" } ], "repeated": 0, "id": 5743 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f4" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{ED4824AF-DCE4-45A8-81E2-FC7965083634}\\Stream" } ], "repeated": 0, "id": 5744 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f4" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{ED4824AF-DCE4-45A8-81E2-FC7965083634}\\PublishExpandedPath" } ], "repeated": 0, "id": 5745 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f4" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{ED4824AF-DCE4-45A8-81E2-FC7965083634}\\DefinitionFlags" } ], "repeated": 0, "id": 5746 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f4" }, { "name": "ValueName", "value": "Attributes" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{ED4824AF-DCE4-45A8-81E2-FC7965083634}\\Attributes" } ], "repeated": 0, "id": 5747 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f4" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{ED4824AF-DCE4-45A8-81E2-FC7965083634}\\FolderTypeID" } ], "repeated": 0, "id": 5748 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f4" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{ED4824AF-DCE4-45A8-81E2-FC7965083634}\\InitFolderHandler" } ], "repeated": 0, "id": 5749 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003f4" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x000003f8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{ED4824AF-DCE4-45A8-81E2-FC7965083634}\\PropertyBag" } ], "repeated": 0, "id": 5750 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f4" } ], "repeated": 0, "id": 5751 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000003f4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 5752 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003f4" }, { "name": "SubKey", "value": "{008CA0B1-55B4-4C56-B8A8-4DE4B299D3BE}" }, { "name": "Handle", "value": "0x000003d0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{008CA0B1-55B4-4C56-B8A8-4DE4B299D3BE}" } ], "repeated": 0, "id": 5753 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f4" } ], "repeated": 0, "id": 5754 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{008CA0B1-55B4-4C56-B8A8-4DE4B299D3BE}\\Category" } ], "repeated": 0, "id": 5755 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "AccountPictures" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{008CA0B1-55B4-4C56-B8A8-4DE4B299D3BE}\\Name" } ], "repeated": 0, "id": 5756 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "Data", "value": "{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{008CA0B1-55B4-4C56-B8A8-4DE4B299D3BE}\\ParentFolder" } ], "repeated": 0, "id": 5757 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{008CA0B1-55B4-4C56-B8A8-4DE4B299D3BE}\\Description" } ], "repeated": 0, "id": 5758 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "Microsoft\\Windows\\AccountPictures" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{008CA0B1-55B4-4C56-B8A8-4DE4B299D3BE}\\RelativePath" } ], "repeated": 0, "id": 5759 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{008CA0B1-55B4-4C56-B8A8-4DE4B299D3BE}\\ParsingName" } ], "repeated": 0, "id": 5760 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{008CA0B1-55B4-4C56-B8A8-4DE4B299D3BE}\\InfoTip" } ], "repeated": 0, "id": 5761 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "Data", "value": "@C:\\Windows\\System32\\Windows.UI.Immersive.dll,-38305" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{008CA0B1-55B4-4C56-B8A8-4DE4B299D3BE}\\LocalizedName" } ], "repeated": 0, "id": 5762 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{008CA0B1-55B4-4C56-B8A8-4DE4B299D3BE}\\Icon" } ], "repeated": 0, "id": 5763 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{008CA0B1-55B4-4C56-B8A8-4DE4B299D3BE}\\Security" } ], "repeated": 0, "id": 5764 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{008CA0B1-55B4-4C56-B8A8-4DE4B299D3BE}\\StreamResource" } ], "repeated": 0, "id": 5765 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{008CA0B1-55B4-4C56-B8A8-4DE4B299D3BE}\\StreamResourceType" } ], "repeated": 0, "id": 5766 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{008CA0B1-55B4-4C56-B8A8-4DE4B299D3BE}\\LocalRedirectOnly" } ], "repeated": 0, "id": 5767 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "Roamable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{008CA0B1-55B4-4C56-B8A8-4DE4B299D3BE}\\Roamable" } ], "repeated": 0, "id": 5768 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{008CA0B1-55B4-4C56-B8A8-4DE4B299D3BE}\\PreCreate" } ], "repeated": 0, "id": 5769 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{008CA0B1-55B4-4C56-B8A8-4DE4B299D3BE}\\Stream" } ], "repeated": 0, "id": 5770 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{008CA0B1-55B4-4C56-B8A8-4DE4B299D3BE}\\PublishExpandedPath" } ], "repeated": 0, "id": 5771 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{008CA0B1-55B4-4C56-B8A8-4DE4B299D3BE}\\DefinitionFlags" } ], "repeated": 0, "id": 5772 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "Attributes" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{008CA0B1-55B4-4C56-B8A8-4DE4B299D3BE}\\Attributes" } ], "repeated": 0, "id": 5773 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{008CA0B1-55B4-4C56-B8A8-4DE4B299D3BE}\\FolderTypeID" } ], "repeated": 0, "id": 5774 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d0" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{008CA0B1-55B4-4C56-B8A8-4DE4B299D3BE}\\InitFolderHandler" } ], "repeated": 0, "id": 5775 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000003d0" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{008CA0B1-55B4-4C56-B8A8-4DE4B299D3BE}\\PropertyBag" } ], "repeated": 0, "id": 5776 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d0" } ], "repeated": 0, "id": 5777 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000003d0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 5778 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003d0" }, { "name": "SubKey", "value": "{339719B5-8C47-4894-94C2-D8F77ADD44A6}" }, { "name": "Handle", "value": "0x000003f4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{339719B5-8C47-4894-94C2-D8F77ADD44A6}" } ], "repeated": 0, "id": 5779 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d0" } ], "repeated": 0, "id": 5780 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f4" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{339719B5-8C47-4894-94C2-D8F77ADD44A6}\\Category" } ], "repeated": 0, "id": 5781 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f4" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "OneDrivePictures" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{339719B5-8C47-4894-94C2-D8F77ADD44A6}\\Name" } ], "repeated": 0, "id": 5782 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f4" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "Data", "value": "{A52BBA46-E9E1-435f-B3D9-28DAA648C0F6}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{339719B5-8C47-4894-94C2-D8F77ADD44A6}\\ParentFolder" } ], "repeated": 0, "id": 5783 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f4" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{339719B5-8C47-4894-94C2-D8F77ADD44A6}\\Description" } ], "repeated": 0, "id": 5784 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f4" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "Pictures" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{339719B5-8C47-4894-94C2-D8F77ADD44A6}\\RelativePath" } ], "repeated": 0, "id": 5785 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f4" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{339719B5-8C47-4894-94C2-D8F77ADD44A6}\\ParsingName" } ], "repeated": 0, "id": 5786 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f4" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{339719B5-8C47-4894-94C2-D8F77ADD44A6}\\InfoTip" } ], "repeated": 0, "id": 5787 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f4" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{339719B5-8C47-4894-94C2-D8F77ADD44A6}\\LocalizedName" } ], "repeated": 0, "id": 5788 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f4" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{339719B5-8C47-4894-94C2-D8F77ADD44A6}\\Icon" } ], "repeated": 0, "id": 5789 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f4" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{339719B5-8C47-4894-94C2-D8F77ADD44A6}\\Security" } ], "repeated": 0, "id": 5790 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f4" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{339719B5-8C47-4894-94C2-D8F77ADD44A6}\\StreamResource" } ], "repeated": 0, "id": 5791 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f4" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{339719B5-8C47-4894-94C2-D8F77ADD44A6}\\StreamResourceType" } ], "repeated": 0, "id": 5792 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f4" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{339719B5-8C47-4894-94C2-D8F77ADD44A6}\\LocalRedirectOnly" } ], "repeated": 0, "id": 5793 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f4" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{339719B5-8C47-4894-94C2-D8F77ADD44A6}\\Roamable" } ], "repeated": 0, "id": 5794 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f4" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{339719B5-8C47-4894-94C2-D8F77ADD44A6}\\PreCreate" } ], "repeated": 0, "id": 5795 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f4" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{339719B5-8C47-4894-94C2-D8F77ADD44A6}\\Stream" } ], "repeated": 0, "id": 5796 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f4" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{339719B5-8C47-4894-94C2-D8F77ADD44A6}\\PublishExpandedPath" } ], "repeated": 0, "id": 5797 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f4" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "Data", "value": "64" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{339719B5-8C47-4894-94C2-D8F77ADD44A6}\\DefinitionFlags" } ], "repeated": 0, "id": 5798 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f4" }, { "name": "ValueName", "value": "Attributes" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{339719B5-8C47-4894-94C2-D8F77ADD44A6}\\Attributes" } ], "repeated": 0, "id": 5799 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f4" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "Data", "value": "{71D642A9-F2B1-42cd-AD92-EB9300C7CC0A}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{339719B5-8C47-4894-94C2-D8F77ADD44A6}\\FolderTypeID" } ], "repeated": 0, "id": 5800 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f4" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{339719B5-8C47-4894-94C2-D8F77ADD44A6}\\InitFolderHandler" } ], "repeated": 0, "id": 5801 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003f4" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x000003d0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{339719B5-8C47-4894-94C2-D8F77ADD44A6}\\PropertyBag" } ], "repeated": 0, "id": 5802 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f4" } ], "repeated": 0, "id": 5803 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000003f4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 5804 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003f4" }, { "name": "SubKey", "value": "{3214FAB5-9757-4298-BB61-92A9DEAA44FF}" }, { "name": "Handle", "value": "0x000003fc" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3214FAB5-9757-4298-BB61-92A9DEAA44FF}" } ], "repeated": 0, "id": 5805 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f4" } ], "repeated": 0, "id": 5806 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003fc" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "3" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3214FAB5-9757-4298-BB61-92A9DEAA44FF}\\Category" } ], "repeated": 0, "id": 5807 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003fc" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "CommonMusic" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3214FAB5-9757-4298-BB61-92A9DEAA44FF}\\Name" } ], "repeated": 0, "id": 5808 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003fc" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "Data", "value": "{DFDF76A2-C82A-4D63-906A-5644AC457385}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3214FAB5-9757-4298-BB61-92A9DEAA44FF}\\ParentFolder" } ], "repeated": 0, "id": 5809 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003fc" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3214FAB5-9757-4298-BB61-92A9DEAA44FF}\\Description" } ], "repeated": 0, "id": 5810 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003fc" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "Music" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3214FAB5-9757-4298-BB61-92A9DEAA44FF}\\RelativePath" } ], "repeated": 0, "id": 5811 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003fc" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3214FAB5-9757-4298-BB61-92A9DEAA44FF}\\ParsingName" } ], "repeated": 0, "id": 5812 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003fc" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "Data", "value": "@%SystemRoot%\\system32\\shell32.dll,-12689" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3214FAB5-9757-4298-BB61-92A9DEAA44FF}\\InfoTip" } ], "repeated": 0, "id": 5813 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003fc" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "Data", "value": "@%SystemRoot%\\system32\\shell32.dll,-21803" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3214FAB5-9757-4298-BB61-92A9DEAA44FF}\\LocalizedName" } ], "repeated": 0, "id": 5814 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003fc" }, { "name": "ValueName", "value": "Icon" }, { "name": "Data", "value": "%SystemRoot%\\system32\\imageres.dll,-3" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3214FAB5-9757-4298-BB61-92A9DEAA44FF}\\Icon" } ], "repeated": 0, "id": 5815 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003fc" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3214FAB5-9757-4298-BB61-92A9DEAA44FF}\\Security" } ], "repeated": 0, "id": 5816 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003fc" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3214FAB5-9757-4298-BB61-92A9DEAA44FF}\\StreamResource" } ], "repeated": 0, "id": 5817 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003fc" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3214FAB5-9757-4298-BB61-92A9DEAA44FF}\\StreamResourceType" } ], "repeated": 0, "id": 5818 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003fc" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3214FAB5-9757-4298-BB61-92A9DEAA44FF}\\LocalRedirectOnly" } ], "repeated": 0, "id": 5819 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003fc" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3214FAB5-9757-4298-BB61-92A9DEAA44FF}\\Roamable" } ], "repeated": 0, "id": 5820 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003fc" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3214FAB5-9757-4298-BB61-92A9DEAA44FF}\\PreCreate" } ], "repeated": 0, "id": 5821 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003fc" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3214FAB5-9757-4298-BB61-92A9DEAA44FF}\\Stream" } ], "repeated": 0, "id": 5822 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003fc" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3214FAB5-9757-4298-BB61-92A9DEAA44FF}\\PublishExpandedPath" } ], "repeated": 0, "id": 5823 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003fc" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3214FAB5-9757-4298-BB61-92A9DEAA44FF}\\DefinitionFlags" } ], "repeated": 0, "id": 5824 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003fc" }, { "name": "ValueName", "value": "Attributes" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3214FAB5-9757-4298-BB61-92A9DEAA44FF}\\Attributes" } ], "repeated": 0, "id": 5825 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003fc" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3214FAB5-9757-4298-BB61-92A9DEAA44FF}\\FolderTypeID" } ], "repeated": 0, "id": 5826 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003fc" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3214FAB5-9757-4298-BB61-92A9DEAA44FF}\\InitFolderHandler" } ], "repeated": 0, "id": 5827 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003fc" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x000003f4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3214FAB5-9757-4298-BB61-92A9DEAA44FF}\\PropertyBag" } ], "repeated": 0, "id": 5828 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003fc" } ], "repeated": 0, "id": 5829 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000003dc" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 5830 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003dc" }, { "name": "SubKey", "value": "{0D4C3DB6-03A3-462F-A0E6-08924C41B5D4}" }, { "name": "Handle", "value": "0x000003fc" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0D4C3DB6-03A3-462F-A0E6-08924C41B5D4}" } ], "repeated": 0, "id": 5831 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003dc" } ], "repeated": 0, "id": 5832 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003fc" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0D4C3DB6-03A3-462F-A0E6-08924C41B5D4}\\Category" } ], "repeated": 0, "id": 5833 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003fc" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "SearchHistoryFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0D4C3DB6-03A3-462F-A0E6-08924C41B5D4}\\Name" } ], "repeated": 0, "id": 5834 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003fc" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "Data", "value": "{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0D4C3DB6-03A3-462F-A0E6-08924C41B5D4}\\ParentFolder" } ], "repeated": 0, "id": 5835 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003fc" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0D4C3DB6-03A3-462F-A0E6-08924C41B5D4}\\Description" } ], "repeated": 0, "id": 5836 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003fc" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "Microsoft\\Windows\\ConnectedSearch\\History" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0D4C3DB6-03A3-462F-A0E6-08924C41B5D4}\\RelativePath" } ], "repeated": 0, "id": 5837 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003fc" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0D4C3DB6-03A3-462F-A0E6-08924C41B5D4}\\ParsingName" } ], "repeated": 0, "id": 5838 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003fc" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0D4C3DB6-03A3-462F-A0E6-08924C41B5D4}\\InfoTip" } ], "repeated": 0, "id": 5839 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003fc" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0D4C3DB6-03A3-462F-A0E6-08924C41B5D4}\\LocalizedName" } ], "repeated": 0, "id": 5840 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003fc" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0D4C3DB6-03A3-462F-A0E6-08924C41B5D4}\\Icon" } ], "repeated": 0, "id": 5841 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003fc" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0D4C3DB6-03A3-462F-A0E6-08924C41B5D4}\\Security" } ], "repeated": 0, "id": 5842 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003fc" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0D4C3DB6-03A3-462F-A0E6-08924C41B5D4}\\StreamResource" } ], "repeated": 0, "id": 5843 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003fc" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0D4C3DB6-03A3-462F-A0E6-08924C41B5D4}\\StreamResourceType" } ], "repeated": 0, "id": 5844 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003fc" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0D4C3DB6-03A3-462F-A0E6-08924C41B5D4}\\LocalRedirectOnly" } ], "repeated": 0, "id": 5845 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003fc" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0D4C3DB6-03A3-462F-A0E6-08924C41B5D4}\\Roamable" } ], "repeated": 0, "id": 5846 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003fc" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0D4C3DB6-03A3-462F-A0E6-08924C41B5D4}\\PreCreate" } ], "repeated": 0, "id": 5847 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003fc" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0D4C3DB6-03A3-462F-A0E6-08924C41B5D4}\\Stream" } ], "repeated": 0, "id": 5848 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003fc" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0D4C3DB6-03A3-462F-A0E6-08924C41B5D4}\\PublishExpandedPath" } ], "repeated": 0, "id": 5849 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003fc" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0D4C3DB6-03A3-462F-A0E6-08924C41B5D4}\\DefinitionFlags" } ], "repeated": 0, "id": 5850 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003fc" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0D4C3DB6-03A3-462F-A0E6-08924C41B5D4}\\Attributes" } ], "repeated": 0, "id": 5851 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003fc" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0D4C3DB6-03A3-462F-A0E6-08924C41B5D4}\\FolderTypeID" } ], "repeated": 0, "id": 5852 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003fc" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0D4C3DB6-03A3-462F-A0E6-08924C41B5D4}\\InitFolderHandler" } ], "repeated": 0, "id": 5853 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000003fc" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{0D4C3DB6-03A3-462F-A0E6-08924C41B5D4}\\PropertyBag" } ], "repeated": 0, "id": 5854 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003fc" } ], "repeated": 0, "id": 5855 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000003fc" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 5856 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003fc" }, { "name": "SubKey", "value": "{905E63B6-C1BF-494E-B29C-65B732D3D21A}" }, { "name": "Handle", "value": "0x000003dc" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{905E63B6-C1BF-494E-B29C-65B732D3D21A}" } ], "repeated": 0, "id": 5857 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003fc" } ], "repeated": 0, "id": 5858 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{905e63b6-c1bf-494e-b29c-65b732d3d21a}\\Category" } ], "repeated": 0, "id": 5859 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "ProgramFiles" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{905e63b6-c1bf-494e-b29c-65b732d3d21a}\\Name" } ], "repeated": 0, "id": 5860 }, { "timestamp": "2026-05-29 01:05:17,790", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{905e63b6-c1bf-494e-b29c-65b732d3d21a}\\ParentFolder" } ], "repeated": 0, "id": 5861 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{905e63b6-c1bf-494e-b29c-65b732d3d21a}\\Description" } ], "repeated": 0, "id": 5862 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{905e63b6-c1bf-494e-b29c-65b732d3d21a}\\RelativePath" } ], "repeated": 0, "id": 5863 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{905e63b6-c1bf-494e-b29c-65b732d3d21a}\\ParsingName" } ], "repeated": 0, "id": 5864 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{905e63b6-c1bf-494e-b29c-65b732d3d21a}\\InfoTip" } ], "repeated": 0, "id": 5865 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "Data", "value": "@%SystemRoot%\\system32\\shell32.dll,-21781" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{905e63b6-c1bf-494e-b29c-65b732d3d21a}\\LocalizedName" } ], "repeated": 0, "id": 5866 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{905e63b6-c1bf-494e-b29c-65b732d3d21a}\\Icon" } ], "repeated": 0, "id": 5867 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{905e63b6-c1bf-494e-b29c-65b732d3d21a}\\Security" } ], "repeated": 0, "id": 5868 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{905e63b6-c1bf-494e-b29c-65b732d3d21a}\\StreamResource" } ], "repeated": 0, "id": 5869 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{905e63b6-c1bf-494e-b29c-65b732d3d21a}\\StreamResourceType" } ], "repeated": 0, "id": 5870 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{905e63b6-c1bf-494e-b29c-65b732d3d21a}\\LocalRedirectOnly" } ], "repeated": 0, "id": 5871 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{905e63b6-c1bf-494e-b29c-65b732d3d21a}\\Roamable" } ], "repeated": 0, "id": 5872 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{905e63b6-c1bf-494e-b29c-65b732d3d21a}\\PreCreate" } ], "repeated": 0, "id": 5873 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{905e63b6-c1bf-494e-b29c-65b732d3d21a}\\Stream" } ], "repeated": 0, "id": 5874 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{905e63b6-c1bf-494e-b29c-65b732d3d21a}\\PublishExpandedPath" } ], "repeated": 0, "id": 5875 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{905e63b6-c1bf-494e-b29c-65b732d3d21a}\\DefinitionFlags" } ], "repeated": 0, "id": 5876 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "Attributes" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{905e63b6-c1bf-494e-b29c-65b732d3d21a}\\Attributes" } ], "repeated": 0, "id": 5877 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{905e63b6-c1bf-494e-b29c-65b732d3d21a}\\FolderTypeID" } ], "repeated": 0, "id": 5878 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{905e63b6-c1bf-494e-b29c-65b732d3d21a}\\InitFolderHandler" } ], "repeated": 0, "id": 5879 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003dc" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x000003fc" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{905e63b6-c1bf-494e-b29c-65b732d3d21a}\\PropertyBag" } ], "repeated": 0, "id": 5880 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003dc" } ], "repeated": 0, "id": 5881 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000003dc" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 5882 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003dc" }, { "name": "SubKey", "value": "{7CFBEFBC-DE1F-45AA-B843-A542AC536CC9}" }, { "name": "Handle", "value": "0x00000398" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7CFBEFBC-DE1F-45AA-B843-A542AC536CC9}" } ], "repeated": 0, "id": 5883 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003dc" } ], "repeated": 0, "id": 5884 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7CFBEFBC-DE1F-45AA-B843-A542AC536CC9}\\Category" } ], "repeated": 0, "id": 5885 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "AppDataFavorites" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7CFBEFBC-DE1F-45AA-B843-A542AC536CC9}\\Name" } ], "repeated": 0, "id": 5886 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "Data", "value": "{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7CFBEFBC-DE1F-45AA-B843-A542AC536CC9}\\ParentFolder" } ], "repeated": 0, "id": 5887 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7CFBEFBC-DE1F-45AA-B843-A542AC536CC9}\\Description" } ], "repeated": 0, "id": 5888 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "Favorites" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7CFBEFBC-DE1F-45AA-B843-A542AC536CC9}\\RelativePath" } ], "repeated": 0, "id": 5889 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7CFBEFBC-DE1F-45AA-B843-A542AC536CC9}\\ParsingName" } ], "repeated": 0, "id": 5890 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7CFBEFBC-DE1F-45AA-B843-A542AC536CC9}\\InfoTip" } ], "repeated": 0, "id": 5891 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7CFBEFBC-DE1F-45AA-B843-A542AC536CC9}\\LocalizedName" } ], "repeated": 0, "id": 5892 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7CFBEFBC-DE1F-45AA-B843-A542AC536CC9}\\Icon" } ], "repeated": 0, "id": 5893 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7CFBEFBC-DE1F-45AA-B843-A542AC536CC9}\\Security" } ], "repeated": 0, "id": 5894 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7CFBEFBC-DE1F-45AA-B843-A542AC536CC9}\\StreamResource" } ], "repeated": 0, "id": 5895 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7CFBEFBC-DE1F-45AA-B843-A542AC536CC9}\\StreamResourceType" } ], "repeated": 0, "id": 5896 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7CFBEFBC-DE1F-45AA-B843-A542AC536CC9}\\LocalRedirectOnly" } ], "repeated": 0, "id": 5897 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7CFBEFBC-DE1F-45AA-B843-A542AC536CC9}\\Roamable" } ], "repeated": 0, "id": 5898 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7CFBEFBC-DE1F-45AA-B843-A542AC536CC9}\\PreCreate" } ], "repeated": 0, "id": 5899 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7CFBEFBC-DE1F-45AA-B843-A542AC536CC9}\\Stream" } ], "repeated": 0, "id": 5900 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7CFBEFBC-DE1F-45AA-B843-A542AC536CC9}\\PublishExpandedPath" } ], "repeated": 0, "id": 5901 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7CFBEFBC-DE1F-45AA-B843-A542AC536CC9}\\DefinitionFlags" } ], "repeated": 0, "id": 5902 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7CFBEFBC-DE1F-45AA-B843-A542AC536CC9}\\Attributes" } ], "repeated": 0, "id": 5903 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7CFBEFBC-DE1F-45AA-B843-A542AC536CC9}\\FolderTypeID" } ], "repeated": 0, "id": 5904 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7CFBEFBC-DE1F-45AA-B843-A542AC536CC9}\\InitFolderHandler" } ], "repeated": 0, "id": 5905 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000398" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7CFBEFBC-DE1F-45AA-B843-A542AC536CC9}\\PropertyBag" } ], "repeated": 0, "id": 5906 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" } ], "repeated": 0, "id": 5907 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x00000398" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 5908 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000398" }, { "name": "SubKey", "value": "{2F8B40C2-83ED-48EE-B383-A1F157EC6F9A}" }, { "name": "Handle", "value": "0x000003e0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2F8B40C2-83ED-48EE-B383-A1F157EC6F9A}" } ], "repeated": 0, "id": 5909 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" } ], "repeated": 0, "id": 5910 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2F8B40C2-83ED-48EE-B383-A1F157EC6F9A}\\Category" } ], "repeated": 0, "id": 5911 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "Recorded Calls" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2F8B40C2-83ED-48EE-B383-A1F157EC6F9A}\\Name" } ], "repeated": 0, "id": 5912 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "Data", "value": "{5E6C858F-0E22-4760-9AFE-EA3317B67173}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2F8B40C2-83ED-48EE-B383-A1F157EC6F9A}\\ParentFolder" } ], "repeated": 0, "id": 5913 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2F8B40C2-83ED-48EE-B383-A1F157EC6F9A}\\Description" } ], "repeated": 0, "id": 5914 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "Recorded Calls" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2F8B40C2-83ED-48EE-B383-A1F157EC6F9A}\\RelativePath" } ], "repeated": 0, "id": 5915 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2F8B40C2-83ED-48EE-B383-A1F157EC6F9A}\\ParsingName" } ], "repeated": 0, "id": 5916 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2F8B40C2-83ED-48EE-B383-A1F157EC6F9A}\\InfoTip" } ], "repeated": 0, "id": 5917 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "Data", "value": "@%SystemRoot%\\system32\\windows.storage.dll,-21827" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2F8B40C2-83ED-48EE-B383-A1F157EC6F9A}\\LocalizedName" } ], "repeated": 0, "id": 5918 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2F8B40C2-83ED-48EE-B383-A1F157EC6F9A}\\Icon" } ], "repeated": 0, "id": 5919 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2F8B40C2-83ED-48EE-B383-A1F157EC6F9A}\\Security" } ], "repeated": 0, "id": 5920 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2F8B40C2-83ED-48EE-B383-A1F157EC6F9A}\\StreamResource" } ], "repeated": 0, "id": 5921 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2F8B40C2-83ED-48EE-B383-A1F157EC6F9A}\\StreamResourceType" } ], "repeated": 0, "id": 5922 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2F8B40C2-83ED-48EE-B383-A1F157EC6F9A}\\LocalRedirectOnly" } ], "repeated": 0, "id": 5923 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2F8B40C2-83ED-48EE-B383-A1F157EC6F9A}\\Roamable" } ], "repeated": 0, "id": 5924 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2F8B40C2-83ED-48EE-B383-A1F157EC6F9A}\\PreCreate" } ], "repeated": 0, "id": 5925 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2F8B40C2-83ED-48EE-B383-A1F157EC6F9A}\\Stream" } ], "repeated": 0, "id": 5926 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2F8B40C2-83ED-48EE-B383-A1F157EC6F9A}\\PublishExpandedPath" } ], "repeated": 0, "id": 5927 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2F8B40C2-83ED-48EE-B383-A1F157EC6F9A}\\DefinitionFlags" } ], "repeated": 0, "id": 5928 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2F8B40C2-83ED-48EE-B383-A1F157EC6F9A}\\Attributes" } ], "repeated": 0, "id": 5929 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2F8B40C2-83ED-48EE-B383-A1F157EC6F9A}\\FolderTypeID" } ], "repeated": 0, "id": 5930 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2F8B40C2-83ED-48EE-B383-A1F157EC6F9A}\\InitFolderHandler" } ], "repeated": 0, "id": 5931 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000003e0" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2F8B40C2-83ED-48EE-B383-A1F157EC6F9A}\\PropertyBag" } ], "repeated": 0, "id": 5932 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" } ], "repeated": 0, "id": 5933 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" } ], "repeated": 0, "id": 5934 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 5935 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 5936 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000003e0" } ], "repeated": 0, "id": 5937 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5938 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "`\\xa7\\xec\\x11l\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5939 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000002e4" }, { "name": "SubKey", "value": "SessionInfo\\1" }, { "name": "Handle", "value": "0x00000398" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1" } ], "repeated": 0, "id": 5940 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000398" }, { "name": "SubKey", "value": "KnownFolders" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1\\KnownFolders" } ], "repeated": 0, "id": 5941 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" } ], "repeated": 0, "id": 5942 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xa3\\xec\\x11l\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x80\\x98\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5943 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000398" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 5944 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000398" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" }, { "name": "Handle", "value": "0x000002e8" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" } ], "repeated": 0, "id": 5945 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" } ], "repeated": 0, "id": 5946 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "{2F8B40C2-83ED-48EE-B383-A1F157EC6F9A}" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\{2F8B40C2-83ED-48EE-B383-A1F157EC6F9A}" } ], "repeated": 0, "id": 5947 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000398" } ], "repeated": 0, "id": 5948 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xec?\\xc0\\xf5\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5949 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "Handle", "value": "0x00000318" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 5950 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "ProfileImagePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath" } ], "repeated": 0, "id": 5951 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "ProfileImagePath" }, { "name": "Data", "value": "C:\\Users\\admin" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath" } ], "repeated": 0, "id": 5952 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" } ], "repeated": 0, "id": 5953 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" } ], "repeated": 0, "id": 5954 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" } ], "repeated": 0, "id": 5955 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 5956 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000002e8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 5957 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000002e8" }, { "name": "SubKey", "value": "{D20BEEC4-5CA8-4905-AE3B-BF251EA09B53}" }, { "name": "Handle", "value": "0x000003e0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D20BEEC4-5CA8-4905-AE3B-BF251EA09B53}" } ], "repeated": 0, "id": 5958 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 5959 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D20BEEC4-5CA8-4905-AE3B-BF251EA09B53}\\Category" } ], "repeated": 0, "id": 5960 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "NetworkPlacesFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D20BEEC4-5CA8-4905-AE3B-BF251EA09B53}\\Name" } ], "repeated": 0, "id": 5961 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D20BEEC4-5CA8-4905-AE3B-BF251EA09B53}\\ParentFolder" } ], "repeated": 0, "id": 5962 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D20BEEC4-5CA8-4905-AE3B-BF251EA09B53}\\Description" } ], "repeated": 0, "id": 5963 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D20BEEC4-5CA8-4905-AE3B-BF251EA09B53}\\RelativePath" } ], "repeated": 0, "id": 5964 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "Data", "value": "::{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D20BEEC4-5CA8-4905-AE3B-BF251EA09B53}\\ParsingName" } ], "repeated": 0, "id": 5965 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D20BEEC4-5CA8-4905-AE3B-BF251EA09B53}\\InfoTip" } ], "repeated": 0, "id": 5966 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D20BEEC4-5CA8-4905-AE3B-BF251EA09B53}\\LocalizedName" } ], "repeated": 0, "id": 5967 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D20BEEC4-5CA8-4905-AE3B-BF251EA09B53}\\Icon" } ], "repeated": 0, "id": 5968 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D20BEEC4-5CA8-4905-AE3B-BF251EA09B53}\\Security" } ], "repeated": 0, "id": 5969 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D20BEEC4-5CA8-4905-AE3B-BF251EA09B53}\\StreamResource" } ], "repeated": 0, "id": 5970 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D20BEEC4-5CA8-4905-AE3B-BF251EA09B53}\\StreamResourceType" } ], "repeated": 0, "id": 5971 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D20BEEC4-5CA8-4905-AE3B-BF251EA09B53}\\LocalRedirectOnly" } ], "repeated": 0, "id": 5972 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D20BEEC4-5CA8-4905-AE3B-BF251EA09B53}\\Roamable" } ], "repeated": 0, "id": 5973 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D20BEEC4-5CA8-4905-AE3B-BF251EA09B53}\\PreCreate" } ], "repeated": 0, "id": 5974 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D20BEEC4-5CA8-4905-AE3B-BF251EA09B53}\\Stream" } ], "repeated": 0, "id": 5975 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D20BEEC4-5CA8-4905-AE3B-BF251EA09B53}\\PublishExpandedPath" } ], "repeated": 0, "id": 5976 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D20BEEC4-5CA8-4905-AE3B-BF251EA09B53}\\DefinitionFlags" } ], "repeated": 0, "id": 5977 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D20BEEC4-5CA8-4905-AE3B-BF251EA09B53}\\Attributes" } ], "repeated": 0, "id": 5978 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D20BEEC4-5CA8-4905-AE3B-BF251EA09B53}\\FolderTypeID" } ], "repeated": 0, "id": 5979 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003e0" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D20BEEC4-5CA8-4905-AE3B-BF251EA09B53}\\InitFolderHandler" } ], "repeated": 0, "id": 5980 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000003e0" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{D20BEEC4-5CA8-4905-AE3B-BF251EA09B53}\\PropertyBag" } ], "repeated": 0, "id": 5981 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" } ], "repeated": 0, "id": 5982 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000003e0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 5983 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003e0" }, { "name": "SubKey", "value": "{DE92C1C7-837F-4F69-A3BB-86E631204A23}" }, { "name": "Handle", "value": "0x000003dc" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DE92C1C7-837F-4F69-A3BB-86E631204A23}" } ], "repeated": 0, "id": 5984 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" } ], "repeated": 0, "id": 5985 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DE92C1C7-837F-4F69-A3BB-86E631204A23}\\Category" } ], "repeated": 0, "id": 5986 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "Playlists" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DE92C1C7-837F-4F69-A3BB-86E631204A23}\\Name" } ], "repeated": 0, "id": 5987 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "Data", "value": "{4BD8D571-6D19-48D3-BE97-422220080E43}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DE92C1C7-837F-4F69-A3BB-86E631204A23}\\ParentFolder" } ], "repeated": 0, "id": 5988 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DE92C1C7-837F-4F69-A3BB-86E631204A23}\\Description" } ], "repeated": 0, "id": 5989 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "Playlists" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DE92C1C7-837F-4F69-A3BB-86E631204A23}\\RelativePath" } ], "repeated": 0, "id": 5990 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DE92C1C7-837F-4F69-A3BB-86E631204A23}\\ParsingName" } ], "repeated": 0, "id": 5991 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DE92C1C7-837F-4F69-A3BB-86E631204A23}\\InfoTip" } ], "repeated": 0, "id": 5992 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "Data", "value": "@%SystemRoot%\\system32\\windows.storage.dll,-21818" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DE92C1C7-837F-4F69-A3BB-86E631204A23}\\LocalizedName" } ], "repeated": 0, "id": 5993 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DE92C1C7-837F-4F69-A3BB-86E631204A23}\\Icon" } ], "repeated": 0, "id": 5994 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DE92C1C7-837F-4F69-A3BB-86E631204A23}\\Security" } ], "repeated": 0, "id": 5995 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DE92C1C7-837F-4F69-A3BB-86E631204A23}\\StreamResource" } ], "repeated": 0, "id": 5996 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DE92C1C7-837F-4F69-A3BB-86E631204A23}\\StreamResourceType" } ], "repeated": 0, "id": 5997 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DE92C1C7-837F-4F69-A3BB-86E631204A23}\\LocalRedirectOnly" } ], "repeated": 0, "id": 5998 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DE92C1C7-837F-4F69-A3BB-86E631204A23}\\Roamable" } ], "repeated": 0, "id": 5999 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DE92C1C7-837F-4F69-A3BB-86E631204A23}\\PreCreate" } ], "repeated": 0, "id": 6000 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DE92C1C7-837F-4F69-A3BB-86E631204A23}\\Stream" } ], "repeated": 0, "id": 6001 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DE92C1C7-837F-4F69-A3BB-86E631204A23}\\PublishExpandedPath" } ], "repeated": 0, "id": 6002 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DE92C1C7-837F-4F69-A3BB-86E631204A23}\\DefinitionFlags" } ], "repeated": 0, "id": 6003 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "Attributes" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DE92C1C7-837F-4F69-A3BB-86E631204A23}\\Attributes" } ], "repeated": 0, "id": 6004 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DE92C1C7-837F-4F69-A3BB-86E631204A23}\\FolderTypeID" } ], "repeated": 0, "id": 6005 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DE92C1C7-837F-4F69-A3BB-86E631204A23}\\InitFolderHandler" } ], "repeated": 0, "id": 6006 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003dc" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x000003e0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{DE92C1C7-837F-4F69-A3BB-86E631204A23}\\PropertyBag" } ], "repeated": 0, "id": 6007 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003dc" } ], "repeated": 0, "id": 6008 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1f5c0412000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6009 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000003dc" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 6010 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003dc" }, { "name": "SubKey", "value": "{10C07CD0-EF91-4567-B850-448B77CB37F9}" }, { "name": "Handle", "value": "0x000003d8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{10C07CD0-EF91-4567-B850-448B77CB37F9}" } ], "repeated": 0, "id": 6011 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003dc" } ], "repeated": 0, "id": 6012 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d8" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{10C07CD0-EF91-4567-B850-448B77CB37F9}\\Category" } ], "repeated": 0, "id": 6013 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d8" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "DpapiKeys" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{10C07CD0-EF91-4567-B850-448B77CB37F9}\\Name" } ], "repeated": 0, "id": 6014 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d8" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{10C07CD0-EF91-4567-B850-448B77CB37F9}\\ParentFolder" } ], "repeated": 0, "id": 6015 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d8" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{10C07CD0-EF91-4567-B850-448B77CB37F9}\\Description" } ], "repeated": 0, "id": 6016 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d8" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{10C07CD0-EF91-4567-B850-448B77CB37F9}\\RelativePath" } ], "repeated": 0, "id": 6017 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d8" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{10C07CD0-EF91-4567-B850-448B77CB37F9}\\ParsingName" } ], "repeated": 0, "id": 6018 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d8" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{10C07CD0-EF91-4567-B850-448B77CB37F9}\\InfoTip" } ], "repeated": 0, "id": 6019 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d8" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{10C07CD0-EF91-4567-B850-448B77CB37F9}\\LocalizedName" } ], "repeated": 0, "id": 6020 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d8" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{10C07CD0-EF91-4567-B850-448B77CB37F9}\\Icon" } ], "repeated": 0, "id": 6021 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d8" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{10C07CD0-EF91-4567-B850-448B77CB37F9}\\Security" } ], "repeated": 0, "id": 6022 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d8" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{10C07CD0-EF91-4567-B850-448B77CB37F9}\\StreamResource" } ], "repeated": 0, "id": 6023 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d8" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{10C07CD0-EF91-4567-B850-448B77CB37F9}\\StreamResourceType" } ], "repeated": 0, "id": 6024 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d8" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{10C07CD0-EF91-4567-B850-448B77CB37F9}\\LocalRedirectOnly" } ], "repeated": 0, "id": 6025 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d8" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{10C07CD0-EF91-4567-B850-448B77CB37F9}\\Roamable" } ], "repeated": 0, "id": 6026 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d8" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{10C07CD0-EF91-4567-B850-448B77CB37F9}\\PreCreate" } ], "repeated": 0, "id": 6027 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d8" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{10C07CD0-EF91-4567-B850-448B77CB37F9}\\Stream" } ], "repeated": 0, "id": 6028 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d8" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{10C07CD0-EF91-4567-B850-448B77CB37F9}\\PublishExpandedPath" } ], "repeated": 0, "id": 6029 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d8" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{10C07CD0-EF91-4567-B850-448B77CB37F9}\\DefinitionFlags" } ], "repeated": 0, "id": 6030 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d8" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{10C07CD0-EF91-4567-B850-448B77CB37F9}\\Attributes" } ], "repeated": 0, "id": 6031 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d8" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{10C07CD0-EF91-4567-B850-448B77CB37F9}\\FolderTypeID" } ], "repeated": 0, "id": 6032 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d8" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{10C07CD0-EF91-4567-B850-448B77CB37F9}\\InitFolderHandler" } ], "repeated": 0, "id": 6033 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000003d8" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{10C07CD0-EF91-4567-B850-448B77CB37F9}\\PropertyBag" } ], "repeated": 0, "id": 6034 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d8" } ], "repeated": 0, "id": 6035 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000034c" }, { "name": "ValueName", "value": "ThisPCPolicy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\PropertyBag\\ThisPCPolicy" } ], "repeated": 0, "id": 6036 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000034c" }, { "name": "ValueName", "value": "ThisPCPolicy" }, { "name": "Data", "value": "Hide" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\PropertyBag\\ThisPCPolicy" } ], "repeated": 0, "id": 6037 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000003d8" } ], "repeated": 0, "id": 6038 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 6039 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d8" } ], "repeated": 0, "id": 6040 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x10\\xc9\\xec\\x11l\\x00\\x00\\x00\\x00\\x00\\x00\\x00l\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00l\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00<\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x8c\\xeb?\\xc0\\xf5\\x01\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 6041 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003d8" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 6042 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003d8" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6043 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000003d8" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 6044 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x0000000c" }, { "name": "TokenHandle", "value": "0x000003dc" } ], "repeated": 0, "id": 6045 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" }, { "name": "Handle", "value": "0x000002e8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" } ], "repeated": 0, "id": 6046 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "RDVirtualizationPool" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\RDVirtualizationPool" } ], "repeated": 0, "id": 6047 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 6048 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" }, { "name": "Handle", "value": "0x000002e8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" } ], "repeated": 0, "id": 6049 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "RDVirtualizationPool" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\RDVirtualizationPool" } ], "repeated": 0, "id": 6050 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 6051 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x90\\xc9\\xec\\x11l\\x00\\x00\\x00\\x00\\x00\\x00\\x00l\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xa0\\xbd}\\x1a\\xff\\x7f\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xf8\\x81}\\x1a" } ], "repeated": 0, "id": 6052 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\fdeploy" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\fdeploy" } ], "repeated": 0, "id": 6053 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003dc" } ], "repeated": 0, "id": 6054 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003d8" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" }, { "name": "Handle", "value": "0x000003dc" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" } ], "repeated": 0, "id": 6055 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003dc" } ], "repeated": 0, "id": 6056 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d8" } ], "repeated": 0, "id": 6057 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000003d8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 6058 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003d8" }, { "name": "SubKey", "value": "{C1BAE2D0-10DF-4334-BEDD-7AA20B227A9D}" }, { "name": "Handle", "value": "0x000003dc" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C1BAE2D0-10DF-4334-BEDD-7AA20B227A9D}" } ], "repeated": 0, "id": 6059 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d8" } ], "repeated": 0, "id": 6060 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "3" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C1BAE2D0-10DF-4334-BEDD-7AA20B227A9D}\\Category" } ], "repeated": 0, "id": 6061 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "OEM Links" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C1BAE2D0-10DF-4334-BEDD-7AA20B227A9D}\\Name" } ], "repeated": 0, "id": 6062 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "Data", "value": "{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C1BAE2D0-10DF-4334-BEDD-7AA20B227A9D}\\ParentFolder" } ], "repeated": 0, "id": 6063 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C1BAE2D0-10DF-4334-BEDD-7AA20B227A9D}\\Description" } ], "repeated": 0, "id": 6064 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "OEM Links" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C1BAE2D0-10DF-4334-BEDD-7AA20B227A9D}\\RelativePath" } ], "repeated": 0, "id": 6065 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C1BAE2D0-10DF-4334-BEDD-7AA20B227A9D}\\ParsingName" } ], "repeated": 0, "id": 6066 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C1BAE2D0-10DF-4334-BEDD-7AA20B227A9D}\\InfoTip" } ], "repeated": 0, "id": 6067 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C1BAE2D0-10DF-4334-BEDD-7AA20B227A9D}\\LocalizedName" } ], "repeated": 0, "id": 6068 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C1BAE2D0-10DF-4334-BEDD-7AA20B227A9D}\\Icon" } ], "repeated": 0, "id": 6069 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C1BAE2D0-10DF-4334-BEDD-7AA20B227A9D}\\Security" } ], "repeated": 0, "id": 6070 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C1BAE2D0-10DF-4334-BEDD-7AA20B227A9D}\\StreamResource" } ], "repeated": 0, "id": 6071 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C1BAE2D0-10DF-4334-BEDD-7AA20B227A9D}\\StreamResourceType" } ], "repeated": 0, "id": 6072 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C1BAE2D0-10DF-4334-BEDD-7AA20B227A9D}\\LocalRedirectOnly" } ], "repeated": 0, "id": 6073 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C1BAE2D0-10DF-4334-BEDD-7AA20B227A9D}\\Roamable" } ], "repeated": 0, "id": 6074 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C1BAE2D0-10DF-4334-BEDD-7AA20B227A9D}\\PreCreate" } ], "repeated": 0, "id": 6075 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C1BAE2D0-10DF-4334-BEDD-7AA20B227A9D}\\Stream" } ], "repeated": 0, "id": 6076 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C1BAE2D0-10DF-4334-BEDD-7AA20B227A9D}\\PublishExpandedPath" } ], "repeated": 0, "id": 6077 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C1BAE2D0-10DF-4334-BEDD-7AA20B227A9D}\\DefinitionFlags" } ], "repeated": 0, "id": 6078 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C1BAE2D0-10DF-4334-BEDD-7AA20B227A9D}\\Attributes" } ], "repeated": 0, "id": 6079 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C1BAE2D0-10DF-4334-BEDD-7AA20B227A9D}\\FolderTypeID" } ], "repeated": 0, "id": 6080 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C1BAE2D0-10DF-4334-BEDD-7AA20B227A9D}\\InitFolderHandler" } ], "repeated": 0, "id": 6081 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000003dc" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{C1BAE2D0-10DF-4334-BEDD-7AA20B227A9D}\\PropertyBag" } ], "repeated": 0, "id": 6082 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003dc" } ], "repeated": 0, "id": 6083 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000003dc" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 6084 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003dc" }, { "name": "SubKey", "value": "{190337D1-B8CA-4121-A639-6D472D16972A}" }, { "name": "Handle", "value": "0x000003d8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{190337D1-B8CA-4121-A639-6D472D16972A}" } ], "repeated": 0, "id": 6085 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003dc" } ], "repeated": 0, "id": 6086 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d8" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{190337d1-b8ca-4121-a639-6d472d16972a}\\Category" } ], "repeated": 0, "id": 6087 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d8" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "SearchHomeFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{190337d1-b8ca-4121-a639-6d472d16972a}\\Name" } ], "repeated": 0, "id": 6088 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d8" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{190337d1-b8ca-4121-a639-6d472d16972a}\\ParentFolder" } ], "repeated": 0, "id": 6089 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d8" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{190337d1-b8ca-4121-a639-6d472d16972a}\\Description" } ], "repeated": 0, "id": 6090 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d8" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{190337d1-b8ca-4121-a639-6d472d16972a}\\RelativePath" } ], "repeated": 0, "id": 6091 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d8" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "Data", "value": "::{9343812e-1c37-4a49-a12e-4b2d810d956b}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{190337d1-b8ca-4121-a639-6d472d16972a}\\ParsingName" } ], "repeated": 0, "id": 6092 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d8" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{190337d1-b8ca-4121-a639-6d472d16972a}\\InfoTip" } ], "repeated": 0, "id": 6093 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d8" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{190337d1-b8ca-4121-a639-6d472d16972a}\\LocalizedName" } ], "repeated": 0, "id": 6094 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d8" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{190337d1-b8ca-4121-a639-6d472d16972a}\\Icon" } ], "repeated": 0, "id": 6095 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d8" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{190337d1-b8ca-4121-a639-6d472d16972a}\\Security" } ], "repeated": 0, "id": 6096 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d8" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{190337d1-b8ca-4121-a639-6d472d16972a}\\StreamResource" } ], "repeated": 0, "id": 6097 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d8" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{190337d1-b8ca-4121-a639-6d472d16972a}\\StreamResourceType" } ], "repeated": 0, "id": 6098 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d8" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{190337d1-b8ca-4121-a639-6d472d16972a}\\LocalRedirectOnly" } ], "repeated": 0, "id": 6099 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d8" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{190337d1-b8ca-4121-a639-6d472d16972a}\\Roamable" } ], "repeated": 0, "id": 6100 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d8" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{190337d1-b8ca-4121-a639-6d472d16972a}\\PreCreate" } ], "repeated": 0, "id": 6101 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d8" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{190337d1-b8ca-4121-a639-6d472d16972a}\\Stream" } ], "repeated": 0, "id": 6102 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d8" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{190337d1-b8ca-4121-a639-6d472d16972a}\\PublishExpandedPath" } ], "repeated": 0, "id": 6103 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d8" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{190337d1-b8ca-4121-a639-6d472d16972a}\\DefinitionFlags" } ], "repeated": 0, "id": 6104 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d8" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{190337d1-b8ca-4121-a639-6d472d16972a}\\Attributes" } ], "repeated": 0, "id": 6105 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d8" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{190337d1-b8ca-4121-a639-6d472d16972a}\\FolderTypeID" } ], "repeated": 0, "id": 6106 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d8" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{190337d1-b8ca-4121-a639-6d472d16972a}\\InitFolderHandler" } ], "repeated": 0, "id": 6107 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000003d8" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{190337d1-b8ca-4121-a639-6d472d16972a}\\PropertyBag" } ], "repeated": 0, "id": 6108 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d8" } ], "repeated": 0, "id": 6109 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000390" }, { "name": "ValueName", "value": "ThisPCPolicy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{f42ee2d3-909f-4907-8871-4c22fc0bf756}\\PropertyBag\\ThisPCPolicy" } ], "repeated": 0, "id": 6110 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000390" }, { "name": "ValueName", "value": "ThisPCPolicy" }, { "name": "Data", "value": "Show" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{f42ee2d3-909f-4907-8871-4c22fc0bf756}\\PropertyBag\\ThisPCPolicy" } ], "repeated": 0, "id": 6111 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000390" }, { "name": "ValueName", "value": "BaseFolderId" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{f42ee2d3-909f-4907-8871-4c22fc0bf756}\\PropertyBag\\BaseFolderId" } ], "repeated": 0, "id": 6112 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000390" }, { "name": "ValueName", "value": "BaseFolderId" }, { "name": "Data", "value": "{FDD39AD0-238F-46AF-ADB4-6C85480369C7}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{f42ee2d3-909f-4907-8871-4c22fc0bf756}\\PropertyBag\\BaseFolderId" } ], "repeated": 0, "id": 6113 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000003d8" } ], "repeated": 0, "id": 6114 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 6115 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d8" } ], "repeated": 0, "id": 6116 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x10\\xc9\\xec\\x11l\\x00\\x00\\x00\\x00\\x00\\x00\\x00l\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00l\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00<\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\xe4?\\xc0\\xf5\\x01\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 6117 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003d8" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 6118 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003d8" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6119 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000003d8" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 6120 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x0000000c" }, { "name": "TokenHandle", "value": "0x000003dc" } ], "repeated": 0, "id": 6121 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" }, { "name": "Handle", "value": "0x000002e8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" } ], "repeated": 0, "id": 6122 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "RDVirtualizationPool" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\RDVirtualizationPool" } ], "repeated": 0, "id": 6123 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 6124 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" }, { "name": "Handle", "value": "0x000002e8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server" } ], "repeated": 0, "id": 6125 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "RDVirtualizationPool" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\RDVirtualizationPool" } ], "repeated": 0, "id": 6126 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 6127 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x90\\xc9\\xec\\x11l\\x00\\x00\\x00\\x00\\x00\\x00\\x00l\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xa0\\xbd}\\x1a\\xff\\x7f\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xf8\\x81}\\x1a" } ], "repeated": 0, "id": 6128 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\fdeploy" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\fdeploy" } ], "repeated": 0, "id": 6129 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003dc" } ], "repeated": 0, "id": 6130 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003d8" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" }, { "name": "Handle", "value": "0x000003dc" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" } ], "repeated": 0, "id": 6131 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003dc" } ], "repeated": 0, "id": 6132 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d8" } ], "repeated": 0, "id": 6133 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" } ], "repeated": 0, "id": 6134 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 6135 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 6136 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000003d8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 6137 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003d8" }, { "name": "SubKey", "value": "{1C2AC1DC-4358-4B6C-9733-AF21156576F0}" }, { "name": "Handle", "value": "0x000003dc" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1C2AC1DC-4358-4B6C-9733-AF21156576F0}" } ], "repeated": 0, "id": 6138 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d8" } ], "repeated": 0, "id": 6139 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1C2AC1DC-4358-4B6C-9733-AF21156576F0}\\Category" } ], "repeated": 0, "id": 6140 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "ThisDeviceFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1C2AC1DC-4358-4B6C-9733-AF21156576F0}\\Name" } ], "repeated": 0, "id": 6141 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1C2AC1DC-4358-4B6C-9733-AF21156576F0}\\ParentFolder" } ], "repeated": 0, "id": 6142 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1C2AC1DC-4358-4B6C-9733-AF21156576F0}\\Description" } ], "repeated": 0, "id": 6143 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1C2AC1DC-4358-4B6C-9733-AF21156576F0}\\RelativePath" } ], "repeated": 0, "id": 6144 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "Data", "value": "::{f8278c54-a712-415b-b593-b77a2be0dda9}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1C2AC1DC-4358-4B6C-9733-AF21156576F0}\\ParsingName" } ], "repeated": 0, "id": 6145 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1C2AC1DC-4358-4B6C-9733-AF21156576F0}\\InfoTip" } ], "repeated": 0, "id": 6146 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1C2AC1DC-4358-4B6C-9733-AF21156576F0}\\LocalizedName" } ], "repeated": 0, "id": 6147 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1C2AC1DC-4358-4B6C-9733-AF21156576F0}\\Icon" } ], "repeated": 0, "id": 6148 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1C2AC1DC-4358-4B6C-9733-AF21156576F0}\\Security" } ], "repeated": 0, "id": 6149 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1C2AC1DC-4358-4B6C-9733-AF21156576F0}\\StreamResource" } ], "repeated": 0, "id": 6150 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1C2AC1DC-4358-4B6C-9733-AF21156576F0}\\StreamResourceType" } ], "repeated": 0, "id": 6151 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1C2AC1DC-4358-4B6C-9733-AF21156576F0}\\LocalRedirectOnly" } ], "repeated": 0, "id": 6152 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1C2AC1DC-4358-4B6C-9733-AF21156576F0}\\Roamable" } ], "repeated": 0, "id": 6153 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1C2AC1DC-4358-4B6C-9733-AF21156576F0}\\PreCreate" } ], "repeated": 0, "id": 6154 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1C2AC1DC-4358-4B6C-9733-AF21156576F0}\\Stream" } ], "repeated": 0, "id": 6155 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1C2AC1DC-4358-4B6C-9733-AF21156576F0}\\PublishExpandedPath" } ], "repeated": 0, "id": 6156 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1C2AC1DC-4358-4B6C-9733-AF21156576F0}\\DefinitionFlags" } ], "repeated": 0, "id": 6157 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1C2AC1DC-4358-4B6C-9733-AF21156576F0}\\Attributes" } ], "repeated": 0, "id": 6158 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1C2AC1DC-4358-4B6C-9733-AF21156576F0}\\FolderTypeID" } ], "repeated": 0, "id": 6159 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1C2AC1DC-4358-4B6C-9733-AF21156576F0}\\InitFolderHandler" } ], "repeated": 0, "id": 6160 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000003dc" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1C2AC1DC-4358-4B6C-9733-AF21156576F0}\\PropertyBag" } ], "repeated": 0, "id": 6161 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003dc" } ], "repeated": 0, "id": 6162 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000003dc" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 6163 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003dc" }, { "name": "SubKey", "value": "{54EED2E0-E7CA-4FDB-9148-0F4247291CFA}" }, { "name": "Handle", "value": "0x000003d8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{54EED2E0-E7CA-4FDB-9148-0F4247291CFA}" } ], "repeated": 0, "id": 6164 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003dc" } ], "repeated": 0, "id": 6165 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d8" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{54EED2E0-E7CA-4fdb-9148-0F4247291CFA}\\Category" } ], "repeated": 0, "id": 6166 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d8" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "SystemCertificates" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{54EED2E0-E7CA-4fdb-9148-0F4247291CFA}\\Name" } ], "repeated": 0, "id": 6167 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d8" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{54EED2E0-E7CA-4fdb-9148-0F4247291CFA}\\ParentFolder" } ], "repeated": 0, "id": 6168 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d8" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{54EED2E0-E7CA-4fdb-9148-0F4247291CFA}\\Description" } ], "repeated": 0, "id": 6169 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d8" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{54EED2E0-E7CA-4fdb-9148-0F4247291CFA}\\RelativePath" } ], "repeated": 0, "id": 6170 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d8" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{54EED2E0-E7CA-4fdb-9148-0F4247291CFA}\\ParsingName" } ], "repeated": 0, "id": 6171 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d8" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{54EED2E0-E7CA-4fdb-9148-0F4247291CFA}\\InfoTip" } ], "repeated": 0, "id": 6172 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d8" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{54EED2E0-E7CA-4fdb-9148-0F4247291CFA}\\LocalizedName" } ], "repeated": 0, "id": 6173 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d8" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{54EED2E0-E7CA-4fdb-9148-0F4247291CFA}\\Icon" } ], "repeated": 0, "id": 6174 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d8" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{54EED2E0-E7CA-4fdb-9148-0F4247291CFA}\\Security" } ], "repeated": 0, "id": 6175 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d8" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{54EED2E0-E7CA-4fdb-9148-0F4247291CFA}\\StreamResource" } ], "repeated": 0, "id": 6176 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d8" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{54EED2E0-E7CA-4fdb-9148-0F4247291CFA}\\StreamResourceType" } ], "repeated": 0, "id": 6177 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d8" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{54EED2E0-E7CA-4fdb-9148-0F4247291CFA}\\LocalRedirectOnly" } ], "repeated": 0, "id": 6178 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d8" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{54EED2E0-E7CA-4fdb-9148-0F4247291CFA}\\Roamable" } ], "repeated": 0, "id": 6179 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d8" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{54EED2E0-E7CA-4fdb-9148-0F4247291CFA}\\PreCreate" } ], "repeated": 0, "id": 6180 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d8" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{54EED2E0-E7CA-4fdb-9148-0F4247291CFA}\\Stream" } ], "repeated": 0, "id": 6181 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d8" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{54EED2E0-E7CA-4fdb-9148-0F4247291CFA}\\PublishExpandedPath" } ], "repeated": 0, "id": 6182 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d8" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{54EED2E0-E7CA-4fdb-9148-0F4247291CFA}\\DefinitionFlags" } ], "repeated": 0, "id": 6183 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d8" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{54EED2E0-E7CA-4fdb-9148-0F4247291CFA}\\Attributes" } ], "repeated": 0, "id": 6184 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d8" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{54EED2E0-E7CA-4fdb-9148-0F4247291CFA}\\FolderTypeID" } ], "repeated": 0, "id": 6185 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d8" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{54EED2E0-E7CA-4fdb-9148-0F4247291CFA}\\InitFolderHandler" } ], "repeated": 0, "id": 6186 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000003d8" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{54EED2E0-E7CA-4fdb-9148-0F4247291CFA}\\PropertyBag" } ], "repeated": 0, "id": 6187 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d8" } ], "repeated": 0, "id": 6188 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000003d8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 6189 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003d8" }, { "name": "SubKey", "value": "{BFB9D5E0-C6A9-404C-B2B2-AE6DB6AF4968}" }, { "name": "Handle", "value": "0x000003dc" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{BFB9D5E0-C6A9-404C-B2B2-AE6DB6AF4968}" } ], "repeated": 0, "id": 6190 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d8" } ], "repeated": 0, "id": 6191 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{bfb9d5e0-c6a9-404c-b2b2-ae6db6af4968}\\Category" } ], "repeated": 0, "id": 6192 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "Links" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{bfb9d5e0-c6a9-404c-b2b2-ae6db6af4968}\\Name" } ], "repeated": 0, "id": 6193 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{bfb9d5e0-c6a9-404c-b2b2-ae6db6af4968}\\ParentFolder" } ], "repeated": 0, "id": 6194 }, { "timestamp": "2026-05-29 01:05:17,805", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{bfb9d5e0-c6a9-404c-b2b2-ae6db6af4968}\\Description" } ], "repeated": 0, "id": 6195 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "Links" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{bfb9d5e0-c6a9-404c-b2b2-ae6db6af4968}\\RelativePath" } ], "repeated": 0, "id": 6196 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "Data", "value": "::{59031a47-3f72-44a7-89c5-5595fe6b30ee}\\{bfb9d5e0-c6a9-404c-b2b2-ae6db6af4968}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{bfb9d5e0-c6a9-404c-b2b2-ae6db6af4968}\\ParsingName" } ], "repeated": 0, "id": 6197 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{bfb9d5e0-c6a9-404c-b2b2-ae6db6af4968}\\InfoTip" } ], "repeated": 0, "id": 6198 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "Data", "value": "@%SystemRoot%\\system32\\shell32.dll,-21810" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{bfb9d5e0-c6a9-404c-b2b2-ae6db6af4968}\\LocalizedName" } ], "repeated": 0, "id": 6199 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "Icon" }, { "name": "Data", "value": "%SystemRoot%\\system32\\imageres.dll,-185" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{bfb9d5e0-c6a9-404c-b2b2-ae6db6af4968}\\Icon" } ], "repeated": 0, "id": 6200 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{bfb9d5e0-c6a9-404c-b2b2-ae6db6af4968}\\Security" } ], "repeated": 0, "id": 6201 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{bfb9d5e0-c6a9-404c-b2b2-ae6db6af4968}\\StreamResource" } ], "repeated": 0, "id": 6202 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{bfb9d5e0-c6a9-404c-b2b2-ae6db6af4968}\\StreamResourceType" } ], "repeated": 0, "id": 6203 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{bfb9d5e0-c6a9-404c-b2b2-ae6db6af4968}\\LocalRedirectOnly" } ], "repeated": 0, "id": 6204 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "Roamable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{bfb9d5e0-c6a9-404c-b2b2-ae6db6af4968}\\Roamable" } ], "repeated": 0, "id": 6205 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{bfb9d5e0-c6a9-404c-b2b2-ae6db6af4968}\\PreCreate" } ], "repeated": 0, "id": 6206 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{bfb9d5e0-c6a9-404c-b2b2-ae6db6af4968}\\Stream" } ], "repeated": 0, "id": 6207 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{bfb9d5e0-c6a9-404c-b2b2-ae6db6af4968}\\PublishExpandedPath" } ], "repeated": 0, "id": 6208 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{bfb9d5e0-c6a9-404c-b2b2-ae6db6af4968}\\DefinitionFlags" } ], "repeated": 0, "id": 6209 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "Attributes" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{bfb9d5e0-c6a9-404c-b2b2-ae6db6af4968}\\Attributes" } ], "repeated": 0, "id": 6210 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{bfb9d5e0-c6a9-404c-b2b2-ae6db6af4968}\\FolderTypeID" } ], "repeated": 0, "id": 6211 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{bfb9d5e0-c6a9-404c-b2b2-ae6db6af4968}\\InitFolderHandler" } ], "repeated": 0, "id": 6212 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000003dc" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{bfb9d5e0-c6a9-404c-b2b2-ae6db6af4968}\\PropertyBag" } ], "repeated": 0, "id": 6213 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003dc" } ], "repeated": 0, "id": 6214 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" } ], "repeated": 0, "id": 6215 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 6216 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 6217 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000003d8" } ], "repeated": 0, "id": 6218 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 6219 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "`\\xa7\\xec\\x11l\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 6220 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000002e4" }, { "name": "SubKey", "value": "SessionInfo\\1" }, { "name": "Handle", "value": "0x000002e8" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1" } ], "repeated": 0, "id": 6221 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000002e8" }, { "name": "SubKey", "value": "KnownFolders" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1\\KnownFolders" } ], "repeated": 0, "id": 6222 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 6223 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xa3\\xec\\x11l\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x80\\xe8\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 6224 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003dc" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 6225 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003dc" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" }, { "name": "Handle", "value": "0x000002e8" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" } ], "repeated": 0, "id": 6226 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003dc" } ], "repeated": 0, "id": 6227 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "{BFB9D5E0-C6A9-404C-B2B2-AE6DB6AF4968}" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\{BFB9D5E0-C6A9-404C-B2B2-AE6DB6AF4968}" } ], "repeated": 0, "id": 6228 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000003dc" } ], "repeated": 0, "id": 6229 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xde?\\xc0\\xf5\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 6230 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "Handle", "value": "0x00000398" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 6231 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "ProfileImagePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath" } ], "repeated": 0, "id": 6232 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "ProfileImagePath" }, { "name": "Data", "value": "C:\\Users\\admin" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath" } ], "repeated": 0, "id": 6233 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" } ], "repeated": 0, "id": 6234 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003dc" } ], "repeated": 0, "id": 6235 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d8" } ], "repeated": 0, "id": 6236 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 6237 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000002e8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 6238 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000002e8" }, { "name": "SubKey", "value": "{5CD7AEE2-2219-4A67-B85D-6C9CE15660CB}" }, { "name": "Handle", "value": "0x00000318" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5CD7AEE2-2219-4A67-B85D-6C9CE15660CB}" } ], "repeated": 0, "id": 6239 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 6240 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5cd7aee2-2219-4a67-b85d-6c9ce15660cb}\\Category" } ], "repeated": 0, "id": 6241 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "UserProgramFiles" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5cd7aee2-2219-4a67-b85d-6c9ce15660cb}\\Name" } ], "repeated": 0, "id": 6242 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "Data", "value": "{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5cd7aee2-2219-4a67-b85d-6c9ce15660cb}\\ParentFolder" } ], "repeated": 0, "id": 6243 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5cd7aee2-2219-4a67-b85d-6c9ce15660cb}\\Description" } ], "repeated": 0, "id": 6244 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "Programs" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5cd7aee2-2219-4a67-b85d-6c9ce15660cb}\\RelativePath" } ], "repeated": 0, "id": 6245 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5cd7aee2-2219-4a67-b85d-6c9ce15660cb}\\ParsingName" } ], "repeated": 0, "id": 6246 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5cd7aee2-2219-4a67-b85d-6c9ce15660cb}\\InfoTip" } ], "repeated": 0, "id": 6247 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5cd7aee2-2219-4a67-b85d-6c9ce15660cb}\\LocalizedName" } ], "repeated": 0, "id": 6248 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5cd7aee2-2219-4a67-b85d-6c9ce15660cb}\\Icon" } ], "repeated": 0, "id": 6249 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5cd7aee2-2219-4a67-b85d-6c9ce15660cb}\\Security" } ], "repeated": 0, "id": 6250 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5cd7aee2-2219-4a67-b85d-6c9ce15660cb}\\StreamResource" } ], "repeated": 0, "id": 6251 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5cd7aee2-2219-4a67-b85d-6c9ce15660cb}\\StreamResourceType" } ], "repeated": 0, "id": 6252 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5cd7aee2-2219-4a67-b85d-6c9ce15660cb}\\LocalRedirectOnly" } ], "repeated": 0, "id": 6253 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5cd7aee2-2219-4a67-b85d-6c9ce15660cb}\\Roamable" } ], "repeated": 0, "id": 6254 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5cd7aee2-2219-4a67-b85d-6c9ce15660cb}\\PreCreate" } ], "repeated": 0, "id": 6255 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5cd7aee2-2219-4a67-b85d-6c9ce15660cb}\\Stream" } ], "repeated": 0, "id": 6256 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5cd7aee2-2219-4a67-b85d-6c9ce15660cb}\\PublishExpandedPath" } ], "repeated": 0, "id": 6257 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5cd7aee2-2219-4a67-b85d-6c9ce15660cb}\\DefinitionFlags" } ], "repeated": 0, "id": 6258 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5cd7aee2-2219-4a67-b85d-6c9ce15660cb}\\Attributes" } ], "repeated": 0, "id": 6259 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5cd7aee2-2219-4a67-b85d-6c9ce15660cb}\\FolderTypeID" } ], "repeated": 0, "id": 6260 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5cd7aee2-2219-4a67-b85d-6c9ce15660cb}\\InitFolderHandler" } ], "repeated": 0, "id": 6261 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000318" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5cd7aee2-2219-4a67-b85d-6c9ce15660cb}\\PropertyBag" } ], "repeated": 0, "id": 6262 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" } ], "repeated": 0, "id": 6263 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000002e8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 6264 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000002e8" }, { "name": "SubKey", "value": "{B94237E7-57AC-4347-9151-B08C6C32D1F7}" }, { "name": "Handle", "value": "0x00000398" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B94237E7-57AC-4347-9151-B08C6C32D1F7}" } ], "repeated": 0, "id": 6265 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 6266 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "3" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B94237E7-57AC-4347-9151-B08C6C32D1F7}\\Category" } ], "repeated": 0, "id": 6267 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "Common Templates" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B94237E7-57AC-4347-9151-B08C6C32D1F7}\\Name" } ], "repeated": 0, "id": 6268 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "Data", "value": "{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B94237E7-57AC-4347-9151-B08C6C32D1F7}\\ParentFolder" } ], "repeated": 0, "id": 6269 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B94237E7-57AC-4347-9151-B08C6C32D1F7}\\Description" } ], "repeated": 0, "id": 6270 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "Microsoft\\Windows\\Templates" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B94237E7-57AC-4347-9151-B08C6C32D1F7}\\RelativePath" } ], "repeated": 0, "id": 6271 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B94237E7-57AC-4347-9151-B08C6C32D1F7}\\ParsingName" } ], "repeated": 0, "id": 6272 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B94237E7-57AC-4347-9151-B08C6C32D1F7}\\InfoTip" } ], "repeated": 0, "id": 6273 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B94237E7-57AC-4347-9151-B08C6C32D1F7}\\LocalizedName" } ], "repeated": 0, "id": 6274 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B94237E7-57AC-4347-9151-B08C6C32D1F7}\\Icon" } ], "repeated": 0, "id": 6275 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B94237E7-57AC-4347-9151-B08C6C32D1F7}\\Security" } ], "repeated": 0, "id": 6276 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B94237E7-57AC-4347-9151-B08C6C32D1F7}\\StreamResource" } ], "repeated": 0, "id": 6277 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B94237E7-57AC-4347-9151-B08C6C32D1F7}\\StreamResourceType" } ], "repeated": 0, "id": 6278 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B94237E7-57AC-4347-9151-B08C6C32D1F7}\\LocalRedirectOnly" } ], "repeated": 0, "id": 6279 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B94237E7-57AC-4347-9151-B08C6C32D1F7}\\Roamable" } ], "repeated": 0, "id": 6280 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B94237E7-57AC-4347-9151-B08C6C32D1F7}\\PreCreate" } ], "repeated": 0, "id": 6281 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B94237E7-57AC-4347-9151-B08C6C32D1F7}\\Stream" } ], "repeated": 0, "id": 6282 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B94237E7-57AC-4347-9151-B08C6C32D1F7}\\PublishExpandedPath" } ], "repeated": 0, "id": 6283 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B94237E7-57AC-4347-9151-B08C6C32D1F7}\\DefinitionFlags" } ], "repeated": 0, "id": 6284 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B94237E7-57AC-4347-9151-B08C6C32D1F7}\\Attributes" } ], "repeated": 0, "id": 6285 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B94237E7-57AC-4347-9151-B08C6C32D1F7}\\FolderTypeID" } ], "repeated": 0, "id": 6286 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B94237E7-57AC-4347-9151-B08C6C32D1F7}\\InitFolderHandler" } ], "repeated": 0, "id": 6287 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000398" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B94237E7-57AC-4347-9151-B08C6C32D1F7}\\PropertyBag" } ], "repeated": 0, "id": 6288 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" } ], "repeated": 0, "id": 6289 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x00000398" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 6290 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000398" }, { "name": "SubKey", "value": "{352481E8-33BE-4251-BA85-6007CAEDCF9D}" }, { "name": "Handle", "value": "0x00000318" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{352481E8-33BE-4251-BA85-6007CAEDCF9D}" } ], "repeated": 0, "id": 6291 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" } ], "repeated": 0, "id": 6292 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{352481E8-33BE-4251-BA85-6007CAEDCF9D}\\Category" } ], "repeated": 0, "id": 6293 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "Cache" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{352481E8-33BE-4251-BA85-6007CAEDCF9D}\\Name" } ], "repeated": 0, "id": 6294 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "Data", "value": "{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{352481E8-33BE-4251-BA85-6007CAEDCF9D}\\ParentFolder" } ], "repeated": 0, "id": 6295 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{352481E8-33BE-4251-BA85-6007CAEDCF9D}\\Description" } ], "repeated": 0, "id": 6296 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "Microsoft\\Windows\\INetCache" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{352481E8-33BE-4251-BA85-6007CAEDCF9D}\\RelativePath" } ], "repeated": 0, "id": 6297 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{352481E8-33BE-4251-BA85-6007CAEDCF9D}\\ParsingName" } ], "repeated": 0, "id": 6298 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{352481E8-33BE-4251-BA85-6007CAEDCF9D}\\InfoTip" } ], "repeated": 0, "id": 6299 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{352481E8-33BE-4251-BA85-6007CAEDCF9D}\\LocalizedName" } ], "repeated": 0, "id": 6300 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{352481E8-33BE-4251-BA85-6007CAEDCF9D}\\Icon" } ], "repeated": 0, "id": 6301 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{352481E8-33BE-4251-BA85-6007CAEDCF9D}\\Security" } ], "repeated": 0, "id": 6302 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{352481E8-33BE-4251-BA85-6007CAEDCF9D}\\StreamResource" } ], "repeated": 0, "id": 6303 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{352481E8-33BE-4251-BA85-6007CAEDCF9D}\\StreamResourceType" } ], "repeated": 0, "id": 6304 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{352481E8-33BE-4251-BA85-6007CAEDCF9D}\\LocalRedirectOnly" } ], "repeated": 0, "id": 6305 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{352481E8-33BE-4251-BA85-6007CAEDCF9D}\\Roamable" } ], "repeated": 0, "id": 6306 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{352481E8-33BE-4251-BA85-6007CAEDCF9D}\\PreCreate" } ], "repeated": 0, "id": 6307 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{352481E8-33BE-4251-BA85-6007CAEDCF9D}\\Stream" } ], "repeated": 0, "id": 6308 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{352481E8-33BE-4251-BA85-6007CAEDCF9D}\\PublishExpandedPath" } ], "repeated": 0, "id": 6309 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{352481E8-33BE-4251-BA85-6007CAEDCF9D}\\DefinitionFlags" } ], "repeated": 0, "id": 6310 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{352481E8-33BE-4251-BA85-6007CAEDCF9D}\\Attributes" } ], "repeated": 0, "id": 6311 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{352481E8-33BE-4251-BA85-6007CAEDCF9D}\\FolderTypeID" } ], "repeated": 0, "id": 6312 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{352481E8-33BE-4251-BA85-6007CAEDCF9D}\\InitFolderHandler" } ], "repeated": 0, "id": 6313 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000318" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{352481E8-33BE-4251-BA85-6007CAEDCF9D}\\PropertyBag" } ], "repeated": 0, "id": 6314 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" } ], "repeated": 0, "id": 6315 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1f5c0413000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6316 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x00000318" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 6317 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000318" }, { "name": "SubKey", "value": "{A63293E8-664E-48DB-A079-DF759E0509F7}" }, { "name": "Handle", "value": "0x000002e8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A63293E8-664E-48DB-A079-DF759E0509F7}" } ], "repeated": 0, "id": 6318 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" } ], "repeated": 0, "id": 6319 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A63293E8-664E-48DB-A079-DF759E0509F7}\\Category" } ], "repeated": 0, "id": 6320 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "Templates" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A63293E8-664E-48DB-A079-DF759E0509F7}\\Name" } ], "repeated": 0, "id": 6321 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "Data", "value": "{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A63293E8-664E-48DB-A079-DF759E0509F7}\\ParentFolder" } ], "repeated": 0, "id": 6322 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A63293E8-664E-48DB-A079-DF759E0509F7}\\Description" } ], "repeated": 0, "id": 6323 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "Microsoft\\Windows\\Templates" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A63293E8-664E-48DB-A079-DF759E0509F7}\\RelativePath" } ], "repeated": 0, "id": 6324 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A63293E8-664E-48DB-A079-DF759E0509F7}\\ParsingName" } ], "repeated": 0, "id": 6325 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A63293E8-664E-48DB-A079-DF759E0509F7}\\InfoTip" } ], "repeated": 0, "id": 6326 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A63293E8-664E-48DB-A079-DF759E0509F7}\\LocalizedName" } ], "repeated": 0, "id": 6327 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A63293E8-664E-48DB-A079-DF759E0509F7}\\Icon" } ], "repeated": 0, "id": 6328 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A63293E8-664E-48DB-A079-DF759E0509F7}\\Security" } ], "repeated": 0, "id": 6329 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A63293E8-664E-48DB-A079-DF759E0509F7}\\StreamResource" } ], "repeated": 0, "id": 6330 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A63293E8-664E-48DB-A079-DF759E0509F7}\\StreamResourceType" } ], "repeated": 0, "id": 6331 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A63293E8-664E-48DB-A079-DF759E0509F7}\\LocalRedirectOnly" } ], "repeated": 0, "id": 6332 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A63293E8-664E-48DB-A079-DF759E0509F7}\\Roamable" } ], "repeated": 0, "id": 6333 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A63293E8-664E-48DB-A079-DF759E0509F7}\\PreCreate" } ], "repeated": 0, "id": 6334 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A63293E8-664E-48DB-A079-DF759E0509F7}\\Stream" } ], "repeated": 0, "id": 6335 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A63293E8-664E-48DB-A079-DF759E0509F7}\\PublishExpandedPath" } ], "repeated": 0, "id": 6336 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A63293E8-664E-48DB-A079-DF759E0509F7}\\DefinitionFlags" } ], "repeated": 0, "id": 6337 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A63293E8-664E-48DB-A079-DF759E0509F7}\\Attributes" } ], "repeated": 0, "id": 6338 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A63293E8-664E-48DB-A079-DF759E0509F7}\\FolderTypeID" } ], "repeated": 0, "id": 6339 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A63293E8-664E-48DB-A079-DF759E0509F7}\\InitFolderHandler" } ], "repeated": 0, "id": 6340 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000002e8" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A63293E8-664E-48DB-A079-DF759E0509F7}\\PropertyBag" } ], "repeated": 0, "id": 6341 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 6342 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000002e8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 6343 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000002e8" }, { "name": "SubKey", "value": "{5CE4A5E9-E4EB-479D-B89F-130C02886155}" }, { "name": "Handle", "value": "0x00000318" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5CE4A5E9-E4EB-479D-B89F-130C02886155}" } ], "repeated": 0, "id": 6344 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 6345 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "3" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5CE4A5E9-E4EB-479D-B89F-130C02886155}\\Category" } ], "repeated": 0, "id": 6346 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "Device Metadata Store" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5CE4A5E9-E4EB-479D-B89F-130C02886155}\\Name" } ], "repeated": 0, "id": 6347 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "Data", "value": "{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5CE4A5E9-E4EB-479D-B89F-130C02886155}\\ParentFolder" } ], "repeated": 0, "id": 6348 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5CE4A5E9-E4EB-479D-B89F-130C02886155}\\Description" } ], "repeated": 0, "id": 6349 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "Microsoft\\Windows\\DeviceMetadataStore" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5CE4A5E9-E4EB-479D-B89F-130C02886155}\\RelativePath" } ], "repeated": 0, "id": 6350 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5CE4A5E9-E4EB-479D-B89F-130C02886155}\\ParsingName" } ], "repeated": 0, "id": 6351 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5CE4A5E9-E4EB-479D-B89F-130C02886155}\\InfoTip" } ], "repeated": 0, "id": 6352 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5CE4A5E9-E4EB-479D-B89F-130C02886155}\\LocalizedName" } ], "repeated": 0, "id": 6353 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5CE4A5E9-E4EB-479D-B89F-130C02886155}\\Icon" } ], "repeated": 0, "id": 6354 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5CE4A5E9-E4EB-479D-B89F-130C02886155}\\Security" } ], "repeated": 0, "id": 6355 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5CE4A5E9-E4EB-479D-B89F-130C02886155}\\StreamResource" } ], "repeated": 0, "id": 6356 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5CE4A5E9-E4EB-479D-B89F-130C02886155}\\StreamResourceType" } ], "repeated": 0, "id": 6357 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5CE4A5E9-E4EB-479D-B89F-130C02886155}\\LocalRedirectOnly" } ], "repeated": 0, "id": 6358 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5CE4A5E9-E4EB-479D-B89F-130C02886155}\\Roamable" } ], "repeated": 0, "id": 6359 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5CE4A5E9-E4EB-479D-B89F-130C02886155}\\PreCreate" } ], "repeated": 0, "id": 6360 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5CE4A5E9-E4EB-479D-B89F-130C02886155}\\Stream" } ], "repeated": 0, "id": 6361 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5CE4A5E9-E4EB-479D-B89F-130C02886155}\\PublishExpandedPath" } ], "repeated": 0, "id": 6362 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5CE4A5E9-E4EB-479D-B89F-130C02886155}\\DefinitionFlags" } ], "repeated": 0, "id": 6363 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5CE4A5E9-E4EB-479D-B89F-130C02886155}\\Attributes" } ], "repeated": 0, "id": 6364 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5CE4A5E9-E4EB-479D-B89F-130C02886155}\\FolderTypeID" } ], "repeated": 0, "id": 6365 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5CE4A5E9-E4EB-479D-B89F-130C02886155}\\InitFolderHandler" } ], "repeated": 0, "id": 6366 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000318" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5CE4A5E9-E4EB-479D-B89F-130C02886155}\\PropertyBag" } ], "repeated": 0, "id": 6367 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" } ], "repeated": 0, "id": 6368 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x00000318" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 6369 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000318" }, { "name": "SubKey", "value": "{82A74AEB-AEB4-465C-A014-D097EE346D63}" }, { "name": "Handle", "value": "0x000002e8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{82A74AEB-AEB4-465C-A014-D097EE346D63}" } ], "repeated": 0, "id": 6370 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" } ], "repeated": 0, "id": 6371 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{82A74AEB-AEB4-465C-A014-D097EE346D63}\\Category" } ], "repeated": 0, "id": 6372 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "ControlPanelFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{82A74AEB-AEB4-465C-A014-D097EE346D63}\\Name" } ], "repeated": 0, "id": 6373 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{82A74AEB-AEB4-465C-A014-D097EE346D63}\\ParentFolder" } ], "repeated": 0, "id": 6374 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{82A74AEB-AEB4-465C-A014-D097EE346D63}\\Description" } ], "repeated": 0, "id": 6375 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{82A74AEB-AEB4-465C-A014-D097EE346D63}\\RelativePath" } ], "repeated": 0, "id": 6376 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "Data", "value": "::{26EE0668-A00A-44D7-9371-BEB064C98683}\\0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{82A74AEB-AEB4-465C-A014-D097EE346D63}\\ParsingName" } ], "repeated": 0, "id": 6377 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{82A74AEB-AEB4-465C-A014-D097EE346D63}\\InfoTip" } ], "repeated": 0, "id": 6378 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{82A74AEB-AEB4-465C-A014-D097EE346D63}\\LocalizedName" } ], "repeated": 0, "id": 6379 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{82A74AEB-AEB4-465C-A014-D097EE346D63}\\Icon" } ], "repeated": 0, "id": 6380 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{82A74AEB-AEB4-465C-A014-D097EE346D63}\\Security" } ], "repeated": 0, "id": 6381 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{82A74AEB-AEB4-465C-A014-D097EE346D63}\\StreamResource" } ], "repeated": 0, "id": 6382 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{82A74AEB-AEB4-465C-A014-D097EE346D63}\\StreamResourceType" } ], "repeated": 0, "id": 6383 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{82A74AEB-AEB4-465C-A014-D097EE346D63}\\LocalRedirectOnly" } ], "repeated": 0, "id": 6384 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{82A74AEB-AEB4-465C-A014-D097EE346D63}\\Roamable" } ], "repeated": 0, "id": 6385 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{82A74AEB-AEB4-465C-A014-D097EE346D63}\\PreCreate" } ], "repeated": 0, "id": 6386 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{82A74AEB-AEB4-465C-A014-D097EE346D63}\\Stream" } ], "repeated": 0, "id": 6387 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{82A74AEB-AEB4-465C-A014-D097EE346D63}\\PublishExpandedPath" } ], "repeated": 0, "id": 6388 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{82A74AEB-AEB4-465C-A014-D097EE346D63}\\DefinitionFlags" } ], "repeated": 0, "id": 6389 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{82A74AEB-AEB4-465C-A014-D097EE346D63}\\Attributes" } ], "repeated": 0, "id": 6390 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{82A74AEB-AEB4-465C-A014-D097EE346D63}\\FolderTypeID" } ], "repeated": 0, "id": 6391 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{82A74AEB-AEB4-465C-A014-D097EE346D63}\\InitFolderHandler" } ], "repeated": 0, "id": 6392 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000002e8" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{82A74AEB-AEB4-465C-A014-D097EE346D63}\\PropertyBag" } ], "repeated": 0, "id": 6393 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 6394 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000002e8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 6395 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000002e8" }, { "name": "SubKey", "value": "{43668BF8-C14E-49B2-97C9-747784D784B7}" }, { "name": "Handle", "value": "0x00000318" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{43668BF8-C14E-49B2-97C9-747784D784B7}" } ], "repeated": 0, "id": 6396 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 6397 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{43668BF8-C14E-49B2-97C9-747784D784B7}\\Category" } ], "repeated": 0, "id": 6398 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "SyncCenterFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{43668BF8-C14E-49B2-97C9-747784D784B7}\\Name" } ], "repeated": 0, "id": 6399 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{43668BF8-C14E-49B2-97C9-747784D784B7}\\ParentFolder" } ], "repeated": 0, "id": 6400 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{43668BF8-C14E-49B2-97C9-747784D784B7}\\Description" } ], "repeated": 0, "id": 6401 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{43668BF8-C14E-49B2-97C9-747784D784B7}\\RelativePath" } ], "repeated": 0, "id": 6402 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "Data", "value": "::{26EE0668-A00A-44D7-9371-BEB064C98683}\\0\\::{9C73F5E5-7AE7-4E32-A8E8-8D23B85255BF}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{43668BF8-C14E-49B2-97C9-747784D784B7}\\ParsingName" } ], "repeated": 0, "id": 6403 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{43668BF8-C14E-49B2-97C9-747784D784B7}\\InfoTip" } ], "repeated": 0, "id": 6404 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{43668BF8-C14E-49B2-97C9-747784D784B7}\\LocalizedName" } ], "repeated": 0, "id": 6405 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{43668BF8-C14E-49B2-97C9-747784D784B7}\\Icon" } ], "repeated": 0, "id": 6406 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{43668BF8-C14E-49B2-97C9-747784D784B7}\\Security" } ], "repeated": 0, "id": 6407 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{43668BF8-C14E-49B2-97C9-747784D784B7}\\StreamResource" } ], "repeated": 0, "id": 6408 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{43668BF8-C14E-49B2-97C9-747784D784B7}\\StreamResourceType" } ], "repeated": 0, "id": 6409 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{43668BF8-C14E-49B2-97C9-747784D784B7}\\LocalRedirectOnly" } ], "repeated": 0, "id": 6410 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{43668BF8-C14E-49B2-97C9-747784D784B7}\\Roamable" } ], "repeated": 0, "id": 6411 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{43668BF8-C14E-49B2-97C9-747784D784B7}\\PreCreate" } ], "repeated": 0, "id": 6412 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{43668BF8-C14E-49B2-97C9-747784D784B7}\\Stream" } ], "repeated": 0, "id": 6413 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{43668BF8-C14E-49B2-97C9-747784D784B7}\\PublishExpandedPath" } ], "repeated": 0, "id": 6414 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{43668BF8-C14E-49B2-97C9-747784D784B7}\\DefinitionFlags" } ], "repeated": 0, "id": 6415 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{43668BF8-C14E-49B2-97C9-747784D784B7}\\Attributes" } ], "repeated": 0, "id": 6416 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{43668BF8-C14E-49B2-97C9-747784D784B7}\\FolderTypeID" } ], "repeated": 0, "id": 6417 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{43668BF8-C14E-49B2-97C9-747784D784B7}\\InitFolderHandler" } ], "repeated": 0, "id": 6418 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000318" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{43668BF8-C14E-49B2-97C9-747784D784B7}\\PropertyBag" } ], "repeated": 0, "id": 6419 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" } ], "repeated": 0, "id": 6420 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1f5c0415000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6421 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x00000318" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 6422 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000318" }, { "name": "SubKey", "value": "{915221FB-9EFE-4BDA-8FD7-F78DCA774F87}" }, { "name": "Handle", "value": "0x00000398" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{915221FB-9EFE-4BDA-8FD7-F78DCA774F87}" } ], "repeated": 0, "id": 6423 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" } ], "repeated": 0, "id": 6424 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{915221FB-9EFE-4bda-8FD7-F78DCA774F87}\\Category" } ], "repeated": 0, "id": 6425 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "CredentialManager" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{915221FB-9EFE-4bda-8FD7-F78DCA774F87}\\Name" } ], "repeated": 0, "id": 6426 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{915221FB-9EFE-4bda-8FD7-F78DCA774F87}\\ParentFolder" } ], "repeated": 0, "id": 6427 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{915221FB-9EFE-4bda-8FD7-F78DCA774F87}\\Description" } ], "repeated": 0, "id": 6428 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{915221FB-9EFE-4bda-8FD7-F78DCA774F87}\\RelativePath" } ], "repeated": 0, "id": 6429 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{915221FB-9EFE-4bda-8FD7-F78DCA774F87}\\ParsingName" } ], "repeated": 0, "id": 6430 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{915221FB-9EFE-4bda-8FD7-F78DCA774F87}\\InfoTip" } ], "repeated": 0, "id": 6431 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{915221FB-9EFE-4bda-8FD7-F78DCA774F87}\\LocalizedName" } ], "repeated": 0, "id": 6432 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{915221FB-9EFE-4bda-8FD7-F78DCA774F87}\\Icon" } ], "repeated": 0, "id": 6433 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{915221FB-9EFE-4bda-8FD7-F78DCA774F87}\\Security" } ], "repeated": 0, "id": 6434 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{915221FB-9EFE-4bda-8FD7-F78DCA774F87}\\StreamResource" } ], "repeated": 0, "id": 6435 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{915221FB-9EFE-4bda-8FD7-F78DCA774F87}\\StreamResourceType" } ], "repeated": 0, "id": 6436 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{915221FB-9EFE-4bda-8FD7-F78DCA774F87}\\LocalRedirectOnly" } ], "repeated": 0, "id": 6437 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{915221FB-9EFE-4bda-8FD7-F78DCA774F87}\\Roamable" } ], "repeated": 0, "id": 6438 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{915221FB-9EFE-4bda-8FD7-F78DCA774F87}\\PreCreate" } ], "repeated": 0, "id": 6439 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{915221FB-9EFE-4bda-8FD7-F78DCA774F87}\\Stream" } ], "repeated": 0, "id": 6440 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{915221FB-9EFE-4bda-8FD7-F78DCA774F87}\\PublishExpandedPath" } ], "repeated": 0, "id": 6441 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{915221FB-9EFE-4bda-8FD7-F78DCA774F87}\\DefinitionFlags" } ], "repeated": 0, "id": 6442 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{915221FB-9EFE-4bda-8FD7-F78DCA774F87}\\Attributes" } ], "repeated": 0, "id": 6443 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{915221FB-9EFE-4bda-8FD7-F78DCA774F87}\\FolderTypeID" } ], "repeated": 0, "id": 6444 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{915221FB-9EFE-4bda-8FD7-F78DCA774F87}\\InitFolderHandler" } ], "repeated": 0, "id": 6445 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000398" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{915221FB-9EFE-4bda-8FD7-F78DCA774F87}\\PropertyBag" } ], "repeated": 0, "id": 6446 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" } ], "repeated": 0, "id": 6447 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x00000398" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 6448 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000398" }, { "name": "SubKey", "value": "{7E636BFE-DFA9-4D5E-B456-D7B39851D8A9}" }, { "name": "Handle", "value": "0x000002e8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7E636BFE-DFA9-4D5E-B456-D7B39851D8A9}" } ], "repeated": 0, "id": 6449 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" } ], "repeated": 0, "id": 6450 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7E636BFE-DFA9-4D5E-B456-D7B39851D8A9}\\Category" } ], "repeated": 0, "id": 6451 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "SearchTemplatesFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7E636BFE-DFA9-4D5E-B456-D7B39851D8A9}\\Name" } ], "repeated": 0, "id": 6452 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "Data", "value": "{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7E636BFE-DFA9-4D5E-B456-D7B39851D8A9}\\ParentFolder" } ], "repeated": 0, "id": 6453 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7E636BFE-DFA9-4D5E-B456-D7B39851D8A9}\\Description" } ], "repeated": 0, "id": 6454 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "Microsoft\\Windows\\ConnectedSearch\\Templates" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7E636BFE-DFA9-4D5E-B456-D7B39851D8A9}\\RelativePath" } ], "repeated": 0, "id": 6455 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7E636BFE-DFA9-4D5E-B456-D7B39851D8A9}\\ParsingName" } ], "repeated": 0, "id": 6456 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7E636BFE-DFA9-4D5E-B456-D7B39851D8A9}\\InfoTip" } ], "repeated": 0, "id": 6457 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7E636BFE-DFA9-4D5E-B456-D7B39851D8A9}\\LocalizedName" } ], "repeated": 0, "id": 6458 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7E636BFE-DFA9-4D5E-B456-D7B39851D8A9}\\Icon" } ], "repeated": 0, "id": 6459 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7E636BFE-DFA9-4D5E-B456-D7B39851D8A9}\\Security" } ], "repeated": 0, "id": 6460 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7E636BFE-DFA9-4D5E-B456-D7B39851D8A9}\\StreamResource" } ], "repeated": 0, "id": 6461 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7E636BFE-DFA9-4D5E-B456-D7B39851D8A9}\\StreamResourceType" } ], "repeated": 0, "id": 6462 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7E636BFE-DFA9-4D5E-B456-D7B39851D8A9}\\LocalRedirectOnly" } ], "repeated": 0, "id": 6463 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7E636BFE-DFA9-4D5E-B456-D7B39851D8A9}\\Roamable" } ], "repeated": 0, "id": 6464 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7E636BFE-DFA9-4D5E-B456-D7B39851D8A9}\\PreCreate" } ], "repeated": 0, "id": 6465 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7E636BFE-DFA9-4D5E-B456-D7B39851D8A9}\\Stream" } ], "repeated": 0, "id": 6466 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7E636BFE-DFA9-4D5E-B456-D7B39851D8A9}\\PublishExpandedPath" } ], "repeated": 0, "id": 6467 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7E636BFE-DFA9-4D5E-B456-D7B39851D8A9}\\DefinitionFlags" } ], "repeated": 0, "id": 6468 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7E636BFE-DFA9-4D5E-B456-D7B39851D8A9}\\Attributes" } ], "repeated": 0, "id": 6469 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7E636BFE-DFA9-4D5E-B456-D7B39851D8A9}\\FolderTypeID" } ], "repeated": 0, "id": 6470 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7E636BFE-DFA9-4D5E-B456-D7B39851D8A9}\\InitFolderHandler" } ], "repeated": 0, "id": 6471 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000002e8" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{7E636BFE-DFA9-4D5E-B456-D7B39851D8A9}\\PropertyBag" } ], "repeated": 0, "id": 6472 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 6473 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000002e8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 6474 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000002e8" }, { "name": "SubKey", "value": "{4C5C32FF-BB9D-43B0-B5B4-2D72E54EAAA4}" }, { "name": "Handle", "value": "0x00000398" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4C5C32FF-BB9D-43B0-B5B4-2D72E54EAAA4}" } ], "repeated": 0, "id": 6475 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 6476 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4C5C32FF-BB9D-43b0-B5B4-2D72E54EAAA4}\\Category" } ], "repeated": 0, "id": 6477 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "SavedGames" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4C5C32FF-BB9D-43b0-B5B4-2D72E54EAAA4}\\Name" } ], "repeated": 0, "id": 6478 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4C5C32FF-BB9D-43b0-B5B4-2D72E54EAAA4}\\ParentFolder" } ], "repeated": 0, "id": 6479 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4C5C32FF-BB9D-43b0-B5B4-2D72E54EAAA4}\\Description" } ], "repeated": 0, "id": 6480 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "Saved Games" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4C5C32FF-BB9D-43b0-B5B4-2D72E54EAAA4}\\RelativePath" } ], "repeated": 0, "id": 6481 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "Data", "value": "::{59031a47-3f72-44a7-89c5-5595fe6b30ee}\\{4C5C32FF-BB9D-43b0-B5B4-2D72E54EAAA4}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4C5C32FF-BB9D-43b0-B5B4-2D72E54EAAA4}\\ParsingName" } ], "repeated": 0, "id": 6482 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4C5C32FF-BB9D-43b0-B5B4-2D72E54EAAA4}\\InfoTip" } ], "repeated": 0, "id": 6483 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "Data", "value": "@%SystemRoot%\\system32\\shell32.dll,-21814" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4C5C32FF-BB9D-43b0-B5B4-2D72E54EAAA4}\\LocalizedName" } ], "repeated": 0, "id": 6484 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "Icon" }, { "name": "Data", "value": "%SystemRoot%\\system32\\imageres.dll,-186" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4C5C32FF-BB9D-43b0-B5B4-2D72E54EAAA4}\\Icon" } ], "repeated": 0, "id": 6485 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4C5C32FF-BB9D-43b0-B5B4-2D72E54EAAA4}\\Security" } ], "repeated": 0, "id": 6486 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4C5C32FF-BB9D-43b0-B5B4-2D72E54EAAA4}\\StreamResource" } ], "repeated": 0, "id": 6487 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4C5C32FF-BB9D-43b0-B5B4-2D72E54EAAA4}\\StreamResourceType" } ], "repeated": 0, "id": 6488 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4C5C32FF-BB9D-43b0-B5B4-2D72E54EAAA4}\\LocalRedirectOnly" } ], "repeated": 0, "id": 6489 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "Roamable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4C5C32FF-BB9D-43b0-B5B4-2D72E54EAAA4}\\Roamable" } ], "repeated": 0, "id": 6490 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4C5C32FF-BB9D-43b0-B5B4-2D72E54EAAA4}\\PreCreate" } ], "repeated": 0, "id": 6491 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4C5C32FF-BB9D-43b0-B5B4-2D72E54EAAA4}\\Stream" } ], "repeated": 0, "id": 6492 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4C5C32FF-BB9D-43b0-B5B4-2D72E54EAAA4}\\PublishExpandedPath" } ], "repeated": 0, "id": 6493 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4C5C32FF-BB9D-43b0-B5B4-2D72E54EAAA4}\\DefinitionFlags" } ], "repeated": 0, "id": 6494 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "Attributes" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4C5C32FF-BB9D-43b0-B5B4-2D72E54EAAA4}\\Attributes" } ], "repeated": 0, "id": 6495 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4C5C32FF-BB9D-43b0-B5B4-2D72E54EAAA4}\\FolderTypeID" } ], "repeated": 0, "id": 6496 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4C5C32FF-BB9D-43b0-B5B4-2D72E54EAAA4}\\InitFolderHandler" } ], "repeated": 0, "id": 6497 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000398" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{4C5C32FF-BB9D-43b0-B5B4-2D72E54EAAA4}\\PropertyBag" } ], "repeated": 0, "id": 6498 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" } ], "repeated": 0, "id": 6499 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WCOSEnumerationBaselineAllowedlist" } ], "repeated": 0, "id": 6500 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 6501 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AllowedEnumeration" } ], "repeated": 0, "id": 6502 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000398" } ], "repeated": 0, "id": 6503 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 6504 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "`\\xa7\\xec\\x11l\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 6505 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000002e4" }, { "name": "SubKey", "value": "SessionInfo\\1" }, { "name": "Handle", "value": "0x000002e8" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1" } ], "repeated": 0, "id": 6506 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000002e8" }, { "name": "SubKey", "value": "KnownFolders" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1\\KnownFolders" } ], "repeated": 0, "id": 6507 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 6508 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xa3\\xec\\x11l\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x80\\xe8\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 6509 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002e8" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 6510 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000002e8" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" }, { "name": "Handle", "value": "0x000003d8" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" } ], "repeated": 0, "id": 6511 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 6512 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d8" }, { "name": "ValueName", "value": "{4C5C32FF-BB9D-43B0-B5B4-2D72E54EAAA4}" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\{4C5C32FF-BB9D-43B0-B5B4-2D72E54EAAA4}" } ], "repeated": 0, "id": 6513 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000002e8" } ], "repeated": 0, "id": 6514 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xf0\\xe4?\\xc0\\xf5\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 6515 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "Handle", "value": "0x000003dc" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 6516 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "ProfileImagePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath" } ], "repeated": 0, "id": 6517 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003dc" }, { "name": "ValueName", "value": "ProfileImagePath" }, { "name": "Data", "value": "C:\\Users\\admin" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath" } ], "repeated": 0, "id": 6518 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003dc" } ], "repeated": 0, "id": 6519 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 6520 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" } ], "repeated": 0, "id": 6521 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d8" } ], "repeated": 0, "id": 6522 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x10\\x12l\\x00\\x00\\x00\\xfc+\\x00\\x00\\x00\\x00\\x00\\x00\\xe0%\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "9696" } ], "repeated": 0, "id": 6523 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "ReadProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6c12102281" }, { "name": "Size", "value": "0x00000001" }, { "name": "Buffer", "value": "\\x00" } ], "repeated": 0, "id": 6524 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6c12102281" }, { "name": "Buffer", "value": "\\x01" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6525 }, { "timestamp": "2026-05-29 01:05:17,821", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000003d8" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Searches\\desktop.ini" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6526 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000003d8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\Searches\\desktop.ini" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x10\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 6527 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000003d8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\Searches\\desktop.ini" }, { "name": "Buffer", "value": "\\xff\\xfe\r\\x00\n\\x00[\\x00.\\x00S\\x00h\\x00e\\x00l\\x00l\\x00C\\x00l\\x00a\\x00s\\x00s\\x00I\\x00n\\x00f\\x00o\\x00]\\x00\r\\x00\n\\x00L\\x00o\\x00c\\x00a\\x00l\\x00i\\x00z\\x00e\\x00d\\x00R\\x00e\\x00s\\x00o\\x00u\\x00r\\x00c\\x00e\\x00N\\x00a\\x00m\\x00e\\x00=\\x00@\\x00%\\x00S\\x00y\\x00s\\x00t\\x00e\\x00m\\x00R\\x00o\\x00o\\x00t\\x00%\\x00\\\\x00s\\x00y\\x00s\\x00t\\x00e\\x00m\\x003\\x002\\x00\\\\x00s\\x00h\\x00e\\x00l\\x00l\\x003\\x002\\x00.\\x00d\\x00l\\x00l\\x00,\\x00-\\x009\\x000\\x003\\x001\\x00\r\\x00\n\\x00I\\x00c\\x00o\\x00n\\x00R\\x00e\\x00s\\x00o\\x00u\\x00r\\x00c\\x00e\\x00=\\x00%\\x00S\\x00y\\x00s\\x00t\\x00e\\x00m\\x00R\\x00o\\x00o\\x00t\\x00%\\x00\\\\x00s\\x00y\\x00s\\x00t\\x00e\\x00m\\x003\\x002\\x00\\\\x00i\\x00m\\x00a\\x00g\\x00e\\x00r\\x00e\\x00" }, { "name": "Length", "value": "524" } ], "repeated": 0, "id": 6528 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000003d8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\Searches\\desktop.ini" }, { "name": "FileInformationClass", "value": "4", "pretty_value": "FileBasicInformation" }, { "name": "FileInformation", "value": "\\x97\\xc5\\xef\\xaf\\xb6\\xee\\xdc\\x01\\x81\\x9d\\xd96\\x07\\xef\\xdc\\x01\\xee\\xed\\xf6\\xaf\\xb6\\xee\\xdc\\x01\\xee\\xed\\xf6\\xaf\\xb6\\xee\\xdc\\x01\\x06\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 6529 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d8" } ], "repeated": 0, "id": 6530 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 6531 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x10\\x12l\\x00\\x00\\x00\\xfc+\\x00\\x00\\x00\\x00\\x00\\x00\\xe0%\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "9696" } ], "repeated": 0, "id": 6532 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "ReadProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6c12102281" }, { "name": "Size", "value": "0x00000001" }, { "name": "Buffer", "value": "\\x01" } ], "repeated": 0, "id": 6533 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6c12102281" }, { "name": "Buffer", "value": "\\x00" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6534 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 6535 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x10\\x12l\\x00\\x00\\x00\\xfc+\\x00\\x00\\x00\\x00\\x00\\x00\\xe0%\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "9696" } ], "repeated": 0, "id": 6536 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "ReadProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6c12102281" }, { "name": "Size", "value": "0x00000001" }, { "name": "Buffer", "value": "\\x00" } ], "repeated": 0, "id": 6537 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6c12102281" }, { "name": "Buffer", "value": "\\x01" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6538 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000003d8" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Contacts\\desktop.ini" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6539 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000003d8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\Contacts\\desktop.ini" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\xa0\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x9c\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 6540 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000003d8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\Contacts\\desktop.ini" }, { "name": "Buffer", "value": "\\xff\\xfe\r\\x00\n\\x00[\\x00.\\x00S\\x00h\\x00e\\x00l\\x00l\\x00C\\x00l\\x00a\\x00s\\x00s\\x00I\\x00n\\x00f\\x00o\\x00]\\x00\r\\x00\n\\x00L\\x00o\\x00c\\x00a\\x00l\\x00i\\x00z\\x00e\\x00d\\x00R\\x00e\\x00s\\x00o\\x00u\\x00r\\x00c\\x00e\\x00N\\x00a\\x00m\\x00e\\x00=\\x00@\\x00%\\x00C\\x00o\\x00m\\x00m\\x00o\\x00n\\x00P\\x00r\\x00o\\x00g\\x00r\\x00a\\x00m\\x00F\\x00i\\x00l\\x00e\\x00s\\x00%\\x00\\\\x00s\\x00y\\x00s\\x00t\\x00e\\x00m\\x00\\\\x00w\\x00a\\x00b\\x003\\x002\\x00r\\x00e\\x00s\\x00.\\x00d\\x00l\\x00l\\x00,\\x00-\\x001\\x000\\x001\\x000\\x000\\x00\r\\x00\n\\x00I\\x00n\\x00f\\x00o\\x00T\\x00i\\x00p\\x00=\\x00@\\x00%\\x00C\\x00o\\x00m\\x00m\\x00o\\x00n\\x00P\\x00r\\x00o\\x00g\\x00r\\x00a\\x00m\\x00F\\x00i\\x00l\\x00e\\x00s\\x00%\\x00\\\\x00s\\x00y\\x00s\\x00t\\x00" }, { "name": "Length", "value": "412" } ], "repeated": 0, "id": 6541 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000003d8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\Contacts\\desktop.ini" }, { "name": "FileInformationClass", "value": "4", "pretty_value": "FileBasicInformation" }, { "name": "FileInformation", "value": "\\xd2\\xfe\\xea\\xaf\\xb6\\xee\\xdc\\x01\\xe9\\xc5\\xd96\\x07\\xef\\xdc\\x01\\xd2\\xfe\\xea\\xaf\\xb6\\xee\\xdc\\x01\\xd2\\xfe\\xea\\xaf\\xb6\\xee\\xdc\\x01&\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 6542 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d8" } ], "repeated": 0, "id": 6543 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 6544 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x10\\x12l\\x00\\x00\\x00\\xfc+\\x00\\x00\\x00\\x00\\x00\\x00\\xe0%\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "9696" } ], "repeated": 0, "id": 6545 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "ReadProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6c12102281" }, { "name": "Size", "value": "0x00000001" }, { "name": "Buffer", "value": "\\x01" } ], "repeated": 0, "id": 6546 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6c12102281" }, { "name": "Buffer", "value": "\\x00" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6547 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 6548 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x10\\x12l\\x00\\x00\\x00\\xfc+\\x00\\x00\\x00\\x00\\x00\\x00\\xe0%\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "9696" } ], "repeated": 0, "id": 6549 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "ReadProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6c12102281" }, { "name": "Size", "value": "0x00000001" }, { "name": "Buffer", "value": "\\x00" } ], "repeated": 0, "id": 6550 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6c12102281" }, { "name": "Buffer", "value": "\\x01" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6551 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000003d8" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Favorites\\desktop.ini" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6552 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000003d8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\Favorites\\desktop.ini" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x98\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x92\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 6553 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000003d8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\Favorites\\desktop.ini" }, { "name": "Buffer", "value": "\\xff\\xfe\r\\x00\n\\x00[\\x00.\\x00S\\x00h\\x00e\\x00l\\x00l\\x00C\\x00l\\x00a\\x00s\\x00s\\x00I\\x00n\\x00f\\x00o\\x00]\\x00\r\\x00\n\\x00L\\x00o\\x00c\\x00a\\x00l\\x00i\\x00z\\x00e\\x00d\\x00R\\x00e\\x00s\\x00o\\x00u\\x00r\\x00c\\x00e\\x00N\\x00a\\x00m\\x00e\\x00=\\x00@\\x00%\\x00S\\x00y\\x00s\\x00t\\x00e\\x00m\\x00R\\x00o\\x00o\\x00t\\x00%\\x00\\\\x00s\\x00y\\x00s\\x00t\\x00e\\x00m\\x003\\x002\\x00\\\\x00s\\x00h\\x00e\\x00l\\x00l\\x003\\x002\\x00.\\x00d\\x00l\\x00l\\x00,\\x00-\\x002\\x001\\x007\\x009\\x006\\x00\r\\x00\n\\x00I\\x00c\\x00o\\x00n\\x00R\\x00e\\x00s\\x00o\\x00u\\x00r\\x00c\\x00e\\x00=\\x00%\\x00S\\x00y\\x00s\\x00t\\x00e\\x00m\\x00R\\x00o\\x00o\\x00t\\x00%\\x00\\\\x00s\\x00y\\x00s\\x00t\\x00e\\x00m\\x003\\x002\\x00\\\\x00i\\x00m\\x00a\\x00g\\x00e\\x00r\\x00" }, { "name": "Length", "value": "402" } ], "repeated": 0, "id": 6554 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000003d8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\Favorites\\desktop.ini" }, { "name": "FileInformationClass", "value": "4", "pretty_value": "FileBasicInformation" }, { "name": "FileInformation", "value": "\\xd2\\xfe\\xea\\xaf\\xb6\\xee\\xdc\\x01\\xe8\\xd9\\xd96\\x07\\xef\\xdc\\x01\\xd2\\xfe\\xea\\xaf\\xb6\\xee\\xdc\\x01lM\\xe8\\xb2\\xb6\\xee\\xdc\\x01&\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 6555 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d8" } ], "repeated": 0, "id": 6556 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 6557 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x10\\x12l\\x00\\x00\\x00\\xfc+\\x00\\x00\\x00\\x00\\x00\\x00\\xe0%\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "9696" } ], "repeated": 0, "id": 6558 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "ReadProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6c12102281" }, { "name": "Size", "value": "0x00000001" }, { "name": "Buffer", "value": "\\x01" } ], "repeated": 0, "id": 6559 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6c12102281" }, { "name": "Buffer", "value": "\\x00" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6560 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 6561 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1f5c0418000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6562 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 6563 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1f5c0419000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6564 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 6565 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x10\\x12l\\x00\\x00\\x00\\xfc+\\x00\\x00\\x00\\x00\\x00\\x00\\xe0%\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "9696" } ], "repeated": 0, "id": 6566 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "ReadProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6c12102281" }, { "name": "Size", "value": "0x00000001" }, { "name": "Buffer", "value": "\\x00" } ], "repeated": 0, "id": 6567 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6c12102281" }, { "name": "Buffer", "value": "\\x01" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6568 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000003d8" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Links\\desktop.ini" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6569 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000003d8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\Links\\desktop.ini" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\xf8\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 6570 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000003d8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\Links\\desktop.ini" }, { "name": "Buffer", "value": "\\xff\\xfe\r\\x00\n\\x00[\\x00.\\x00S\\x00h\\x00e\\x00l\\x00l\\x00C\\x00l\\x00a\\x00s\\x00s\\x00I\\x00n\\x00f\\x00o\\x00]\\x00\r\\x00\n\\x00L\\x00o\\x00c\\x00a\\x00l\\x00i\\x00z\\x00e\\x00d\\x00R\\x00e\\x00s\\x00o\\x00u\\x00r\\x00c\\x00e\\x00N\\x00a\\x00m\\x00e\\x00=\\x00@\\x00%\\x00S\\x00y\\x00s\\x00t\\x00e\\x00m\\x00R\\x00o\\x00o\\x00t\\x00%\\x00\\\\x00s\\x00y\\x00s\\x00t\\x00e\\x00m\\x003\\x002\\x00\\\\x00s\\x00h\\x00e\\x00l\\x00l\\x003\\x002\\x00.\\x00d\\x00l\\x00l\\x00,\\x00-\\x002\\x001\\x008\\x001\\x000\\x00\r\\x00\n\\x00I\\x00c\\x00o\\x00n\\x00R\\x00e\\x00s\\x00o\\x00u\\x00r\\x00c\\x00e\\x00=\\x00%\\x00S\\x00y\\x00s\\x00t\\x00e\\x00m\\x00R\\x00o\\x00o\\x00t\\x00%\\x00\\\\x00s\\x00y\\x00s\\x00t\\x00e\\x00m\\x003\\x002\\x00\\\\x00i\\x00m\\x00a\\x00g\\x00e\\x00r\\x00" }, { "name": "Length", "value": "504" } ], "repeated": 0, "id": 6571 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000003d8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\Links\\desktop.ini" }, { "name": "FileInformationClass", "value": "4", "pretty_value": "FileBasicInformation" }, { "name": "FileInformation", "value": "\\x1e\\x8b\\xf4\\xaf\\xb6\\xee\\xdc\\x01\\xf1)\\xda6\\x07\\xef\\xdc\\x01\\xeaP\\xf9\\xaf\\xb6\\xee\\xdc\\x01\\xeaP\\xf9\\xaf\\xb6\\xee\\xdc\\x01\\x06\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 6572 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d8" } ], "repeated": 0, "id": 6573 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 6574 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x10\\x12l\\x00\\x00\\x00\\xfc+\\x00\\x00\\x00\\x00\\x00\\x00\\xe0%\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "9696" } ], "repeated": 0, "id": 6575 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "ReadProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6c12102281" }, { "name": "Size", "value": "0x00000001" }, { "name": "Buffer", "value": "\\x01" } ], "repeated": 0, "id": 6576 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6c12102281" }, { "name": "Buffer", "value": "\\x00" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6577 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 6578 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x10\\x12l\\x00\\x00\\x00\\xfc+\\x00\\x00\\x00\\x00\\x00\\x00\\xe0%\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "9696" } ], "repeated": 0, "id": 6579 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "ReadProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6c12102281" }, { "name": "Size", "value": "0x00000001" }, { "name": "Buffer", "value": "\\x00" } ], "repeated": 0, "id": 6580 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6c12102281" }, { "name": "Buffer", "value": "\\x01" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6581 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000003d8" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Saved Games\\desktop.ini" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6582 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000003d8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\Saved Games\\desktop.ini" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": " \\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x1a\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 6583 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000003d8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\Saved Games\\desktop.ini" }, { "name": "Buffer", "value": "\\xff\\xfe\r\\x00\n\\x00[\\x00.\\x00S\\x00h\\x00e\\x00l\\x00l\\x00C\\x00l\\x00a\\x00s\\x00s\\x00I\\x00n\\x00f\\x00o\\x00]\\x00\r\\x00\n\\x00L\\x00o\\x00c\\x00a\\x00l\\x00i\\x00z\\x00e\\x00d\\x00R\\x00e\\x00s\\x00o\\x00u\\x00r\\x00c\\x00e\\x00N\\x00a\\x00m\\x00e\\x00=\\x00@\\x00%\\x00S\\x00y\\x00s\\x00t\\x00e\\x00m\\x00R\\x00o\\x00o\\x00t\\x00%\\x00\\\\x00s\\x00y\\x00s\\x00t\\x00e\\x00m\\x003\\x002\\x00\\\\x00s\\x00h\\x00e\\x00l\\x00l\\x003\\x002\\x00.\\x00d\\x00l\\x00l\\x00,\\x00-\\x002\\x001\\x008\\x001\\x004\\x00\r\\x00\n\\x00I\\x00c\\x00o\\x00n\\x00R\\x00e\\x00s\\x00o\\x00u\\x00r\\x00c\\x00e\\x00=\\x00%\\x00S\\x00y\\x00s\\x00t\\x00e\\x00m\\x00R\\x00o\\x00o\\x00t\\x00%\\x00\\\\x00s\\x00y\\x00s\\x00t\\x00e\\x00m\\x003\\x002\\x00\\\\x00i\\x00m\\x00a\\x00g\\x00e\\x00r\\x00" }, { "name": "Length", "value": "282" } ], "repeated": 0, "id": 6584 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000003d8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\Saved Games\\desktop.ini" }, { "name": "FileInformationClass", "value": "4", "pretty_value": "FileBasicInformation" }, { "name": "FileInformation", "value": "\\x1e\\x8b\\xf4\\xaf\\xb6\\xee\\xdc\\x01\\xbaP\\xda6\\x07\\xef\\xdc\\x01\\xee\\xed\\xf6\\xaf\\xb6\\xee\\xdc\\x01\\xee\\xed\\xf6\\xaf\\xb6\\xee\\xdc\\x01&\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 6585 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d8" } ], "repeated": 0, "id": 6586 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 6587 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x10\\x12l\\x00\\x00\\x00\\xfc+\\x00\\x00\\x00\\x00\\x00\\x00\\xe0%\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "9696" } ], "repeated": 0, "id": 6588 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "ReadProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6c12102281" }, { "name": "Size", "value": "0x00000001" }, { "name": "Buffer", "value": "\\x01" } ], "repeated": 0, "id": 6589 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6c12102281" }, { "name": "Buffer", "value": "\\x00" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6590 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 6591 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UsersFiles\\NameSpace" }, { "name": "Handle", "value": "0x000003d8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UsersFiles\\NameSpace" } ], "repeated": 0, "id": 6592 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d8" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "DelegateFolders" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UsersFiles\\NameSpace\\DelegateFolders" } ], "repeated": 0, "id": 6593 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000266" }, { "name": "SubKey", "value": "DelegateFolders" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\DelegateFolders" } ], "repeated": 3, "id": 6594 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": false, "return": "0x00000103", "pretty_return": "NO_MORE_ITEMS", "arguments": [ { "name": "Handle", "value": "0x000003d8" }, { "name": "Index", "value": "1" }, { "name": "Name", "value": "" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UsersFiles\\NameSpace\\" } ], "repeated": 0, "id": 6595 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d8" } ], "repeated": 0, "id": 6596 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UsersFiles\\NameSpace" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UsersFiles\\NameSpace" } ], "repeated": 0, "id": 6597 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UsersFiles\\NameSpace\\DelegateFolders" }, { "name": "Handle", "value": "0x000003d8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UsersFiles\\NameSpace\\DelegateFolders" } ], "repeated": 0, "id": 6598 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d8" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "{DFFACDC5-679F-4156-8947-C5C76BC0B67F}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UsersFiles\\NameSpace\\DelegateFolders\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}" } ], "repeated": 0, "id": 6599 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegEnumKeyExW", "status": false, "return": "0x00000103", "pretty_return": "NO_MORE_ITEMS", "arguments": [ { "name": "Handle", "value": "0x000003d8" }, { "name": "Index", "value": "1" }, { "name": "Name", "value": "" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UsersFiles\\NameSpace\\DelegateFolders\\" } ], "repeated": 0, "id": 6600 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d8" } ], "repeated": 0, "id": 6601 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UsersFiles\\NameSpace\\DelegateFolders" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UsersFiles\\NameSpace\\DelegateFolders" } ], "repeated": 0, "id": 6602 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000002e4" }, { "name": "SubKey", "value": "SessionInfo\\1" }, { "name": "Handle", "value": "0x000003d8" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1" } ], "repeated": 0, "id": 6603 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000003d8" }, { "name": "SubKey", "value": "UsersFiles\\NameSpace" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1\\UsersFiles\\NameSpace" } ], "repeated": 0, "id": 6604 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000003d8" }, { "name": "SubKey", "value": "UsersFiles\\NameSpace\\DelegateFolders" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1\\UsersFiles\\NameSpace\\DelegateFolders" } ], "repeated": 0, "id": 6605 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d8" } ], "repeated": 0, "id": 6606 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\ShellFolder" }, { "name": "Handle", "value": "0x000003da" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\ShellFolder" } ], "repeated": 0, "id": 6607 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003da" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\ShellFolder\\Attributes" } ], "repeated": 0, "id": 6608 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003da" }, { "name": "ValueName", "value": "CallForAttributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\ShellFolder\\CallForAttributes" } ], "repeated": 0, "id": 6609 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003da" }, { "name": "ValueName", "value": "RestrictedAttributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\ShellFolder\\RestrictedAttributes" } ], "repeated": 0, "id": 6610 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003da" }, { "name": "ValueName", "value": "FolderValueFlags" }, { "name": "Data", "value": "1080" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\ShellFolder\\FolderValueFlags" } ], "repeated": 0, "id": 6611 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003da" } ], "repeated": 0, "id": 6612 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\ShellFolder" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\ShellFolder" } ], "repeated": 0, "id": 6613 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\ShellFolder" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\ShellFolder" } ], "repeated": 0, "id": 6614 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum" } ], "repeated": 0, "id": 6615 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum" }, { "name": "Handle", "value": "0x000003d8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum" } ], "repeated": 0, "id": 6616 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d8" }, { "name": "ValueName", "value": "{DFFACDC5-679F-4156-8947-C5C76BC0B67F}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}" } ], "repeated": 0, "id": 6617 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d8" } ], "repeated": 0, "id": 6618 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Users\\admin" } ], "repeated": 0, "id": 6619 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 6620 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "Handle", "value": "0x000003d8" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 6621 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003d8" }, { "name": "SubKey", "value": "{528c102f-0000-0000-0000-300300000000}\\" }, { "name": "Handle", "value": "0x00000318" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\" } ], "repeated": 0, "id": 6622 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d8" } ], "repeated": 0, "id": 6623 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "Generation" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation" } ], "repeated": 0, "id": 6624 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" } ], "repeated": 0, "id": 6625 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6626 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtQueryInformationFile", "status": false, "return": "0xffffffffc000000d", "pretty_return": "INVALID_PARAMETER", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\" }, { "name": "FileInformationClass", "value": "55", "pretty_value": "FileReplaceCompletionInformation" }, { "name": "FileInformation", "value": "" } ], "repeated": 0, "id": 6627 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtQueryDirectoryFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x006\\xean:\\xdd\\xac\\xd5\\x01B\\xd8<0\\x04\\xef\\xdc\\x01\\x9d\\xa9\\xd1\\xc9\\xb8\\xee\\xdc\\x01\\x9d\\xa9\\xd1\\xc9\\xb8\\xee\\xdc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x11\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xee\\x05\\x00\\x00\\x00\\x00\\x01\\x00U\\x00s\\x00e\\x00r\\x00s\\x00" }, { "name": "FileName", "value": "C:\\Users" }, { "name": "FileInformationClass", "value": "37", "pretty_value": "FileIdBothDirectoryInformation" } ], "repeated": 0, "id": 6628 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" } ], "repeated": 0, "id": 6629 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 6630 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6631 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtQueryInformationFile", "status": false, "return": "0xffffffffc000000d", "pretty_return": "INVALID_PARAMETER", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\Users" }, { "name": "FileInformationClass", "value": "55", "pretty_value": "FileReplaceCompletionInformation" }, { "name": "FileInformation", "value": "" } ], "repeated": 0, "id": 6632 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtQueryDirectoryFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf4a\\xd0\\x9c\\xb6\\xee\\xdc\\x01\\xfa\\xea\\x96k\\x05\\xef\\xdc\\x01\\xfa\\xea\\x96k\\x05\\xef\\xdc\\x01\\xfa\\xea\\x96k\\x05\\xef\\xdc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x004\\x9a\\x01\\x00\\x00\\x00\\x04\\x00a\\x00d\\x00m\\x00i\\x00n\\x00" }, { "name": "FileName", "value": "C:\\Users\\admin" }, { "name": "FileInformationClass", "value": "37", "pretty_value": "FileIdBothDirectoryInformation" } ], "repeated": 0, "id": 6633 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" } ], "repeated": 0, "id": 6634 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 3, "id": 6635 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1f5c041c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6636 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1f5c041d000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6637 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1f5c0420000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6638 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 6639 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000398" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 6640 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000398" }, { "name": "HandleName", "value": "C:\\" }, { "name": "FileInformationClass", "value": "9", "pretty_value": "FileNameInformation" }, { "name": "FileInformation", "value": "\\x02\\x00\\x00\\x00\\\\x00" } ], "repeated": 0, "id": 6641 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "GetVolumeInformationByHandleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Handle", "value": "0x00000398" }, { "name": "VolumeName", "value": "" }, { "name": "VolumeSerial", "value": "0xb34c3674" } ], "repeated": 0, "id": 6642 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" } ], "repeated": 0, "id": 6643 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "93" }, { "name": "ProcessInformation", "value": "\\x7f7\\x9e}" } ], "repeated": 0, "id": 6644 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "ntshrui.dll" } ], "repeated": 0, "id": 6645 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtQueryAttributesFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\ntshrui.dll" } ], "repeated": 0, "id": 6646 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\ntshrui.dll" } ], "repeated": 0, "id": 6647 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000398" }, { "name": "DesiredAccess", "value": "0x00100021", "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\ntshrui.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 6648 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002e8" }, { "name": "DesiredAccess", "value": "0x0000000d", "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x00000398" }, { "name": "FileName", "value": "C:\\Windows\\System32\\ntshrui.dll" } ], "repeated": 0, "id": 6649 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002e8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff41c10000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x0007d000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6650 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff41c8a000" }, { "name": "ModuleName", "value": "ntshrui.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6651 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff41c70000" }, { "name": "ModuleName", "value": "ntshrui.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6652 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff41c70000" }, { "name": "ModuleName", "value": "ntshrui.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6653 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff41c70000" }, { "name": "ModuleName", "value": "ntshrui.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6654 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff41c70000" }, { "name": "ModuleName", "value": "ntshrui.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6655 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff41c6f000" }, { "name": "ModuleName", "value": "ntshrui.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00002000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6656 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 6657 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" } ], "repeated": 0, "id": 6658 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff41c6f000" }, { "name": "ModuleName", "value": "ntshrui.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00002000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6659 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "35" }, { "name": "ProcessInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x19\\x00/C\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00P\\x001\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00Users\\x02\\x00\\x00\\x00\\x00\\x04\\x00\\xef\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00.\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00U\\x02\\x00\\x00\\x00\\x00r\\x00s\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00dmin\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xbe\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00a\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 6660 }, { "timestamp": "2026-05-29 01:05:17,837", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\ntshrui" }, { "name": "DllBase", "value": "0x7fff41c10000" } ], "repeated": 0, "id": 6661 }, { "timestamp": "2026-05-29 01:05:17,868", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\ntshrui" }, { "name": "BaseAddress", "value": "0x7fff41c10000" }, { "name": "InitRoutine", "value": "0x7fff41c21320" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 6662 }, { "timestamp": "2026-05-29 01:05:17,868", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff4359a000" }, { "name": "ModuleName", "value": "LINKINFO.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6663 }, { "timestamp": "2026-05-29 01:05:17,868", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff4359a000" }, { "name": "ModuleName", "value": "LINKINFO.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6664 }, { "timestamp": "2026-05-29 01:05:17,868", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "93" }, { "name": "ProcessInformation", "value": "\\x7f7\\x9e}" } ], "repeated": 0, "id": 6665 }, { "timestamp": "2026-05-29 01:05:17,868", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "srvcli.dll" } ], "repeated": 0, "id": 6666 }, { "timestamp": "2026-05-29 01:05:17,868", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtQueryAttributesFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\srvcli.dll" } ], "repeated": 0, "id": 6667 }, { "timestamp": "2026-05-29 01:05:17,868", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\srvcli.dll" } ], "repeated": 0, "id": 6668 }, { "timestamp": "2026-05-29 01:05:17,868", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002e8" }, { "name": "DesiredAccess", "value": "0x00100021", "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\srvcli.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 6669 }, { "timestamp": "2026-05-29 01:05:17,868", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000318" }, { "name": "DesiredAccess", "value": "0x0000000d", "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x000002e8" }, { "name": "FileName", "value": "C:\\Windows\\System32\\srvcli.dll" } ], "repeated": 0, "id": 6670 }, { "timestamp": "2026-05-29 01:05:17,868", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000318" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff4d670000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00028000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6671 }, { "timestamp": "2026-05-29 01:05:17,868", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff4d695000" }, { "name": "ModuleName", "value": "srvcli.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6672 }, { "timestamp": "2026-05-29 01:05:17,868", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff4d684000" }, { "name": "ModuleName", "value": "srvcli.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6673 }, { "timestamp": "2026-05-29 01:05:17,868", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff4d684000" }, { "name": "ModuleName", "value": "srvcli.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6674 }, { "timestamp": "2026-05-29 01:05:17,868", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff4d684000" }, { "name": "ModuleName", "value": "srvcli.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6675 }, { "timestamp": "2026-05-29 01:05:17,868", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff4d684000" }, { "name": "ModuleName", "value": "srvcli.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6676 }, { "timestamp": "2026-05-29 01:05:17,868", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff4d684000" }, { "name": "ModuleName", "value": "srvcli.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6677 }, { "timestamp": "2026-05-29 01:05:17,868", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" } ], "repeated": 0, "id": 6678 }, { "timestamp": "2026-05-29 01:05:17,868", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 6679 }, { "timestamp": "2026-05-29 01:05:17,868", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff4d684000" }, { "name": "ModuleName", "value": "srvcli.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6680 }, { "timestamp": "2026-05-29 01:05:17,868", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\srvcli" }, { "name": "DllBase", "value": "0x7fff4d670000" } ], "repeated": 0, "id": 6681 }, { "timestamp": "2026-05-29 01:05:17,868", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "System\\CurrentControlSet\\Services\\LanmanWorkstation\\Parameters" }, { "name": "Handle", "value": "0x000003d8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\LanmanWorkstation\\Parameters" } ], "repeated": 0, "id": 6682 }, { "timestamp": "2026-05-29 01:05:17,868", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003d8" }, { "name": "ValueName", "value": "RpcCacheTimeout" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\LanmanWorkstation\\Parameters\\RpcCacheTimeout" } ], "repeated": 0, "id": 6683 }, { "timestamp": "2026-05-29 01:05:17,868", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d8" } ], "repeated": 0, "id": 6684 }, { "timestamp": "2026-05-29 01:05:17,868", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\srvcli" }, { "name": "BaseAddress", "value": "0x7fff4d670000" }, { "name": "InitRoutine", "value": "0x7fff4d672110" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 6685 }, { "timestamp": "2026-05-29 01:05:17,868", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff41c8a000" }, { "name": "ModuleName", "value": "ntshrui.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6686 }, { "timestamp": "2026-05-29 01:05:17,868", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff41c8a000" }, { "name": "ModuleName", "value": "ntshrui.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6687 }, { "timestamp": "2026-05-29 01:05:17,868", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "misc", "api": "GetComputerNameExW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ComputerName", "value": "DESKTOP-74SUV8W" } ], "repeated": 0, "id": 6688 }, { "timestamp": "2026-05-29 01:05:17,868", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000040c" }, { "name": "DesiredAccess", "value": "0xc0100080", "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\PIPE\\srvsvc" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6689 }, { "timestamp": "2026-05-29 01:05:17,868", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000040c" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\srvsvc" }, { "name": "FileInformationClass", "value": "23", "pretty_value": "FilePipeInformation" }, { "name": "FileInformation", "value": "\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 6690 }, { "timestamp": "2026-05-29 01:05:17,868", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000040c" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\srvsvc" }, { "name": "FileInformationClass", "value": "41", "pretty_value": "FileIoStatusBlockRangeInformation" }, { "name": "FileInformation", "value": "\\x02\\x00\\x00\\x00" } ], "repeated": 0, "id": 6691 }, { "timestamp": "2026-05-29 01:05:17,868", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000040c" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\srvsvc" }, { "name": "FileInformationClass", "value": "30", "pretty_value": "FileCompletionInformation" }, { "name": "FileInformation", "value": "\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb8\\xf0A\\xc0\\xf5\\x01\\x00\\x00" } ], "repeated": 0, "id": 6692 }, { "timestamp": "2026-05-29 01:05:17,868", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Policies\\Microsoft\\Windows NT\\Rpc" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows NT\\Rpc" } ], "repeated": 0, "id": 6693 }, { "timestamp": "2026-05-29 01:05:17,868", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000040c" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\srvsvc" }, { "name": "Buffer", "value": "\\x05\\x00\\x0b\\x03\\x10\\x00\\x00\\x00\\xa0\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xb8\\x10\\xb8\\x10\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\xc8O2Kp\\x16\\xd3\\x01\\x12xZG\\xbfn\\xe1\\x88\\x03\\x00\\x00\\x00\\x04]\\x88\\x8a\\xeb\\x1c\\xc9\\x11\\x9f\\xe8\\x08\\x00+\\x10H`\\x02\\x00\\x00\\x00\\x01\\x00\\x01\\x00\\xc8O2Kp\\x16\\xd3\\x01\\x12xZG\\xbfn\\xe1\\x88\\x03\\x00\\x00\\x003\\x05qq\\xba\\xbe7I\\x83\\x19\\xb5\\xdb\\xef\\x9c\\xcc6\\x01\\x00\\x00\\x00\\x02\\x00\\x01\\x00\\xc8O2Kp\\x16\\xd3\\x01\\x12xZG\\xbfn\\xe1\\x88\\x03\\x00\\x00\\x00,\\x1c\\xb7l\\x12\\x98@E\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00" }, { "name": "Length", "value": "160" } ], "repeated": 0, "id": 6694 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000040c" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\srvsvc" }, { "name": "Buffer", "value": "\\x05\\x00\\x0c\\x03\\x10\\x00\\x00\\x00t\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xb8\\x10\\xb8\\x10\\xdf\\x0c\\x00\\x00\r\\x00\\PIPE\\srvsvc\\x00\\x00\\x03\\x00\\x00\\x00\\x02\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x003\\x05qq\\xba\\xbe7I\\x83\\x19\\xb5\\xdb\\xef\\x9c\\xcc6\\x01\\x00\\x00\\x00\\x03\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "2151778615412" } ], "repeated": 0, "id": 6695 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001f5" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 6696 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\cscapi" }, { "name": "DllBase", "value": "0x7fff434d0000" } ], "repeated": 0, "id": 6697 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "cscapi.dll" }, { "name": "BaseAddress", "value": "0x7fff434d0000" } ], "repeated": 0, "id": 6698 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff434d0000", "arguments": [ { "name": "lpLibFileName", "value": "cscapi.dll" }, { "name": "dwFlags", "value": "0x00000000" } ], "repeated": 0, "id": 6699 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "cscapi.dll" }, { "name": "ModuleHandle", "value": "0x7fff434d0000" }, { "name": "FunctionName", "value": "CscNetApiGetInterface" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff434d19f0" } ], "repeated": 0, "id": 6700 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 6701 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "NtQuerySystemInformation" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fed690" } ], "repeated": 0, "id": 6702 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "134" } ], "repeated": 0, "id": 6703 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff4359a000" }, { "name": "ModuleName", "value": "LINKINFO.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6704 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff4359a000" }, { "name": "ModuleName", "value": "LINKINFO.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6705 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000430" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6706 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000430" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk" }, { "name": "FileInformationClass", "value": "34", "pretty_value": "FileNetworkOpenInformation" }, { "name": "FileInformation", "value": "\\\\xbd\\xd6\\x9c\\xb6\\xee\\xdc\\x01\\x94\\xee\\xb46\\x07\\xef\\xdc\\x01z\\xe4:{\\xde\\xac\\xd5\\x01\\xbe7\\xc0\\xa1\\xb7\\xee\\xdc\\x01\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xeb\t\\x00\\x00\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 6707 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "device", "api": "DeviceIoControl", "status": true, "return": "0x00000001", "arguments": [ { "name": "DeviceHandle", "value": "0x00000430" }, { "name": "IoControlCode", "value": "0x000900c0" }, { "name": "InBuffer", "value": "" }, { "name": "OutBuffer", "value": "\\xbb\\xd7\\xa7\\x1c\\xe4Z\\xf1\\x11\\xae'RT\\x00\\x88\\x98^\nfB\\xd59\\xbe\\xebJ\\x92$Gl\\xf0\\xf7\\x89K\\xbb\\xd7\\xa7\\x1c\\xe4Z\\xf1\\x11\\xae'RT\\x00\\x88\\x98^\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 6708 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc00000ba", "pretty_return": "FILE_IS_A_DIRECTORY", "arguments": [ { "name": "FileHandle", "value": "0x1f5c1cf0000" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 6709 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000434" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6710 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "device", "api": "DeviceIoControl", "status": false, "return": "0x00000000", "arguments": [ { "name": "DeviceHandle", "value": "0x00000434" }, { "name": "IoControlCode", "value": "0x000900a8", "pretty_value": "FSCTL_GET_REPARSE_POINT" }, { "name": "InBuffer", "value": "" }, { "name": "OutBuffer", "value": "\\xe0\\xe5\\xec\\x11l\\x00\\x00\\x00\\x10\\xe6\\xec\\x11l\\x00\\x00\\x00\\x80\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\xba\\x00\\x00\\xc0\\xff\\xff\\xff\\xff\\xbc\\x02X:M`\\x00\\x00\\x08\\x82}\\x1a\\xff\\x7f\\x00\\x00`\\xdc?\\xc0\\xf5\\x01\\x00\\x00\\xba\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\xeb\\xec\\x11l\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\xe6\\xec\\x11l\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfak}W\\xff\\x7f\\x00\\x00C\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\xe6\\xec\\x11l\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\xcf\\xc1\\xf5\\x01\\x00\\x00\\xb6\\x00\\xba\\x00\\xff\\x7f\\x00\\x00`\\xdc?\\xc0\\xf5\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x00\\x00\\x00\\x00\\x00\\x00\\x004\\xc4\\x85\\x1a\\xff\\x7f\\x00\\x000\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe8\\xe5\\xec\\x11l\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 6711 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000434" } ], "repeated": 0, "id": 6712 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000434" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 6713 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000434" } ], "repeated": 0, "id": 6714 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "misc", "api": "GetComputerNameW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ComputerName", "value": "DESKTOP-74SUV8W" } ], "repeated": 0, "id": 6715 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000430" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk" }, { "name": "FileInformationClass", "value": "9", "pretty_value": "FileNameInformation" }, { "name": "FileInformation", "value": "\\xd8\\x00\\x00\\x00\\\\x00U\\x00s\\x00e\\x00r\\x00s\\x00\\\\x00a\\x00d\\x00m\\x00i\\x00n\\x00\\\\x00A\\x00p\\x00p\\x00D\\x00a\\x00t\\x00a\\x00\\\\x00R\\x00o\\x00a\\x00m\\x00i\\x00n\\x00g\\x00\\\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00\\\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00\\\\x00S\\x00t\\x00a\\x00r\\x00t\\x00 \\x00M\\x00e\\x00n\\x00u\\x00\\\\x00P\\x00r\\x00o\\x00g\\x00r\\x00a\\x00m\\x00s\\x00\\\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00 \\x00P\\x00o\\x00w\\x00e\\x00r\\x00S\\x00h\\x00e\\x00l\\x00l\\x00\\\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00 \\x00P\\x00o\\x00w\\x00e\\x00r\\x00S\\x00h\\x00e\\x00l\\x00l\\x00.\\x00l\\x00n\\x00k\\x00" } ], "repeated": 0, "id": 6716 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000434" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\MountPointManager" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6717 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "device", "api": "DeviceIoControl", "status": true, "return": "0x00000001", "arguments": [ { "name": "DeviceHandle", "value": "0x00000434" }, { "name": "IoControlCode", "value": "0x006d0008", "pretty_value": "IOCTL_MOUNTMGR_QUERY_POINTS" }, { "name": "InBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00.\\x00\\x00\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00" }, { "name": "OutBuffer", "value": "\\xee\\x00\\x00\\x00\\x02\\x00\\x00\\x00r\\x00\\x00\\x00\\x1c\\x00\\x00\\x008\\x00\\x00\\x00\\x0c\\x00\\x00\\x00D\\x00\\x00\\x00.\\x00\\x00\\x00\\x8e\\x00\\x00\\x00`\\x00\\x00\\x008\\x00\\x00\\x00\\x0c\\x00\\x00\\x00D\\x00\\x00\\x00.\\x00\\x00\\x00/\\x10\\x8cR\\x00\\x000\\x03\\x00\\x00\\x00\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00\\\\x00D\\x00o\\x00s\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00s\\x00\\\\x00C\\x00:\\x00\\\\x00?\\x00?\\x00\\\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00{\\x005\\x002\\x008\\x00c\\x001\\x000\\x002\\x00f\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x003\\x000\\x000\\x003\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x00}\\x00" } ], "repeated": 0, "id": 6718 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000434" } ], "repeated": 0, "id": 6719 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000430" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk" }, { "name": "FileInformationClass", "value": "48", "pretty_value": "FileNetworkPhysicalNameInformation" }, { "name": "FileInformation", "value": "\\xd8\\x00\\x00\\x00\\\\x00U\\x00s\\x00e\\x00r\\x00s\\x00\\\\x00a\\x00d\\x00m\\x00i\\x00n\\x00\\\\x00A\\x00p\\x00p\\x00D\\x00a\\x00t\\x00a\\x00\\\\x00R\\x00o\\x00a\\x00m\\x00i\\x00n\\x00g\\x00\\\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00\\\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00\\\\x00S\\x00t\\x00a\\x00r\\x00t\\x00 \\x00M\\x00e\\x00n\\x00u\\x00\\\\x00P\\x00r\\x00o\\x00g\\x00r\\x00a\\x00m\\x00s\\x00\\\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00 \\x00P\\x00o\\x00w\\x00e\\x00r\\x00S\\x00h\\x00e\\x00l\\x00l\\x00\\\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00 \\x00P\\x00o\\x00w\\x00e\\x00r\\x00S\\x00h\\x00e\\x00l\\x00l\\x00.\\x00l\\x00n\\x00k\\x00" } ], "repeated": 0, "id": 6720 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000430" } ], "repeated": 0, "id": 6721 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ee24", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000430" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\CustomLocale" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\CustomLocale" } ], "repeated": 0, "id": 6722 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ee24", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000430" }, { "name": "ValueName", "value": "en-US" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US" } ], "repeated": 0, "id": 6723 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ee24", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000430" } ], "repeated": 0, "id": 6724 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ee24", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000430" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\ExtendedLocale" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\ExtendedLocale" } ], "repeated": 0, "id": 6725 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ee24", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000430" }, { "name": "ValueName", "value": "en-US" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US" } ], "repeated": 0, "id": 6726 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ee24", "parentcaller": "0x7ff7e415e863", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000430" } ], "repeated": 0, "id": 6727 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ee24", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000002e0" }, { "name": "ValueName", "value": "en-US" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en-US" } ], "repeated": 0, "id": 6728 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ee24", "parentcaller": "0x7ff7e415e863", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000002e0" }, { "name": "ValueName", "value": "en" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en" } ], "repeated": 0, "id": 6729 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ebea", "parentcaller": "0x7ff7e415e8c0", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x1f5c0411510", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\windowspowershell\\v1.0\\powershell_ise.exe" }, { "name": "FirstCreateTimeLow", "value": "0x21dff6e3" }, { "name": "FirstCreateTimeHigh", "value": "0x01d5ace4" } ], "repeated": 0, "id": 6730 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ec04", "parentcaller": "0x7ff7e415e8c0", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000430" } ], "repeated": 0, "id": 6731 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415edbb", "parentcaller": "0x7ff7e415e92b", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00021401-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "000214F9-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "lnkfile" } ], "repeated": 0, "id": 6732 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e92b", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "Handle", "value": "0x00000434" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 6733 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e92b", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000434" }, { "name": "SubKey", "value": "{528c102f-0000-0000-0000-300300000000}\\" }, { "name": "Handle", "value": "0x00000438" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\" } ], "repeated": 0, "id": 6734 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e92b", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000434" } ], "repeated": 0, "id": 6735 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e92b", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000438" }, { "name": "ValueName", "value": "Generation" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation" } ], "repeated": 0, "id": 6736 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e92b", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000438" } ], "repeated": 0, "id": 6737 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e92b", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000438" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6738 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e92b", "category": "filesystem", "api": "NtQueryInformationFile", "status": false, "return": "0xffffffffc000000d", "pretty_return": "INVALID_PARAMETER", "arguments": [ { "name": "FileHandle", "value": "0x00000438" }, { "name": "HandleName", "value": "C:\\" }, { "name": "FileInformationClass", "value": "55", "pretty_value": "FileReplaceCompletionInformation" }, { "name": "FileInformation", "value": "" } ], "repeated": 0, "id": 6739 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e92b", "category": "filesystem", "api": "NtQueryDirectoryFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000438" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x006\\xean:\\xdd\\xac\\xd5\\x01W\\xec\\xc0/\\x04\\xef\\xdc\\x01\\xfc\\x07\\x87\\xc3\\xb8\\xee\\xdc\\x01\\xfc\\x07\\x87\\xc3\\xb8\\xee\\xdc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x0e\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'\\x06\\x00\\x00\\x00\\x00\\x01\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00" }, { "name": "FileName", "value": "C:\\Windows" }, { "name": "FileInformationClass", "value": "37", "pretty_value": "FileIdBothDirectoryInformation" } ], "repeated": 0, "id": 6740 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e92b", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000438" } ], "repeated": 0, "id": 6741 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e92b", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000438" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6742 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e92b", "category": "filesystem", "api": "NtQueryInformationFile", "status": false, "return": "0xffffffffc000000d", "pretty_return": "INVALID_PARAMETER", "arguments": [ { "name": "FileHandle", "value": "0x00000438" }, { "name": "HandleName", "value": "C:\\Windows" }, { "name": "FileInformationClass", "value": "55", "pretty_value": "FileReplaceCompletionInformation" }, { "name": "FileInformation", "value": "" } ], "repeated": 0, "id": 6743 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e92b", "category": "filesystem", "api": "NtQueryDirectoryFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000438" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x006\\xean:\\xdd\\xac\\xd5\\x01\\x98\\x12\\x8d5\\x07\\xef\\xdc\\x01U\\x15q5\\x07\\xef\\xdc\\x01U\\x15q5\\x07\\xef\\xdc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe3\\x0c\\x00\\x00\\x00\\x00\\x01\\x00S\\x00y\\x00s\\x00t\\x00e\\x00m\\x003\\x002\\x00" }, { "name": "FileName", "value": "C:\\Windows\\System32" }, { "name": "FileInformationClass", "value": "37", "pretty_value": "FileIdBothDirectoryInformation" } ], "repeated": 0, "id": 6744 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e92b", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000438" } ], "repeated": 0, "id": 6745 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e92b", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000438" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6746 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e92b", "category": "filesystem", "api": "NtQueryInformationFile", "status": false, "return": "0xffffffffc000000d", "pretty_return": "INVALID_PARAMETER", "arguments": [ { "name": "FileHandle", "value": "0x00000438" }, { "name": "HandleName", "value": "C:\\Windows\\System32" }, { "name": "FileInformationClass", "value": "55", "pretty_value": "FileReplaceCompletionInformation" }, { "name": "FileInformation", "value": "" } ], "repeated": 0, "id": 6747 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e92b", "category": "filesystem", "api": "NtQueryDirectoryFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000438" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\\\x8c\\x9b\\xc8\\xde\\xac\\xd5\\x01'\\xedDz\\x04\\xef\\xdc\\x01\\\\x8c\\x9b\\xc8\\xde\\xac\\xd5\\x01\\x96\\x0cy\\xe2\\xf8\\xee\\xdc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xdc\\x10\\x00\\x00\\x00\\x00\\x01\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00P\\x00o\\x00w\\x00e\\x00r\\x00S\\x00h\\x00e\\x00l\\x00l\\x00" }, { "name": "FileName", "value": "C:\\Windows\\System32\\windowspowershell" }, { "name": "FileInformationClass", "value": "37", "pretty_value": "FileIdBothDirectoryInformation" } ], "repeated": 0, "id": 6748 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e92b", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000438" } ], "repeated": 0, "id": 6749 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e92b", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000438" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\WindowsPowerShell" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6750 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e92b", "category": "filesystem", "api": "NtQueryInformationFile", "status": false, "return": "0xffffffffc000000d", "pretty_return": "INVALID_PARAMETER", "arguments": [ { "name": "FileHandle", "value": "0x00000438" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\WindowsPowerShell" }, { "name": "FileInformationClass", "value": "55", "pretty_value": "FileReplaceCompletionInformation" }, { "name": "FileInformation", "value": "" } ], "repeated": 0, "id": 6751 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e92b", "category": "filesystem", "api": "NtQueryDirectoryFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000438" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\\\x8c\\x9b\\xc8\\xde\\xac\\xd5\\x01\\xfa\\x14\\xc6Y\\x05\\xef\\xdc\\x01buvp]&\\xda\\x01\\x96\\x0cy\\xe2\\xf8\\xee\\xdc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xdd\\x10\\x00\\x00\\x00\\x00\\x01\\x00v\\x001\\x00.\\x000\\x00" }, { "name": "FileName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0" }, { "name": "FileInformationClass", "value": "37", "pretty_value": "FileIdBothDirectoryInformation" } ], "repeated": 0, "id": 6752 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e92b", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000438" } ], "repeated": 0, "id": 6753 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e92b", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000438" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6754 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e92b", "category": "filesystem", "api": "NtQueryInformationFile", "status": false, "return": "0xffffffffc000000d", "pretty_return": "INVALID_PARAMETER", "arguments": [ { "name": "FileHandle", "value": "0x00000438" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0" }, { "name": "FileInformationClass", "value": "55", "pretty_value": "FileReplaceCompletionInformation" }, { "name": "FileInformation", "value": "" } ], "repeated": 0, "id": 6755 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e92b", "category": "filesystem", "api": "NtQueryDirectoryFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000438" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe3\\xf6\\xdf!\\xe4\\xac\\xd5\\x01\\xda\\xba\\xb05\\x07\\xef\\xdc\\x01\\x00\\xc6\"KW\\xac\\xd5\\x01\\xbe7\\xc0\\xa1\\xb7\\xee\\xdc\\x01\\x00@\\x03\\x00\\x00\\x00\\x00\\x00\\x00@\\x03\\x00\\x00\\x00\\x00\\x00 \\x00\\x00\\x00$\\x00\\x00\\x00t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\xfd\\x00\\x00\\x00\\x00\\x01\\x00p\\x00o\\x00w\\x00e\\x00r\\x00s\\x00h\\x00e\\x00l\\x00l\\x00_\\x00i\\x00s\\x00e\\x00.\\x00e\\x00x\\x00e\\x00" }, { "name": "FileName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell_ise.exe" }, { "name": "FileInformationClass", "value": "37", "pretty_value": "FileIdBothDirectoryInformation" } ], "repeated": 0, "id": 6756 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e92b", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000438" } ], "repeated": 0, "id": 6757 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e92b", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 6758 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e92b", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "Handle", "value": "0x00000438" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 6759 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e92b", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000438" }, { "name": "SubKey", "value": "{528c102f-0000-0000-0000-300300000000}\\" }, { "name": "Handle", "value": "0x00000434" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\" } ], "repeated": 0, "id": 6760 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e92b", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000438" } ], "repeated": 0, "id": 6761 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e92b", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000434" }, { "name": "ValueName", "value": "Generation" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation" } ], "repeated": 0, "id": 6762 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e92b", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000434" } ], "repeated": 0, "id": 6763 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e92b", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\IdListAliasTranslations" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\IdListAliasTranslations" } ], "repeated": 0, "id": 6764 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e92b", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\IdListAliasTranslations" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\IdListAliasTranslations" } ], "repeated": 0, "id": 6765 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e92b", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000434" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 6766 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e92b", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000434" }, { "name": "HandleName", "value": "C:\\" }, { "name": "FileInformationClass", "value": "9", "pretty_value": "FileNameInformation" }, { "name": "FileInformation", "value": "\\x02\\x00\\x00\\x00\\\\x00" } ], "repeated": 0, "id": 6767 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e92b", "category": "filesystem", "api": "GetVolumeInformationByHandleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Handle", "value": "0x00000434" }, { "name": "VolumeName", "value": "" }, { "name": "VolumeSerial", "value": "0xb34c3674" } ], "repeated": 0, "id": 6768 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e92b", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000434" } ], "repeated": 0, "id": 6769 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e92b", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000434" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell_ise.exe" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6770 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e92b", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000434" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell_ise.exe" }, { "name": "FileInformationClass", "value": "34", "pretty_value": "FileNetworkOpenInformation" }, { "name": "FileInformation", "value": "\\xe3\\xf6\\xdf!\\xe4\\xac\\xd5\\x01\\xb5\\xc2\\xb05\\x07\\xef\\xdc\\x01\\x00\\xc6\"KW\\xac\\xd5\\x01\\xbe7\\xc0\\xa1\\xb7\\xee\\xdc\\x01\\x00@\\x03\\x00\\x00\\x00\\x00\\x00\\x00@\\x03\\x00\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 6771 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e92b", "category": "device", "api": "DeviceIoControl", "status": true, "return": "0x00000001", "arguments": [ { "name": "DeviceHandle", "value": "0x00000434" }, { "name": "IoControlCode", "value": "0x000900c0" }, { "name": "InBuffer", "value": "" }, { "name": "OutBuffer", "value": "\\xbc\\xd7\\xa7\\x1c\\xe4Z\\xf1\\x11\\xae'RT\\x00\\x88\\x98^\nfB\\xd59\\xbe\\xebJ\\x92$Gl\\xf0\\xf7\\x89K\\xbc\\xd7\\xa7\\x1c\\xe4Z\\xf1\\x11\\xae'RT\\x00\\x88\\x98^\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 6772 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e92b", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc00000ba", "pretty_return": "FILE_IS_A_DIRECTORY", "arguments": [ { "name": "FileHandle", "value": "0x1f5c1cf0000" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 6773 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e92b", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000438" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6774 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e92b", "category": "device", "api": "DeviceIoControl", "status": false, "return": "0x00000000", "arguments": [ { "name": "DeviceHandle", "value": "0x00000438" }, { "name": "IoControlCode", "value": "0x000900a8", "pretty_value": "FSCTL_GET_REPARSE_POINT" }, { "name": "InBuffer", "value": "" }, { "name": "OutBuffer", "value": "\\xe0\\xe5\\xec\\x11l\\x00\\x00\\x00\\x10\\xe6\\xec\\x11l\\x00\\x00\\x00\\x80\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\xba\\x00\\x00\\xc0\\xff\\xff\\xff\\xff\\xbc\\x02X:M`\\x00\\x00\\x08\\x82}\\x1a\\xff\\x7f\\x00\\x00\\x80\\xe2@\\xc0\\xf5\\x01\\x00\\x00\\xba\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\xeb\\xec\\x11l\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\xe6\\xec\\x11l\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfak}W\\xff\\x7f\\x00\\x00C\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\xe6\\xec\\x11l\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\xcf\\xc1\\xf5\\x01\\x00\\x00\\\\x00`\\x00\\xff\\x7f\\x00\\x00\\x80\\xe2@\\xc0\\xf5\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x00\\x00\\x00\\x00\\x00\\x00\\x004\\xc4\\x85\\x1a\\xff\\x7f\\x00\\x000\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe8\\xe5\\xec\\x11l\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 6775 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e92b", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000438" } ], "repeated": 0, "id": 6776 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e92b", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000438" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 6777 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e92b", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000438" } ], "repeated": 0, "id": 6778 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e92b", "category": "misc", "api": "GetComputerNameW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ComputerName", "value": "DESKTOP-74SUV8W" } ], "repeated": 0, "id": 6779 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e92b", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000434" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell_ise.exe" }, { "name": "FileInformationClass", "value": "9", "pretty_value": "FileNameInformation" }, { "name": "FileInformation", "value": "v\\x00\\x00\\x00\\\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00\\\\x00S\\x00y\\x00s\\x00t\\x00e\\x00m\\x003\\x002\\x00\\\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00P\\x00o\\x00w\\x00e\\x00r\\x00S\\x00h\\x00e\\x00l\\x00l\\x00\\\\x00v\\x001\\x00.\\x000\\x00\\\\x00p\\x00o\\x00w\\x00e\\x00r\\x00s\\x00h\\x00e\\x00l\\x00l\\x00_\\x00i\\x00s\\x00e\\x00.\\x00e\\x00x\\x00e\\x00" } ], "repeated": 0, "id": 6780 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e92b", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000438" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\MountPointManager" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6781 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e92b", "category": "device", "api": "DeviceIoControl", "status": true, "return": "0x00000001", "arguments": [ { "name": "DeviceHandle", "value": "0x00000438" }, { "name": "IoControlCode", "value": "0x006d0008", "pretty_value": "IOCTL_MOUNTMGR_QUERY_POINTS" }, { "name": "InBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00.\\x00\\x00\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00" }, { "name": "OutBuffer", "value": "\\xee\\x00\\x00\\x00\\x02\\x00\\x00\\x00r\\x00\\x00\\x00\\x1c\\x00\\x00\\x008\\x00\\x00\\x00\\x0c\\x00\\x00\\x00D\\x00\\x00\\x00.\\x00\\x00\\x00\\x8e\\x00\\x00\\x00`\\x00\\x00\\x008\\x00\\x00\\x00\\x0c\\x00\\x00\\x00D\\x00\\x00\\x00.\\x00\\x00\\x00/\\x10\\x8cR\\x00\\x000\\x03\\x00\\x00\\x00\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00\\\\x00D\\x00o\\x00s\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00s\\x00\\\\x00C\\x00:\\x00\\\\x00?\\x00?\\x00\\\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00{\\x005\\x002\\x008\\x00c\\x001\\x000\\x002\\x00f\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x003\\x000\\x000\\x003\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x00}\\x00" } ], "repeated": 0, "id": 6782 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e92b", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000438" } ], "repeated": 0, "id": 6783 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e92b", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000434" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell_ise.exe" }, { "name": "FileInformationClass", "value": "48", "pretty_value": "FileNetworkPhysicalNameInformation" }, { "name": "FileInformation", "value": "v\\x00\\x00\\x00\\\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00\\\\x00S\\x00y\\x00s\\x00t\\x00e\\x00m\\x003\\x002\\x00\\\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00P\\x00o\\x00w\\x00e\\x00r\\x00S\\x00h\\x00e\\x00l\\x00l\\x00\\\\x00v\\x001\\x00.\\x000\\x00\\\\x00p\\x00o\\x00w\\x00e\\x00r\\x00s\\x00h\\x00e\\x00l\\x00l\\x00_\\x00i\\x00s\\x00e\\x00.\\x00e\\x00x\\x00e\\x00" } ], "repeated": 0, "id": 6784 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e92b", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000434" } ], "repeated": 0, "id": 6785 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415edbb", "parentcaller": "0x7ff7e415e9d0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00021401-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "000214F9-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "lnkfile" } ], "repeated": 0, "id": 6786 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e9d0", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "Handle", "value": "0x00000438" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 6787 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e9d0", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000438" }, { "name": "SubKey", "value": "{528c102f-0000-0000-0000-300300000000}\\" }, { "name": "Handle", "value": "0x0000043c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\" } ], "repeated": 0, "id": 6788 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e9d0", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000438" } ], "repeated": 0, "id": 6789 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e9d0", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000043c" }, { "name": "ValueName", "value": "Generation" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation" } ], "repeated": 0, "id": 6790 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e9d0", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000043c" } ], "repeated": 0, "id": 6791 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e9d0", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000043c" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6792 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e9d0", "category": "filesystem", "api": "NtQueryInformationFile", "status": false, "return": "0xffffffffc000000d", "pretty_return": "INVALID_PARAMETER", "arguments": [ { "name": "FileHandle", "value": "0x0000043c" }, { "name": "HandleName", "value": "C:\\" }, { "name": "FileInformationClass", "value": "55", "pretty_value": "FileReplaceCompletionInformation" }, { "name": "FileInformation", "value": "" } ], "repeated": 0, "id": 6793 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e9d0", "category": "filesystem", "api": "NtQueryDirectoryFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000043c" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x006\\xean:\\xdd\\xac\\xd5\\x01W\\xec\\xc0/\\x04\\xef\\xdc\\x01\\xfc\\x07\\x87\\xc3\\xb8\\xee\\xdc\\x01\\xfc\\x07\\x87\\xc3\\xb8\\xee\\xdc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x0e\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'\\x06\\x00\\x00\\x00\\x00\\x01\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00" }, { "name": "FileName", "value": "C:\\Windows" }, { "name": "FileInformationClass", "value": "37", "pretty_value": "FileIdBothDirectoryInformation" } ], "repeated": 0, "id": 6794 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e9d0", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000043c" } ], "repeated": 0, "id": 6795 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e9d0", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000043c" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6796 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e9d0", "category": "filesystem", "api": "NtQueryInformationFile", "status": false, "return": "0xffffffffc000000d", "pretty_return": "INVALID_PARAMETER", "arguments": [ { "name": "FileHandle", "value": "0x0000043c" }, { "name": "HandleName", "value": "C:\\Windows" }, { "name": "FileInformationClass", "value": "55", "pretty_value": "FileReplaceCompletionInformation" }, { "name": "FileInformation", "value": "" } ], "repeated": 0, "id": 6797 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e9d0", "category": "filesystem", "api": "NtQueryDirectoryFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000043c" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x006\\xean:\\xdd\\xac\\xd5\\x01\\x98\\x12\\x8d5\\x07\\xef\\xdc\\x01U\\x15q5\\x07\\xef\\xdc\\x01U\\x15q5\\x07\\xef\\xdc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe3\\x0c\\x00\\x00\\x00\\x00\\x01\\x00S\\x00y\\x00s\\x00t\\x00e\\x00m\\x003\\x002\\x00" }, { "name": "FileName", "value": "C:\\Windows\\System32" }, { "name": "FileInformationClass", "value": "37", "pretty_value": "FileIdBothDirectoryInformation" } ], "repeated": 0, "id": 6798 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e9d0", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000043c" } ], "repeated": 0, "id": 6799 }, { "timestamp": "2026-05-29 01:05:17,883", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e9d0", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000043c" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6800 }, { "timestamp": "2026-05-29 01:05:17,899", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e9d0", "category": "filesystem", "api": "NtQueryInformationFile", "status": false, "return": "0xffffffffc000000d", "pretty_return": "INVALID_PARAMETER", "arguments": [ { "name": "FileHandle", "value": "0x0000043c" }, { "name": "HandleName", "value": "C:\\Windows\\System32" }, { "name": "FileInformationClass", "value": "55", "pretty_value": "FileReplaceCompletionInformation" }, { "name": "FileInformation", "value": "" } ], "repeated": 0, "id": 6801 }, { "timestamp": "2026-05-29 01:05:17,899", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e9d0", "category": "filesystem", "api": "NtQueryDirectoryFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000043c" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\\\x8c\\x9b\\xc8\\xde\\xac\\xd5\\x01'\\xedDz\\x04\\xef\\xdc\\x01\\\\x8c\\x9b\\xc8\\xde\\xac\\xd5\\x01\\x96\\x0cy\\xe2\\xf8\\xee\\xdc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xdc\\x10\\x00\\x00\\x00\\x00\\x01\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00P\\x00o\\x00w\\x00e\\x00r\\x00S\\x00h\\x00e\\x00l\\x00l\\x00" }, { "name": "FileName", "value": "C:\\Windows\\System32\\windowspowershell" }, { "name": "FileInformationClass", "value": "37", "pretty_value": "FileIdBothDirectoryInformation" } ], "repeated": 0, "id": 6802 }, { "timestamp": "2026-05-29 01:05:17,899", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e9d0", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000043c" } ], "repeated": 0, "id": 6803 }, { "timestamp": "2026-05-29 01:05:17,899", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e9d0", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000043c" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\WindowsPowerShell" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6804 }, { "timestamp": "2026-05-29 01:05:17,899", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e9d0", "category": "filesystem", "api": "NtQueryInformationFile", "status": false, "return": "0xffffffffc000000d", "pretty_return": "INVALID_PARAMETER", "arguments": [ { "name": "FileHandle", "value": "0x0000043c" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\WindowsPowerShell" }, { "name": "FileInformationClass", "value": "55", "pretty_value": "FileReplaceCompletionInformation" }, { "name": "FileInformation", "value": "" } ], "repeated": 0, "id": 6805 }, { "timestamp": "2026-05-29 01:05:17,899", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e9d0", "category": "filesystem", "api": "NtQueryDirectoryFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000043c" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\\\x8c\\x9b\\xc8\\xde\\xac\\xd5\\x01\\xfa\\x14\\xc6Y\\x05\\xef\\xdc\\x01buvp]&\\xda\\x01\\x96\\x0cy\\xe2\\xf8\\xee\\xdc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xdd\\x10\\x00\\x00\\x00\\x00\\x01\\x00v\\x001\\x00.\\x000\\x00" }, { "name": "FileName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0" }, { "name": "FileInformationClass", "value": "37", "pretty_value": "FileIdBothDirectoryInformation" } ], "repeated": 0, "id": 6806 }, { "timestamp": "2026-05-29 01:05:17,899", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e9d0", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000043c" } ], "repeated": 0, "id": 6807 }, { "timestamp": "2026-05-29 01:05:17,899", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e9d0", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000043c" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6808 }, { "timestamp": "2026-05-29 01:05:17,899", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e9d0", "category": "filesystem", "api": "NtQueryInformationFile", "status": false, "return": "0xffffffffc000000d", "pretty_return": "INVALID_PARAMETER", "arguments": [ { "name": "FileHandle", "value": "0x0000043c" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0" }, { "name": "FileInformationClass", "value": "55", "pretty_value": "FileReplaceCompletionInformation" }, { "name": "FileInformation", "value": "" } ], "repeated": 0, "id": 6809 }, { "timestamp": "2026-05-29 01:05:17,899", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e9d0", "category": "filesystem", "api": "NtQueryDirectoryFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000043c" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe3\\xf6\\xdf!\\xe4\\xac\\xd5\\x01\\xda\\xba\\xb05\\x07\\xef\\xdc\\x01\\x00\\xc6\"KW\\xac\\xd5\\x01\\xbe7\\xc0\\xa1\\xb7\\xee\\xdc\\x01\\x00@\\x03\\x00\\x00\\x00\\x00\\x00\\x00@\\x03\\x00\\x00\\x00\\x00\\x00 \\x00\\x00\\x00$\\x00\\x00\\x00t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\xfd\\x00\\x00\\x00\\x00\\x01\\x00p\\x00o\\x00w\\x00e\\x00r\\x00s\\x00h\\x00e\\x00l\\x00l\\x00_\\x00i\\x00s\\x00e\\x00.\\x00e\\x00x\\x00e\\x00" }, { "name": "FileName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell_ise.exe" }, { "name": "FileInformationClass", "value": "37", "pretty_value": "FileIdBothDirectoryInformation" } ], "repeated": 0, "id": 6810 }, { "timestamp": "2026-05-29 01:05:17,899", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e9d0", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000043c" } ], "repeated": 0, "id": 6811 }, { "timestamp": "2026-05-29 01:05:17,899", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e9d0", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 6812 }, { "timestamp": "2026-05-29 01:05:17,899", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e9d0", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "Handle", "value": "0x0000043c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 6813 }, { "timestamp": "2026-05-29 01:05:17,899", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e9d0", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000043c" }, { "name": "SubKey", "value": "{528c102f-0000-0000-0000-300300000000}\\" }, { "name": "Handle", "value": "0x00000414" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\" } ], "repeated": 0, "id": 6814 }, { "timestamp": "2026-05-29 01:05:17,899", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e9d0", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000043c" } ], "repeated": 0, "id": 6815 }, { "timestamp": "2026-05-29 01:05:17,899", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e9d0", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000414" }, { "name": "ValueName", "value": "Generation" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation" } ], "repeated": 0, "id": 6816 }, { "timestamp": "2026-05-29 01:05:17,899", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e9d0", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000414" } ], "repeated": 0, "id": 6817 }, { "timestamp": "2026-05-29 01:05:17,899", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e9d0", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000410" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 6818 }, { "timestamp": "2026-05-29 01:05:17,899", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e9d0", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000410" }, { "name": "HandleName", "value": "C:\\" }, { "name": "FileInformationClass", "value": "9", "pretty_value": "FileNameInformation" }, { "name": "FileInformation", "value": "\\x02\\x00\\x00\\x00\\\\x00" } ], "repeated": 0, "id": 6819 }, { "timestamp": "2026-05-29 01:05:17,899", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e9d0", "category": "filesystem", "api": "GetVolumeInformationByHandleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Handle", "value": "0x00000410" }, { "name": "VolumeName", "value": "" }, { "name": "VolumeSerial", "value": "0xb34c3674" } ], "repeated": 0, "id": 6820 }, { "timestamp": "2026-05-29 01:05:17,899", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e9d0", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000410" } ], "repeated": 0, "id": 6821 }, { "timestamp": "2026-05-29 01:05:17,899", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e9d0", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000410" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell_ise.exe" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6822 }, { "timestamp": "2026-05-29 01:05:17,899", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e9d0", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000410" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell_ise.exe" }, { "name": "FileInformationClass", "value": "34", "pretty_value": "FileNetworkOpenInformation" }, { "name": "FileInformation", "value": "\\xe3\\xf6\\xdf!\\xe4\\xac\\xd5\\x01\\xb5\\xc2\\xb05\\x07\\xef\\xdc\\x01\\x00\\xc6\"KW\\xac\\xd5\\x01\\xbe7\\xc0\\xa1\\xb7\\xee\\xdc\\x01\\x00@\\x03\\x00\\x00\\x00\\x00\\x00\\x00@\\x03\\x00\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 6823 }, { "timestamp": "2026-05-29 01:05:17,899", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e9d0", "category": "device", "api": "DeviceIoControl", "status": true, "return": "0x00000001", "arguments": [ { "name": "DeviceHandle", "value": "0x00000410" }, { "name": "IoControlCode", "value": "0x000900c0" }, { "name": "InBuffer", "value": "" }, { "name": "OutBuffer", "value": "\\xbc\\xd7\\xa7\\x1c\\xe4Z\\xf1\\x11\\xae'RT\\x00\\x88\\x98^\nfB\\xd59\\xbe\\xebJ\\x92$Gl\\xf0\\xf7\\x89K\\xbc\\xd7\\xa7\\x1c\\xe4Z\\xf1\\x11\\xae'RT\\x00\\x88\\x98^\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 6824 }, { "timestamp": "2026-05-29 01:05:17,899", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e9d0", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc00000ba", "pretty_return": "FILE_IS_A_DIRECTORY", "arguments": [ { "name": "FileHandle", "value": "0x1f5c1cf0000" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 6825 }, { "timestamp": "2026-05-29 01:05:17,899", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e9d0", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000438" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6826 }, { "timestamp": "2026-05-29 01:05:17,899", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e9d0", "category": "device", "api": "DeviceIoControl", "status": false, "return": "0x00000000", "arguments": [ { "name": "DeviceHandle", "value": "0x00000438" }, { "name": "IoControlCode", "value": "0x000900a8", "pretty_value": "FSCTL_GET_REPARSE_POINT" }, { "name": "InBuffer", "value": "" }, { "name": "OutBuffer", "value": "\\xe0\\xe5\\xec\\x11l\\x00\\x00\\x00\\x10\\xe6\\xec\\x11l\\x00\\x00\\x00\\x80\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\xba\\x00\\x00\\xc0\\xff\\xff\\xff\\xff\\xbc\\x02X:M`\\x00\\x00\\x08\\x82}\\x1a\\xff\\x7f\\x00\\x000\\xe1@\\xc0\\xf5\\x01\\x00\\x00\\xba\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\xeb\\xec\\x11l\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\xe6\\xec\\x11l\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfak}W\\xff\\x7f\\x00\\x00C\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\xe6\\xec\\x11l\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\xcf\\xc1\\xf5\\x01\\x00\\x00\\\\x00`\\x00\\xff\\x7f\\x00\\x000\\xe1@\\xc0\\xf5\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x00\\x00\\x00\\x00\\x00\\x00\\x004\\xc4\\x85\\x1a\\xff\\x7f\\x00\\x000\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe8\\xe5\\xec\\x11l\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 6827 }, { "timestamp": "2026-05-29 01:05:17,899", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e9d0", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000438" } ], "repeated": 0, "id": 6828 }, { "timestamp": "2026-05-29 01:05:17,899", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e9d0", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000438" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 6829 }, { "timestamp": "2026-05-29 01:05:17,899", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e9d0", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000438" } ], "repeated": 0, "id": 6830 }, { "timestamp": "2026-05-29 01:05:17,899", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e9d0", "category": "misc", "api": "GetComputerNameW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ComputerName", "value": "DESKTOP-74SUV8W" } ], "repeated": 0, "id": 6831 }, { "timestamp": "2026-05-29 01:05:17,899", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e9d0", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000410" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell_ise.exe" }, { "name": "FileInformationClass", "value": "9", "pretty_value": "FileNameInformation" }, { "name": "FileInformation", "value": "v\\x00\\x00\\x00\\\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00\\\\x00S\\x00y\\x00s\\x00t\\x00e\\x00m\\x003\\x002\\x00\\\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00P\\x00o\\x00w\\x00e\\x00r\\x00S\\x00h\\x00e\\x00l\\x00l\\x00\\\\x00v\\x001\\x00.\\x000\\x00\\\\x00p\\x00o\\x00w\\x00e\\x00r\\x00s\\x00h\\x00e\\x00l\\x00l\\x00_\\x00i\\x00s\\x00e\\x00.\\x00e\\x00x\\x00e\\x00" } ], "repeated": 0, "id": 6832 }, { "timestamp": "2026-05-29 01:05:17,899", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e9d0", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000438" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\MountPointManager" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6833 }, { "timestamp": "2026-05-29 01:05:17,899", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e9d0", "category": "device", "api": "DeviceIoControl", "status": true, "return": "0x00000001", "arguments": [ { "name": "DeviceHandle", "value": "0x00000438" }, { "name": "IoControlCode", "value": "0x006d0008", "pretty_value": "IOCTL_MOUNTMGR_QUERY_POINTS" }, { "name": "InBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00.\\x00\\x00\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00" }, { "name": "OutBuffer", "value": "\\xee\\x00\\x00\\x00\\x02\\x00\\x00\\x00r\\x00\\x00\\x00\\x1c\\x00\\x00\\x008\\x00\\x00\\x00\\x0c\\x00\\x00\\x00D\\x00\\x00\\x00.\\x00\\x00\\x00\\x8e\\x00\\x00\\x00`\\x00\\x00\\x008\\x00\\x00\\x00\\x0c\\x00\\x00\\x00D\\x00\\x00\\x00.\\x00\\x00\\x00/\\x10\\x8cR\\x00\\x000\\x03\\x00\\x00\\x00\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00\\\\x00D\\x00o\\x00s\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00s\\x00\\\\x00C\\x00:\\x00\\\\x00?\\x00?\\x00\\\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00{\\x005\\x002\\x008\\x00c\\x001\\x000\\x002\\x00f\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x003\\x000\\x000\\x003\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x00}\\x00" } ], "repeated": 0, "id": 6834 }, { "timestamp": "2026-05-29 01:05:17,899", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e9d0", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000438" } ], "repeated": 0, "id": 6835 }, { "timestamp": "2026-05-29 01:05:17,899", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e9d0", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000410" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell_ise.exe" }, { "name": "FileInformationClass", "value": "48", "pretty_value": "FileNetworkPhysicalNameInformation" }, { "name": "FileInformation", "value": "v\\x00\\x00\\x00\\\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00\\\\x00S\\x00y\\x00s\\x00t\\x00e\\x00m\\x003\\x002\\x00\\\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00P\\x00o\\x00w\\x00e\\x00r\\x00S\\x00h\\x00e\\x00l\\x00l\\x00\\\\x00v\\x001\\x00.\\x000\\x00\\\\x00p\\x00o\\x00w\\x00e\\x00r\\x00s\\x00h\\x00e\\x00l\\x00l\\x00_\\x00i\\x00s\\x00e\\x00.\\x00e\\x00x\\x00e\\x00" } ], "repeated": 0, "id": 6836 }, { "timestamp": "2026-05-29 01:05:17,899", "thread_id": "9696", "caller": "0x7ff7e415ede1", "parentcaller": "0x7ff7e415e9d0", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000410" } ], "repeated": 0, "id": 6837 }, { "timestamp": "2026-05-29 01:05:17,899", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced" }, { "name": "Handle", "value": "0x00000410" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced" } ], "repeated": 0, "id": 6838 }, { "timestamp": "2026-05-29 01:05:17,899", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000410" }, { "name": "ValueName", "value": "Start_TrackDocs" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Start_TrackDocs" } ], "repeated": 0, "id": 6839 }, { "timestamp": "2026-05-29 01:05:17,899", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000410" } ], "repeated": 0, "id": 6840 }, { "timestamp": "2026-05-29 01:05:17,899", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced" }, { "name": "Handle", "value": "0x00000410" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced" } ], "repeated": 0, "id": 6841 }, { "timestamp": "2026-05-29 01:05:17,899", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000410" }, { "name": "ValueName", "value": "Start_TrackDocs" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Start_TrackDocs" } ], "repeated": 0, "id": 6842 }, { "timestamp": "2026-05-29 01:05:17,899", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000410" } ], "repeated": 0, "id": 6843 }, { "timestamp": "2026-05-29 01:05:17,899", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "93" }, { "name": "ProcessInformation", "value": "\\x7f7\\x9e}" } ], "repeated": 0, "id": 6844 }, { "timestamp": "2026-05-29 01:05:17,899", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "policymanager.dll" } ], "repeated": 0, "id": 6845 }, { "timestamp": "2026-05-29 01:05:17,899", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\policymanager.dll" } ], "repeated": 0, "id": 6846 }, { "timestamp": "2026-05-29 01:05:17,899", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000410" }, { "name": "DesiredAccess", "value": "0x00100021", "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\policymanager.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 6847 }, { "timestamp": "2026-05-29 01:05:17,899", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000438" }, { "name": "DesiredAccess", "value": "0x0000000d", "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x00000410" }, { "name": "FileName", "value": "C:\\Windows\\System32\\policymanager.dll" } ], "repeated": 0, "id": 6848 }, { "timestamp": "2026-05-29 01:05:17,899", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000438" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff522d0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x000a1000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6849 }, { "timestamp": "2026-05-29 01:05:17,899", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5236e000" }, { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6850 }, { "timestamp": "2026-05-29 01:05:17,899", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff52348000" }, { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6851 }, { "timestamp": "2026-05-29 01:05:17,899", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff52348000" }, { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6852 }, { "timestamp": "2026-05-29 01:05:17,899", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff52348000" }, { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6853 }, { "timestamp": "2026-05-29 01:05:17,899", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff52348000" }, { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6854 }, { "timestamp": "2026-05-29 01:05:17,899", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff52348000" }, { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6855 }, { "timestamp": "2026-05-29 01:05:17,899", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "msvcp110_win.dll" } ], "repeated": 0, "id": 6856 }, { "timestamp": "2026-05-29 01:05:17,899", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000438" } ], "repeated": 0, "id": 6857 }, { "timestamp": "2026-05-29 01:05:17,899", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000410" } ], "repeated": 0, "id": 6858 }, { "timestamp": "2026-05-29 01:05:17,899", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\msvcp110_win.dll" } ], "repeated": 0, "id": 6859 }, { "timestamp": "2026-05-29 01:05:17,899", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000410" }, { "name": "DesiredAccess", "value": "0x00100021", "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\msvcp110_win.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 6860 }, { "timestamp": "2026-05-29 01:05:17,899", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000438" }, { "name": "DesiredAccess", "value": "0x0000000d", "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x00000410" }, { "name": "FileName", "value": "C:\\Windows\\System32\\msvcp110_win.dll" } ], "repeated": 0, "id": 6861 }, { "timestamp": "2026-05-29 01:05:17,899", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000438" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff566c0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x0008a000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6862 }, { "timestamp": "2026-05-29 01:05:17,899", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5670d000" }, { "name": "ModuleName", "value": "msvcp110_win.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6863 }, { "timestamp": "2026-05-29 01:05:17,899", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5670d000" }, { "name": "ModuleName", "value": "msvcp110_win.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6864 }, { "timestamp": "2026-05-29 01:05:17,899", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5670d000" }, { "name": "ModuleName", "value": "msvcp110_win.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6865 }, { "timestamp": "2026-05-29 01:05:17,899", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5670d000" }, { "name": "ModuleName", "value": "msvcp110_win.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6866 }, { "timestamp": "2026-05-29 01:05:17,899", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5670d000" }, { "name": "ModuleName", "value": "msvcp110_win.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6867 }, { "timestamp": "2026-05-29 01:05:17,899", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000438" } ], "repeated": 0, "id": 6868 }, { "timestamp": "2026-05-29 01:05:17,899", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000410" } ], "repeated": 0, "id": 6869 }, { "timestamp": "2026-05-29 01:05:17,899", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff52348000" }, { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6870 }, { "timestamp": "2026-05-29 01:05:17,899", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "35" }, { "name": "ProcessInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\r\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x19\\x00/C\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00P\\x001\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00Users\\x02\\x00\\x00\\x00\\x00\\x04\\x00\\xef\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00.\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00U\\x02\\x00\\x00\\x00\\x00r\\x00s\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00dmin\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xbe\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00a\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 6871 }, { "timestamp": "2026-05-29 01:05:17,899", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5670d000" }, { "name": "ModuleName", "value": "msvcp110_win.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6872 }, { "timestamp": "2026-05-29 01:05:17,899", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\msvcp110_win" }, { "name": "DllBase", "value": "0x7fff566c0000" } ], "repeated": 0, "id": 6873 }, { "timestamp": "2026-05-29 01:05:17,899", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\policymanager" }, { "name": "DllBase", "value": "0x7fff522d0000" } ], "repeated": 0, "id": 6874 }, { "timestamp": "2026-05-29 01:05:17,899", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\msvcp110_win" }, { "name": "BaseAddress", "value": "0x7fff566c0000" }, { "name": "InitRoutine", "value": "0x7fff56705870" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 6875 }, { "timestamp": "2026-05-29 01:05:17,899", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\policymanager" }, { "name": "BaseAddress", "value": "0x7fff522d0000" }, { "name": "InitRoutine", "value": "0x7fff522d9ed0" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 6876 }, { "timestamp": "2026-05-29 01:05:17,899", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e86000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6877 }, { "timestamp": "2026-05-29 01:05:17,899", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e86000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6878 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5236e000" }, { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6879 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5236e000" }, { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6880 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\default\\Start\\HideRecentJumplists" }, { "name": "Handle", "value": "0x00000410" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Start\\HideRecentJumplists" } ], "repeated": 0, "id": 6881 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000410" }, { "name": "ValueName", "value": "PolicyType" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Start\\HideRecentJumplists\\PolicyType" } ], "repeated": 0, "id": 6882 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000410" }, { "name": "ValueName", "value": "Behavior" }, { "name": "Data", "value": "139312" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Start\\HideRecentJumplists\\Behavior" } ], "repeated": 0, "id": 6883 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000410" }, { "name": "ValueName", "value": "MergeAlgorithm" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Start\\HideRecentJumplists\\MergeAlgorithm" } ], "repeated": 0, "id": 6884 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000410" }, { "name": "ValueName", "value": "RegKeyPathRedirectMapped" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Start\\HideRecentJumplists\\RegKeyPathRedirectMapped" } ], "repeated": 0, "id": 6885 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000410" }, { "name": "ValueName", "value": "RegKeyPathRedirect" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Start\\HideRecentJumplists\\RegKeyPathRedirect" } ], "repeated": 0, "id": 6886 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000410" }, { "name": "ValueName", "value": "grouppolicyname" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Start\\HideRecentJumplists\\grouppolicyname" } ], "repeated": 0, "id": 6887 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5236e000" }, { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6888 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5236e000" }, { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6889 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000410" }, { "name": "ValueName", "value": "grouppolicyname" }, { "name": "Data", "value": "NoRecentDocsHistory" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Start\\HideRecentJumplists\\grouppolicyname" } ], "repeated": 0, "id": 6890 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000410" }, { "name": "ValueName", "value": "grouppolicypath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Start\\HideRecentJumplists\\grouppolicypath" } ], "repeated": 0, "id": 6891 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000410" }, { "name": "ValueName", "value": "grouppolicypath" }, { "name": "Data", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Start\\HideRecentJumplists\\grouppolicypath" } ], "repeated": 0, "id": 6892 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000410" }, { "name": "ValueName", "value": "grouppolicyismultisz" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Start\\HideRecentJumplists\\grouppolicyismultisz" } ], "repeated": 0, "id": 6893 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000410" }, { "name": "ValueName", "value": "grouppolicymultiszSeparatorChar" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Start\\HideRecentJumplists\\grouppolicymultiszSeparatorChar" } ], "repeated": 0, "id": 6894 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000410" }, { "name": "ValueName", "value": "ADMXMetadataUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Start\\HideRecentJumplists\\ADMXMetadataUser" } ], "repeated": 0, "id": 6895 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000410" }, { "name": "ValueName", "value": "ADMXMetadataDevice" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Start\\HideRecentJumplists\\ADMXMetadataDevice" } ], "repeated": 0, "id": 6896 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000410" }, { "name": "ValueName", "value": "ADMXMetadataBoth" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Start\\HideRecentJumplists\\ADMXMetadataBoth" } ], "repeated": 0, "id": 6897 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000410" }, { "name": "ValueName", "value": "30Value" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Start\\HideRecentJumplists\\30Value" } ], "repeated": 0, "id": 6898 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000410" }, { "name": "ValueName", "value": "Value" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Start\\HideRecentJumplists\\Value" } ], "repeated": 0, "id": 6899 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000410" } ], "repeated": 0, "id": 6900 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000410" } ], "repeated": 0, "id": 6901 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 6902 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x003A\\xc0\\xf5\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\\\x00W\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00" } ], "repeated": 0, "id": 6903 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000410" } ], "repeated": 1, "id": 6904 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000444" } ], "repeated": 0, "id": 6905 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000444" } ], "repeated": 0, "id": 6906 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 6907 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80(A\\xc0\\xf5\\x01\\x00\\x00\\x00\\x00\\x00\\x00u\\x00n\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00" } ], "repeated": 0, "id": 6908 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000444" } ], "repeated": 0, "id": 6909 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xf0\\xf4\\xec\\x11l\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf5\\x01\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00D\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x009\\xc0\\xf5\\x01\\x00\\x00\\xe0\\xf5\\xec\\x11l\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 6910 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000444" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 6911 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000444" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 6912 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000444" } ], "repeated": 0, "id": 6913 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\current\\S-1-5-21-3968686040-3210279463-847977608-1001\\Start" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\S-1-5-21-3968686040-3210279463-847977608-1001\\Start" } ], "repeated": 1, "id": 6914 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000444" } ], "repeated": 0, "id": 6915 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000410" } ], "repeated": 0, "id": 6916 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000410" } ], "repeated": 0, "id": 6917 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 6918 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80+A\\xc0\\xf5\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00" } ], "repeated": 0, "id": 6919 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000410" } ], "repeated": 0, "id": 6920 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xf6\\xec\\x11l\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf5\\x01\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\x10\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x009\\xc0\\xf5\\x01\\x00\\x00\\x10\\xf7\\xec\\x11l\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 6921 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000410" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 6922 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000410" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 6923 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000410" } ], "repeated": 0, "id": 6924 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\default\\Start\\HideRecentJumplists" }, { "name": "Handle", "value": "0x00000410" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Start\\HideRecentJumplists" } ], "repeated": 0, "id": 6925 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000410" }, { "name": "ValueName", "value": "PolicyType" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Start\\HideRecentJumplists\\PolicyType" } ], "repeated": 0, "id": 6926 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000410" }, { "name": "ValueName", "value": "Behavior" }, { "name": "Data", "value": "139312" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Start\\HideRecentJumplists\\Behavior" } ], "repeated": 0, "id": 6927 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000410" }, { "name": "ValueName", "value": "MergeAlgorithm" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Start\\HideRecentJumplists\\MergeAlgorithm" } ], "repeated": 0, "id": 6928 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000410" }, { "name": "ValueName", "value": "RegKeyPathRedirectMapped" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Start\\HideRecentJumplists\\RegKeyPathRedirectMapped" } ], "repeated": 0, "id": 6929 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000410" }, { "name": "ValueName", "value": "RegKeyPathRedirect" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Start\\HideRecentJumplists\\RegKeyPathRedirect" } ], "repeated": 0, "id": 6930 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000410" }, { "name": "ValueName", "value": "grouppolicyname" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Start\\HideRecentJumplists\\grouppolicyname" } ], "repeated": 0, "id": 6931 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000410" }, { "name": "ValueName", "value": "grouppolicyname" }, { "name": "Data", "value": "NoRecentDocsHistory" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Start\\HideRecentJumplists\\grouppolicyname" } ], "repeated": 0, "id": 6932 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000410" }, { "name": "ValueName", "value": "grouppolicypath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Start\\HideRecentJumplists\\grouppolicypath" } ], "repeated": 0, "id": 6933 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000410" }, { "name": "ValueName", "value": "grouppolicypath" }, { "name": "Data", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Start\\HideRecentJumplists\\grouppolicypath" } ], "repeated": 0, "id": 6934 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000410" }, { "name": "ValueName", "value": "grouppolicyismultisz" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Start\\HideRecentJumplists\\grouppolicyismultisz" } ], "repeated": 0, "id": 6935 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000410" }, { "name": "ValueName", "value": "grouppolicymultiszSeparatorChar" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Start\\HideRecentJumplists\\grouppolicymultiszSeparatorChar" } ], "repeated": 0, "id": 6936 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000410" }, { "name": "ValueName", "value": "ADMXMetadataUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Start\\HideRecentJumplists\\ADMXMetadataUser" } ], "repeated": 0, "id": 6937 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000410" }, { "name": "ValueName", "value": "ADMXMetadataDevice" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Start\\HideRecentJumplists\\ADMXMetadataDevice" } ], "repeated": 0, "id": 6938 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000410" }, { "name": "ValueName", "value": "ADMXMetadataBoth" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Start\\HideRecentJumplists\\ADMXMetadataBoth" } ], "repeated": 0, "id": 6939 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000410" }, { "name": "ValueName", "value": "30Value" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Start\\HideRecentJumplists\\30Value" } ], "repeated": 0, "id": 6940 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000410" }, { "name": "ValueName", "value": "Value" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Start\\HideRecentJumplists\\Value" } ], "repeated": 0, "id": 6941 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000410" } ], "repeated": 0, "id": 6942 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "Handle", "value": "0x00000410" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 6943 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000410" }, { "name": "ValueName", "value": "NoRecentDocsHistory" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoRecentDocsHistory" } ], "repeated": 0, "id": 6944 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000410" } ], "repeated": 0, "id": 6945 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Start" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Start" } ], "repeated": 0, "id": 6946 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "Handle", "value": "0x00000410" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 6947 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000410" }, { "name": "ValueName", "value": "NoRecentDocsHistory" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoRecentDocsHistory" } ], "repeated": 0, "id": 6948 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ea4a", "parentcaller": "0x7ff7e415ed0b", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000410" } ], "repeated": 0, "id": 6949 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e4153ed6", "parentcaller": "0x7ff7e415ea7d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" } ], "repeated": 0, "id": 6950 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "filesystem", "api": "CreateDirectoryW", "status": false, "return": "0x00000000", "arguments": [ { "name": "DirectoryName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations" } ], "repeated": 0, "id": 6951 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e86000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6952 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e86000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6953 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000001c4" }, { "name": "HandleName", "value": "\\Device\\KsecDD" }, { "name": "IoControlCode", "value": "0x00390400" }, { "name": "InputBuffer", "value": "M<+\\x1a\\x00\\x00\\x02\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x06\\x00\\x00\\x00l\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "\\x01\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\xff\\xff\\xff\\xffP\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x98\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xffR\\x00N\\x00G\\x00\\x00\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00 \\x00P\\x00r\\x00i\\x00m\\x00i\\x00t\\x00i\\x00v\\x00e\\x00 \\x00P\\x00r\\x00o\\x00v\\x00i\\x00d\\x00e\\x00r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00b\\x00c\\x00r\\x00y\\x00p\\x00t\\x00p\\x00r\\x00i\\x00m\\x00i\\x00t\\x00i\\x00v\\x00e\\x00s\\x00.\\x00d\\x00l\\x00l\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 6954 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000001c4" }, { "name": "HandleName", "value": "\\Device\\KsecDD" }, { "name": "IoControlCode", "value": "0x00390400" }, { "name": "InputBuffer", "value": "M<+\\x1a\\x00\\x00\\x02\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\xf5\\x01\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x01\\x00\\x00\\x00\\x02\\x00\\x00\\x00R\\x00N\\x00G\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "\\x01\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00G\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x98\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xffR\\x00N\\x00G\\x00\\x00\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00 \\x00P\\x00r\\x00i\\x00m\\x00i\\x00t\\x00i\\x00v\\x00e\\x00 \\x00P\\x00r\\x00o\\x00v\\x00i\\x00d\\x00e\\x00r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00b\\x00c\\x00r\\x00y\\x00p\\x00t\\x00p\\x00r\\x00i\\x00m\\x00i\\x00t\\x00i\\x00v\\x00e\\x00s\\x00.\\x00d\\x00l\\x00l\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 6955 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\bcryptprimitives.dll" }, { "name": "BaseAddress", "value": "0x7fff57ef0000" } ], "repeated": 0, "id": 6956 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff57ef0000", "arguments": [ { "name": "lpLibFileName", "value": "C:\\Windows\\system32\\bcryptprimitives.dll" }, { "name": "dwFlags", "value": "0x00000000" } ], "repeated": 0, "id": 6957 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "bcryptPrimitives.dll" }, { "name": "ModuleHandle", "value": "0x7fff57ef0000" }, { "name": "FunctionName", "value": "GetRngInterface" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff57f10940" } ], "repeated": 0, "id": 6958 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "filesystem", "api": "NtQueryAttributesFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\VHST5SNBKLGDHAI8GQ3C.temp" } ], "repeated": 0, "id": 6959 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "MutexName", "value": "" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 6960 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000410" }, { "name": "DesiredAccess", "value": "0xc0100080", "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\VHST5SNBKLGDHAI8GQ3C.temp" }, { "name": "CreateDisposition", "value": "5", "pretty_value": "FILE_OVERWRITE_IF" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6961 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1f5c1d7a000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6962 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 6963 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 6964 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 6965 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" } ], "repeated": 0, "id": 6966 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 6967 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 6968 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" } ], "repeated": 1, "id": 6969 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 6970 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 6971 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 6972 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" } ], "repeated": 0, "id": 6973 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 6974 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 6975 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" } ], "repeated": 1, "id": 6976 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 6977 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 6978 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 6979 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" } ], "repeated": 0, "id": 6980 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 6981 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 6982 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" } ], "repeated": 1, "id": 6983 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 6984 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 6985 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 6986 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" } ], "repeated": 0, "id": 6987 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 6988 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 6989 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" } ], "repeated": 1, "id": 6990 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 6991 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 6992 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 6993 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" } ], "repeated": 0, "id": 6994 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 6995 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 6996 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" } ], "repeated": 1, "id": 6997 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 6998 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 6999 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7000 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" } ], "repeated": 0, "id": 7001 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7002 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7003 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" } ], "repeated": 1, "id": 7004 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 7005 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7006 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7007 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7008 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" } ], "repeated": 0, "id": 7009 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7010 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7011 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" } ], "repeated": 1, "id": 7012 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7013 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7014 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7015 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" } ], "repeated": 0, "id": 7016 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7017 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7018 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" } ], "repeated": 1, "id": 7019 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7020 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7021 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7022 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" } ], "repeated": 0, "id": 7023 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7024 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7025 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" } ], "repeated": 1, "id": 7026 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7027 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7028 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7029 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" } ], "repeated": 0, "id": 7030 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7031 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7032 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" } ], "repeated": 1, "id": 7033 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7034 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7035 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7036 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" } ], "repeated": 0, "id": 7037 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7038 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7039 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" } ], "repeated": 1, "id": 7040 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7041 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7042 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7043 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" } ], "repeated": 0, "id": 7044 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7045 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7046 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" } ], "repeated": 1, "id": 7047 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff58b12000" }, { "name": "ModuleName", "value": "SHLWAPI.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7048 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff58b12000" }, { "name": "ModuleName", "value": "SHLWAPI.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7049 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7050 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7051 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7052 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" } ], "repeated": 0, "id": 7053 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7054 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7055 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" } ], "repeated": 1, "id": 7056 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7057 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7058 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7059 }, { "timestamp": "2026-05-29 01:05:17,915", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" } ], "repeated": 0, "id": 7060 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7061 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7062 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" } ], "repeated": 1, "id": 7063 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7064 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7065 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7066 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" } ], "repeated": 0, "id": 7067 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7068 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7069 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" } ], "repeated": 1, "id": 7070 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7071 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7072 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7073 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" } ], "repeated": 0, "id": 7074 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7075 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7076 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" } ], "repeated": 1, "id": 7077 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7078 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7079 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7080 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" } ], "repeated": 0, "id": 7081 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7082 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7083 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" } ], "repeated": 1, "id": 7084 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7085 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7086 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7087 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" } ], "repeated": 0, "id": 7088 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7089 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7090 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" } ], "repeated": 1, "id": 7091 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7092 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7093 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7094 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" } ], "repeated": 0, "id": 7095 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7096 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7097 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" } ], "repeated": 1, "id": 7098 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7099 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7100 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7101 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" } ], "repeated": 0, "id": 7102 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7103 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7104 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" } ], "repeated": 1, "id": 7105 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7106 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7107 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7108 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" } ], "repeated": 0, "id": 7109 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7110 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7111 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" } ], "repeated": 1, "id": 7112 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7113 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7114 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7115 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" } ], "repeated": 0, "id": 7116 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7117 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7118 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" } ], "repeated": 1, "id": 7119 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7120 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7121 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7122 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" } ], "repeated": 0, "id": 7123 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7124 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7125 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" } ], "repeated": 1, "id": 7126 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7127 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7128 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7129 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" } ], "repeated": 0, "id": 7130 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7131 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7132 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" } ], "repeated": 1, "id": 7133 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7134 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7135 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7136 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" } ], "repeated": 0, "id": 7137 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7138 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7139 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" } ], "repeated": 1, "id": 7140 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7141 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7142 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7143 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" } ], "repeated": 0, "id": 7144 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7145 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7146 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" } ], "repeated": 1, "id": 7147 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7148 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7149 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7150 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" } ], "repeated": 0, "id": 7151 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7152 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7153 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" } ], "repeated": 1, "id": 7154 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7155 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7156 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7157 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" } ], "repeated": 0, "id": 7158 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7159 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7160 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" } ], "repeated": 1, "id": 7161 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7162 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7163 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7164 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" } ], "repeated": 0, "id": 7165 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7166 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7167 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" } ], "repeated": 1, "id": 7168 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7169 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7170 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7171 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" } ], "repeated": 0, "id": 7172 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7173 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7174 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7175 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" } ], "repeated": 0, "id": 7176 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000410" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\VHST5SNBKLGDHAI8GQ3C.temp" }, { "name": "Buffer", "value": "\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x14\\x02\\x00\\x00\\x00\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00FL\\x00\\x00\\x00\\x01\\x14\\x02\\x00\\x00\\x00\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00F\\xc3 \\xa0\\x00 \\x00\\x00\\x00\\\\xbd\\xd6\\x9c\\xb6\\xee\\xdc\\x01\\x94\\xee\\xb46\\x07\\xef\\xdc\\x01z\\xe4:{\\xde\\xac\\xd5\\x01\\xeb\t\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb6\\x03:\\x00\\x1fDG\\x1a\\x03Yr?\\xa7D\\x89\\xc5U\\x95\\xfek0\\xee&\\x00\\x01\\x00&\\x00\\xef\\xbe\\x10\\x00\\x00\\x00\\xf4a\\xd0\\x9c\\xb6\\xee\\xdc\\x01\\xfa\\xea\\x96k\\x05\\xef\\xdc\\x01\\xef.\\xbe6\\x07\\xef\\xdc\\x01\\x14\\x00\\x82\\x00t\\x00\\x1c\\x00CFSF\\x16\\x001\\x00\\x00\\x00\\x00\\x00\\xbc\\\\x8a{\\x12\\x00AppData\\x00\\x00\\x00t\\x1aY^\\x96\\xdf\\xd3H\\x8dg\\x173\\xbc\\xee(\\xba\\xc5\\xcd\\xfa\\xdf\\x9fgVA\\x89G\\xc5\\xc7k\\xc0\\xb6\\x7f@\\x00\t\\x00\\x04\\x00\\xef\\xbe\\xbc\\\\x8a{\\xbd\\t\\x05.\\x00" }, { "name": "Length", "value": "4096" } ], "repeated": 0, "id": 7177 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7178 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7179 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" } ], "repeated": 1, "id": 7180 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7181 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7182 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" } ], "repeated": 1, "id": 7183 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7184 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7185 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7186 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" } ], "repeated": 0, "id": 7187 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7188 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7189 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" } ], "repeated": 1, "id": 7190 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7191 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7192 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7193 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" } ], "repeated": 0, "id": 7194 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7195 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7196 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" } ], "repeated": 1, "id": 7197 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7198 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7199 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7200 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" } ], "repeated": 0, "id": 7201 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7202 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7203 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" } ], "repeated": 1, "id": 7204 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7205 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7206 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7207 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" } ], "repeated": 0, "id": 7208 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7209 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7210 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" } ], "repeated": 1, "id": 7211 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7212 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7213 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7214 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" } ], "repeated": 0, "id": 7215 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7216 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7217 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" } ], "repeated": 1, "id": 7218 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7219 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7220 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7221 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" } ], "repeated": 0, "id": 7222 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7223 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7224 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" } ], "repeated": 1, "id": 7225 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7226 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7227 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7228 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" } ], "repeated": 0, "id": 7229 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7230 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7231 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" } ], "repeated": 1, "id": 7232 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7233 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7234 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7235 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" } ], "repeated": 0, "id": 7236 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7237 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7238 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" } ], "repeated": 1, "id": 7239 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7240 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7241 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7242 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" } ], "repeated": 0, "id": 7243 }, { "timestamp": "2026-05-29 01:05:17,930", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000410" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\VHST5SNBKLGDHAI8GQ3C.temp" }, { "name": "Buffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\x00o\\x00w\\x00e\\x00r\\x00s\\x00h\\x00e\\x00l\\x00l\\x00_\\x00i\\x00s\\x00e\\x00.\\x00e\\x00x\\x00e\\x00\\x00\\x00\"\\x00\\x00\\x00l\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x1c\\x00\\x00\\x00-\\x00\\x00\\x00\\x00\\x00\\x00\\x00k\\x00\\x00\\x00\\x11\\x00\\x00\\x00\\x03\\x00\\x00\\x00t6L\\xb3\\x10\\x00\\x00\\x00\\x00C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell_ise.exe\\x00\\x00?\\x00%\\x00s\\x00y\\x00s\\x00t\\x00e\\x00m\\x00r\\x00o\\x00o\\x00t\\x00%\\x00\\\\x00s\\x00y\\x00s\\x00t\\x00e\\x00m\\x003\\x002\\x00\\\\x00w\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00p\\x00o\\x00w\\x00e\\x00r\\x00s\\x00h\\x00e\\x00l\\x00l\\x00\\\\x00v\\x001\\x00.\\x000\\x00\\\\x00p" }, { "name": "Length", "value": "1345" } ], "repeated": 0, "id": 7244 }, { "timestamp": "2026-05-29 01:05:17,946", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7245 }, { "timestamp": "2026-05-29 01:05:17,946", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7246 }, { "timestamp": "2026-05-29 01:05:17,946", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" } ], "repeated": 1, "id": 7247 }, { "timestamp": "2026-05-29 01:05:17,946", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7248 }, { "timestamp": "2026-05-29 01:05:17,946", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000410" } ], "repeated": 0, "id": 7249 }, { "timestamp": "2026-05-29 01:05:17,946", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" } ], "repeated": 0, "id": 7250 }, { "timestamp": "2026-05-29 01:05:17,946", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" } ], "repeated": 0, "id": 7251 }, { "timestamp": "2026-05-29 01:05:17,946", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms" } ], "repeated": 0, "id": 7252 }, { "timestamp": "2026-05-29 01:05:17,946", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc0000061", "arguments": [ { "name": "FileHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x0113008a", "pretty_value": "FILE_WRITE_ACCESS|FILE_READ_EA|FILE_READ_ATTRIBUTES|DELETE|READ_CONTROL|SYNCHRONIZE|ACCESS_SYSTEM_SECURITY" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 7253 }, { "timestamp": "2026-05-29 01:05:17,946", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000374" }, { "name": "DesiredAccess", "value": "0x0013008a", "pretty_value": "FILE_WRITE_ACCESS|FILE_READ_EA|FILE_READ_ATTRIBUTES|DELETE|READ_CONTROL|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 7254 }, { "timestamp": "2026-05-29 01:05:17,946", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000410" }, { "name": "DesiredAccess", "value": "0xc01d0000", "pretty_value": "GENERIC_READ|GENERIC_WRITE|DELETE|WRITE_DAC|WRITE_OWNER|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\VHST5SNBKLGDHAI8GQ3C.temp" }, { "name": "ShareAccess", "value": "0" } ], "repeated": 0, "id": 7255 }, { "timestamp": "2026-05-29 01:05:17,946", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000374" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms" }, { "name": "FileInformationClass", "value": "4", "pretty_value": "FileBasicInformation" }, { "name": "FileInformation", "value": "\\xbe7\\xc0\\xa1\\xb7\\xee\\xdc\\x01\\xbfi\\xb46\\x07\\xef\\xdc\\x01\\xfa\\xe9\\x08[\\x05\\xef\\xdc\\x01\\xe6\\x12\n[\\x05\\xef\\xdc\\x01 \\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 7256 }, { "timestamp": "2026-05-29 01:05:17,946", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000410" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\VHST5SNBKLGDHAI8GQ3C.temp" }, { "name": "FileInformationClass", "value": "4", "pretty_value": "FileBasicInformation" }, { "name": "FileInformation", "value": "6\\x83\\xe66\\x07\\xef\\xdc\\x01Y\\xd2\\xe86\\x07\\xef\\xdc\\x01Y\\xd2\\xe86\\x07\\xef\\xdc\\x01Y\\xd2\\xe86\\x07\\xef\\xdc\\x01 \\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 7257 }, { "timestamp": "2026-05-29 01:05:17,946", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000410" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\VHST5SNBKLGDHAI8GQ3C.temp" }, { "name": "FileInformationClass", "value": "4", "pretty_value": "FileBasicInformation" }, { "name": "FileInformation", "value": "\\xbe7\\xc0\\xa1\\xb7\\xee\\xdc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 7258 }, { "timestamp": "2026-05-29 01:05:17,946", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57a6b000" }, { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7259 }, { "timestamp": "2026-05-29 01:05:17,946", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57a6b000" }, { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7260 }, { "timestamp": "2026-05-29 01:05:17,946", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "93" }, { "name": "ProcessInformation", "value": "\\x7f7\\x9e}" } ], "repeated": 0, "id": 7261 }, { "timestamp": "2026-05-29 01:05:17,946", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "ntmarta.dll" } ], "repeated": 0, "id": 7262 }, { "timestamp": "2026-05-29 01:05:17,946", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\ntmarta.dll" } ], "repeated": 0, "id": 7263 }, { "timestamp": "2026-05-29 01:05:17,946", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000438" }, { "name": "DesiredAccess", "value": "0x00100021", "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\ntmarta.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 7264 }, { "timestamp": "2026-05-29 01:05:17,946", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000440" }, { "name": "DesiredAccess", "value": "0x0000000d", "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x00000438" }, { "name": "FileName", "value": "C:\\Windows\\System32\\ntmarta.dll" } ], "repeated": 0, "id": 7265 }, { "timestamp": "2026-05-29 01:05:17,946", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000440" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff56770000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00033000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7266 }, { "timestamp": "2026-05-29 01:05:17,946", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff567a0000" }, { "name": "ModuleName", "value": "ntmarta.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7267 }, { "timestamp": "2026-05-29 01:05:17,946", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff56794000" }, { "name": "ModuleName", "value": "ntmarta.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7268 }, { "timestamp": "2026-05-29 01:05:17,946", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff56794000" }, { "name": "ModuleName", "value": "ntmarta.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7269 }, { "timestamp": "2026-05-29 01:05:17,946", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff56794000" }, { "name": "ModuleName", "value": "ntmarta.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7270 }, { "timestamp": "2026-05-29 01:05:17,946", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff56794000" }, { "name": "ModuleName", "value": "ntmarta.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7271 }, { "timestamp": "2026-05-29 01:05:17,946", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff56794000" }, { "name": "ModuleName", "value": "ntmarta.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7272 }, { "timestamp": "2026-05-29 01:05:17,946", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000440" } ], "repeated": 0, "id": 7273 }, { "timestamp": "2026-05-29 01:05:17,946", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000438" } ], "repeated": 0, "id": 7274 }, { "timestamp": "2026-05-29 01:05:17,946", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff56794000" }, { "name": "ModuleName", "value": "ntmarta.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7275 }, { "timestamp": "2026-05-29 01:05:17,946", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\ntmarta" }, { "name": "DllBase", "value": "0x7fff56770000" } ], "repeated": 0, "id": 7276 }, { "timestamp": "2026-05-29 01:05:17,946", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\ntmarta" }, { "name": "BaseAddress", "value": "0x7fff56770000" }, { "name": "InitRoutine", "value": "0x7fff56776930" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 7277 }, { "timestamp": "2026-05-29 01:05:17,946", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff59a6b000" }, { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7278 }, { "timestamp": "2026-05-29 01:05:17,946", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff59a6b000" }, { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7279 }, { "timestamp": "2026-05-29 01:05:17,946", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000374" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000045c" }, { "name": "Options", "value": "0x00000000" } ], "repeated": 0, "id": 7280 }, { "timestamp": "2026-05-29 01:05:17,946", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "filesystem", "api": "NtQueryInformationFile", "status": false, "return": "0xffffffffc000000d", "pretty_return": "INVALID_PARAMETER", "arguments": [ { "name": "FileHandle", "value": "0x0000045c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms" }, { "name": "FileInformationClass", "value": "55", "pretty_value": "FileReplaceCompletionInformation" }, { "name": "FileInformation", "value": "" } ], "repeated": 0, "id": 7281 }, { "timestamp": "2026-05-29 01:05:17,946", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000045c" } ], "repeated": 0, "id": 7282 }, { "timestamp": "2026-05-29 01:05:17,946", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000410" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000045c" }, { "name": "Options", "value": "0x00000000" } ], "repeated": 0, "id": 7283 }, { "timestamp": "2026-05-29 01:05:17,946", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "filesystem", "api": "NtQueryInformationFile", "status": false, "return": "0xffffffffc000000d", "pretty_return": "INVALID_PARAMETER", "arguments": [ { "name": "FileHandle", "value": "0x0000045c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\VHST5SNBKLGDHAI8GQ3C.temp" }, { "name": "FileInformationClass", "value": "55", "pretty_value": "FileReplaceCompletionInformation" }, { "name": "FileInformation", "value": "" } ], "repeated": 0, "id": 7284 }, { "timestamp": "2026-05-29 01:05:17,946", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000045c" } ], "repeated": 0, "id": 7285 }, { "timestamp": "2026-05-29 01:05:17,946", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000410" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000045c" }, { "name": "Options", "value": "0x00000000" } ], "repeated": 0, "id": 7286 }, { "timestamp": "2026-05-29 01:05:17,962", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "filesystem", "api": "NtQueryInformationFile", "status": false, "return": "0xffffffffc000000d", "pretty_return": "INVALID_PARAMETER", "arguments": [ { "name": "FileHandle", "value": "0x0000045c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\VHST5SNBKLGDHAI8GQ3C.temp" }, { "name": "FileInformationClass", "value": "55", "pretty_value": "FileReplaceCompletionInformation" }, { "name": "FileInformation", "value": "" } ], "repeated": 0, "id": 7287 }, { "timestamp": "2026-05-29 01:05:17,962", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000045c" } ], "repeated": 0, "id": 7288 }, { "timestamp": "2026-05-29 01:05:17,962", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000410" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000045c" }, { "name": "Options", "value": "0x00000000" } ], "repeated": 0, "id": 7289 }, { "timestamp": "2026-05-29 01:05:17,962", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000045c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\VHST5SNBKLGDHAI8GQ3C.temp" }, { "name": "FileInformationClass", "value": "4", "pretty_value": "FileBasicInformation" }, { "name": "FileInformation", "value": "\\xbe7\\xc0\\xa1\\xb7\\xee\\xdc\\x01Y\\xd2\\xe86\\x07\\xef\\xdc\\x01Y\\xd2\\xe86\\x07\\xef\\xdc\\x01\\xa34\\xeb6\\x07\\xef\\xdc\\x01 \\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 7290 }, { "timestamp": "2026-05-29 01:05:17,962", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x0000000a" }, { "name": "TokenHandle", "value": "0x00000460" } ], "repeated": 0, "id": 7291 }, { "timestamp": "2026-05-29 01:05:17,962", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000464" }, { "name": "DesiredAccess", "value": "0x00020000", "pretty_value": "READ_CONTROL" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 7292 }, { "timestamp": "2026-05-29 01:05:17,962", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "filesystem", "api": "NtQueryInformationFile", "status": false, "return": "0xffffffffc000000d", "pretty_return": "INVALID_PARAMETER", "arguments": [ { "name": "FileHandle", "value": "0x00000464" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations" }, { "name": "FileInformationClass", "value": "55", "pretty_value": "FileReplaceCompletionInformation" }, { "name": "FileInformation", "value": "" } ], "repeated": 0, "id": 7293 }, { "timestamp": "2026-05-29 01:05:17,962", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1f5c0424000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7294 }, { "timestamp": "2026-05-29 01:05:17,962", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000464" } ], "repeated": 0, "id": 7295 }, { "timestamp": "2026-05-29 01:05:17,962", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "filesystem", "api": "NtQueryInformationFile", "status": false, "return": "0xffffffffc000000d", "pretty_return": "INVALID_PARAMETER", "arguments": [ { "name": "FileHandle", "value": "0x0000045c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\VHST5SNBKLGDHAI8GQ3C.temp" }, { "name": "FileInformationClass", "value": "55", "pretty_value": "FileReplaceCompletionInformation" }, { "name": "FileInformation", "value": "" } ], "repeated": 0, "id": 7296 }, { "timestamp": "2026-05-29 01:05:17,962", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "S<\n\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 7297 }, { "timestamp": "2026-05-29 01:05:17,962", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "x\\x0cA\\xc0\\xf5\\x01\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 7298 }, { "timestamp": "2026-05-29 01:05:17,962", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\x00\\x17A\\xc0\\xf5\\x01\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00l\\x00\\x00\\x00" } ], "repeated": 0, "id": 7299 }, { "timestamp": "2026-05-29 01:05:17,962", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 7300 }, { "timestamp": "2026-05-29 01:05:17,962", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\x08hA\\xc0\\xf5\\x01\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 7301 }, { "timestamp": "2026-05-29 01:05:17,962", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 7302 }, { "timestamp": "2026-05-29 01:05:17,962", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\x98\\x13A\\xc0\\xf5\\x01\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 7303 }, { "timestamp": "2026-05-29 01:05:17,962", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x81\\x1a\\xff\\x7f\\x00\\x00\\xebPY\\x1a\\xff\\x7f\\x00\\x00\\x17\\xcdp\\x021p\\x00\\x00(N}\\x1a\\xff\\x7f\\x00\\x00\\xe0\\xec\\xec\\x11l\\x00\\x00\\x00\\xd8\\xec\\xec\\x11l\\x00\\x00\\x00\\xa8\\xec\\xec\\x11l\\x00\\x00\\x00\\xc8\\xec\\xec\\x11" } ], "repeated": 0, "id": 7304 }, { "timestamp": "2026-05-29 01:05:17,962", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x13A\\xc0\\xf5\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8Z\\x1a\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xc8\\xea\\xec\\x11l\\x00\\x00\\x00`\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2}\\x1a" } ], "repeated": 0, "id": 7305 }, { "timestamp": "2026-05-29 01:05:17,962", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000460" } ], "repeated": 0, "id": 7306 }, { "timestamp": "2026-05-29 01:05:17,962", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000045c" } ], "repeated": 0, "id": 7307 }, { "timestamp": "2026-05-29 01:05:17,962", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000374" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms" }, { "name": "FileInformationClass", "value": "22", "pretty_value": "FileStreamInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x0e\\x00\\x00\\x00A\\x15\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00:\\x00:\\x00$\\x00D\\x00A\\x00T\\x00A\\x00" } ], "repeated": 0, "id": 7308 }, { "timestamp": "2026-05-29 01:05:17,962", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "device", "api": "DeviceIoControl", "status": true, "return": "0x00000001", "arguments": [ { "name": "DeviceHandle", "value": "0x00000410" }, { "name": "IoControlCode", "value": "0x000900a0" }, { "name": "InBuffer", "value": "" }, { "name": "OutBuffer", "value": "" } ], "repeated": 0, "id": 7309 }, { "timestamp": "2026-05-29 01:05:17,962", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000374" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000045c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 7310 }, { "timestamp": "2026-05-29 01:05:17,962", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000460" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "FILE_READ_ACCESS" }, { "name": "ObjectAttributes", "value": "C:\\??" } ], "repeated": 0, "id": 7311 }, { "timestamp": "2026-05-29 01:05:17,962", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000464" } ], "repeated": 0, "id": 7312 }, { "timestamp": "2026-05-29 01:05:17,962", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000460" } ], "repeated": 0, "id": 7313 }, { "timestamp": "2026-05-29 01:05:17,962", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "misc", "api": "GetComputerNameW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ComputerName", "value": "DESKTOP-74SUV8W" } ], "repeated": 0, "id": 7314 }, { "timestamp": "2026-05-29 01:05:17,962", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "filesystem", "api": "NtSetInformationFile", "status": false, "return": "0xffffffffc00002f0", "arguments": [ { "name": "FileHandle", "value": "0x0000045c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms" }, { "name": "FileInformationClass", "value": "36", "pretty_value": "FileTrackingInformation" }, { "name": "FileInformation", "value": "\\x10\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00DESKTOP-74SUV8W\\x00\\x00\\x00\\x00\\x00|\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x06\\x02\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 7315 }, { "timestamp": "2026-05-29 01:05:17,962", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000045c" } ], "repeated": 0, "id": 7316 }, { "timestamp": "2026-05-29 01:05:17,962", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000045c" }, { "name": "DesiredAccess", "value": "0x40110080", "pretty_value": "GENERIC_WRITE|FILE_READ_ATTRIBUTES|DELETE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFad57.TMP" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "0" }, { "name": "FileAttributes", "value": "0x00000102", "pretty_value": "FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_TEMPORARY" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7317 }, { "timestamp": "2026-05-29 01:05:17,962", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000045c" } ], "repeated": 0, "id": 7318 }, { "timestamp": "2026-05-29 01:05:17,962", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000374" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms" }, { "name": "FileInformationClass", "value": "65" }, { "name": "FileInformation", "value": "\\x05\\x00\\x00\\x00\\xf5\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\\\x00?\\x00?\\x00\\\\x00C\\x00:\\x00\\\\x00U\\x00s\\x00e\\x00r\\x00s\\x00\\\\x00a\\x00d\\x00m\\x00i\\x00n\\x00\\\\x00A\\x00p\\x00p\\x00D\\x00a\\x00t\\x00a\\x00\\\\x00R\\x00o\\x00a\\x00m\\x00i\\x00n\\x00g\\x00\\\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00\\\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00\\\\x00R\\x00e\\x00c\\x00e\\x00n\\x00t\\x00\\\\x00C\\x00u\\x00s\\x00t\\x00o\\x00m\\x00D\\x00e\\x00s\\x00t\\x00i\\x00n\\x00a\\x00t\\x00i\\x00o\\x00n\\x00s\\x00\\\\x005\\x009\\x000\\x00a\\x00e\\x00e\\x007\\x00b\\x00d\\x00d\\x006\\x009\\x00b\\x005\\x009\\x00b\\x00.\\x00c\\x00u\\x00s\\x00t\\x00o\\x00m\\x00D\\x00e\\x00s\\x00t\\x00i\\x00n\\x00a\\x00t\\x00i\\x00o\\x00n\\x00s\\x00-\\x00m\\x00s\\x00~\\x00" } ], "repeated": 0, "id": 7319 }, { "timestamp": "2026-05-29 01:05:17,962", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000410" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\VHST5SNBKLGDHAI8GQ3C.temp" }, { "name": "FileInformationClass", "value": "65" }, { "name": "FileInformation", "value": "\\x05\\x00\\x00\\x00?\\x00\\\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xea\\x00\\x00\\x00\\\\x00?\\x00?\\x00\\\\x00C\\x00:\\x00\\\\x00U\\x00s\\x00e\\x00r\\x00s\\x00\\\\x00a\\x00d\\x00m\\x00i\\x00n\\x00\\\\x00A\\x00p\\x00p\\x00D\\x00a\\x00t\\x00a\\x00\\\\x00R\\x00o\\x00a\\x00m\\x00i\\x00n\\x00g\\x00\\\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00\\\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00\\\\x00R\\x00e\\x00c\\x00e\\x00n\\x00t\\x00\\\\x00C\\x00u\\x00s\\x00t\\x00o\\x00m\\x00D\\x00e\\x00s\\x00t\\x00i\\x00n\\x00a\\x00t\\x00i\\x00o\\x00n\\x00s\\x00\\\\x005\\x009\\x000\\x00a\\x00e\\x00e\\x007\\x00b\\x00d\\x00d\\x006\\x009\\x00b\\x005\\x009\\x00b\\x00.\\x00c\\x00u\\x00s\\x00t\\x00o\\x00m\\x00D\\x00e\\x00s\\x00t\\x00i\\x00n\\x00a\\x00t\\x00i\\x00o\\x00n\\x00s\\x00-\\x00m\\x00s\\x00P\\x00" } ], "repeated": 0, "id": 7320 }, { "timestamp": "2026-05-29 01:05:17,962", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" } ], "repeated": 0, "id": 7321 }, { "timestamp": "2026-05-29 01:05:17,977", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000410" } ], "repeated": 0, "id": 7322 }, { "timestamp": "2026-05-29 01:05:17,977", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "filesystem", "api": "DeleteFileW", "status": true, "return": "0x00000001", "arguments": [ { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFad57.TMP" } ], "repeated": 0, "id": 7323 }, { "timestamp": "2026-05-29 01:05:17,977", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" } ], "repeated": 0, "id": 7324 }, { "timestamp": "2026-05-29 01:05:17,977", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000430" } ], "repeated": 0, "id": 7325 }, { "timestamp": "2026-05-29 01:05:17,977", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000434" } ], "repeated": 0, "id": 7326 }, { "timestamp": "2026-05-29 01:05:18,008", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\wintypes" }, { "name": "DllBase", "value": "0x7fff52dc0000" } ], "repeated": 0, "id": 7327 }, { "timestamp": "2026-05-29 01:05:18,008", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\UMPDC" }, { "name": "DllBase", "value": "0x7fff57470000" } ], "repeated": 0, "id": 7328 }, { "timestamp": "2026-05-29 01:05:18,008", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\cryptsp" }, { "name": "DllBase", "value": "0x7fff56ef0000" } ], "repeated": 0, "id": 7329 }, { "timestamp": "2026-05-29 01:05:18,008", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtQuerySystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 12, "id": 7330 }, { "timestamp": "2026-05-29 01:05:18,024", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\dsreg" }, { "name": "DllBase", "value": "0x7fff52f20000" } ], "repeated": 0, "id": 7331 }, { "timestamp": "2026-05-29 01:05:18,024", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\cdp" }, { "name": "DllBase", "value": "0x7fff45dc0000" } ], "repeated": 0, "id": 7332 }, { "timestamp": "2026-05-29 01:05:18,024", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\TaskFlowDataEngine" }, { "name": "DllBase", "value": "0x7fff40b90000" } ], "repeated": 0, "id": 7333 }, { "timestamp": "2026-05-29 01:05:18,024", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\TaskFlowDataEngine.dll" }, { "name": "BaseAddress", "value": "0x7fff40b90000" } ], "repeated": 0, "id": 7334 }, { "timestamp": "2026-05-29 01:05:18,024", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "3237555C-C043-4836-AFDE-570D63E9EDAB" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "61AFCF6C-6597-4990-8E9B-E5DACD3BCB28" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 7335 }, { "timestamp": "2026-05-29 01:05:18,024", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x10\\x12l\\x00\\x00\\x00\\xfc+\\x00\\x00\\x00\\x00\\x00\\x00\\xe0%\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "9696" } ], "repeated": 0, "id": 7336 }, { "timestamp": "2026-05-29 01:05:18,024", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "threading", "api": "NtCreateThreadEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x0000045c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartAddress", "value": "0x7fff580853d0" }, { "name": "Parameter", "value": "0x1f5c1d785d0" }, { "name": "CreateFlags", "value": "0x00000001" }, { "name": "ThreadId", "value": "11564" }, { "name": "ProcessId", "value": "11260" }, { "name": "Module", "value": "SHCORE.dll" } ], "repeated": 0, "id": 7337 }, { "timestamp": "2026-05-29 01:05:18,024", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x0000045c", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x7fff580853d0" }, { "name": "Parameter", "value": "0x1f5c1d785d0" }, { "name": "CreationFlags", "value": "0x00000004" }, { "name": "ThreadId", "value": "11564" }, { "name": "ProcessId", "value": "11260" } ], "repeated": 0, "id": 7338 }, { "timestamp": "2026-05-29 01:05:18,024", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "threading", "api": "NtResumeThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x0000045c" }, { "name": "SuspendCount", "value": "1" }, { "name": "ThreadId", "value": "11564" }, { "name": "ProcessId", "value": "11260" } ], "repeated": 0, "id": 7339 }, { "timestamp": "2026-05-29 01:05:18,024", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000045c" } ], "repeated": 0, "id": 7340 }, { "timestamp": "2026-05-29 01:05:18,024", "thread_id": "11564", "caller": "0x7fff577b7861", "parentcaller": "0x7fff577b7530", "category": "device", "api": "NtDeviceIoControlFile", "status": false, "return": "0xffffffffc00700bb", "arguments": [ { "name": "FileHandle", "value": "0x00000054" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xebg\\x12l\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x98\\xebg\\x12l\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 7341 }, { "timestamp": "2026-05-29 01:05:18,024", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7342 }, { "timestamp": "2026-05-29 01:05:18,024", "thread_id": "11564", "caller": "0x7fff59fc507d", "parentcaller": "0x7fff59fc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7343 }, { "timestamp": "2026-05-29 01:05:18,024", "thread_id": "11564", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7fff580853d0" }, { "name": "Parameter", "value": "0x1f5c1d785d0" } ], "repeated": 0, "id": 7344 }, { "timestamp": "2026-05-29 01:05:18,024", "thread_id": "11564", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x11\\x12l\\x00\\x00\\x00\\xfc+\\x00\\x00\\x00\\x00\\x00\\x00,-\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "11564" } ], "repeated": 0, "id": 7345 }, { "timestamp": "2026-05-29 01:05:18,024", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" } ], "repeated": 0, "id": 7346 }, { "timestamp": "2026-05-29 01:05:18,024", "thread_id": "11564", "caller": "0x7fff577ce76a", "parentcaller": "0x7fff40b97c8d", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 7347 }, { "timestamp": "2026-05-29 01:05:18,024", "thread_id": "11564", "caller": "0x7fff577dac31", "parentcaller": "0x7fff40b97caa", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDisownModuleHeapAllocation" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fcfa30" } ], "repeated": 0, "id": 7348 }, { "timestamp": "2026-05-29 01:05:18,024", "thread_id": "11564", "caller": "0x7fff597a1630", "parentcaller": "0x7fff597a12cd", "category": "system", "api": "NtQuerySystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7349 }, { "timestamp": "2026-05-29 01:05:18,024", "thread_id": "11564", "caller": "0x7fff585741cf", "parentcaller": "0x7fff59f938c0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0000032A-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000149-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 7350 }, { "timestamp": "2026-05-29 01:05:18,024", "thread_id": "11564", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 7351 }, { "timestamp": "2026-05-29 01:05:18,024", "thread_id": "11564", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\OneCoreCommonProxyStub" }, { "name": "DllBase", "value": "0x7fff48780000" } ], "repeated": 0, "id": 7352 }, { "timestamp": "2026-05-29 01:05:18,024", "thread_id": "11564", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\OneCoreCommonProxyStub.dll" }, { "name": "BaseAddress", "value": "0x7fff48780000" } ], "repeated": 0, "id": 7353 }, { "timestamp": "2026-05-29 01:05:18,024", "thread_id": "11564", "caller": "0x7fff40c61194", "parentcaller": "0x7fff40c50aae", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "C2F03A33-21F5-47FA-B4BB-156362A2F239" }, { "name": "ClsContext", "value": "0x00000004", "pretty_value": "CLSCTX_LOCAL_SERVER" }, { "name": "riid", "value": "6D5140C1-7436-11CE-8034-00AA006009FA" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 7354 }, { "timestamp": "2026-05-29 01:05:18,024", "thread_id": "11564", "caller": "0x7fff597a1630", "parentcaller": "0x7fff597a12cd", "category": "system", "api": "NtQuerySystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7355 }, { "timestamp": "2026-05-29 01:05:18,024", "thread_id": "11564", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5987e000" }, { "name": "ModuleName", "value": "RPCRT4.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7356 }, { "timestamp": "2026-05-29 01:05:18,024", "thread_id": "11564", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5987e000" }, { "name": "ModuleName", "value": "RPCRT4.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7357 }, { "timestamp": "2026-05-29 01:05:18,024", "thread_id": "11564", "caller": "0x7fff59767be3", "parentcaller": "0x7fff597a15ab", "category": "system", "api": "NtQuerySystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7358 }, { "timestamp": "2026-05-29 01:05:18,024", "thread_id": "11564", "caller": "0x7fff59f93f7a", "parentcaller": "0x7fff59770ed7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 7359 }, { "timestamp": "2026-05-29 01:05:18,024", "thread_id": "11564", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff5854fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000266" }, { "name": "SubKey", "value": "Interface\\{AF86E2E0-B12D-4C6A-9C5A-D7AA65101E90}" }, { "name": "Handle", "value": "0x0000048e" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{AF86E2E0-B12D-4C6A-9C5A-D7AA65101E90}" } ], "repeated": 0, "id": 7360 }, { "timestamp": "2026-05-29 01:05:18,024", "thread_id": "11564", "caller": "0x7fff5854fa51", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000048e" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x00000492" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{AF86E2E0-B12D-4c6a-9C5A-D7AA65101E90}\\ProxyStubClsid32" } ], "repeated": 0, "id": 7361 }, { "timestamp": "2026-05-29 01:05:18,024", "thread_id": "11564", "caller": "0x7fff5854fa8c", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000492" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{00000320-0000-0000-C000-000000000046}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{AF86E2E0-B12D-4c6a-9C5A-D7AA65101E90}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 7362 }, { "timestamp": "2026-05-29 01:05:18,024", "thread_id": "11564", "caller": "0x7fff5854fad3", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000492" } ], "repeated": 0, "id": 7363 }, { "timestamp": "2026-05-29 01:05:18,024", "thread_id": "11564", "caller": "0x7fff5854fae4", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000048e" } ], "repeated": 0, "id": 7364 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "11564", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff5854fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000266" }, { "name": "SubKey", "value": "Interface\\{A629347B-7A47-4061-9C3E-8AC7C6F000A7}" }, { "name": "Handle", "value": "0x00000496" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{A629347B-7A47-4061-9C3E-8AC7C6F000A7}" } ], "repeated": 0, "id": 7365 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "11564", "caller": "0x7fff5854fa51", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000496" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x0000049a" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{A629347B-7A47-4061-9C3E-8AC7C6F000A7}\\ProxyStubClsid32" } ], "repeated": 0, "id": 7366 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "11564", "caller": "0x7fff5854fa8c", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000049a" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{A1DB7B5E-D0EA-4FE0-93C4-314505788272}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{A629347B-7A47-4061-9C3E-8AC7C6F000A7}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 7367 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "11564", "caller": "0x7fff5854fad3", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000049a" } ], "repeated": 0, "id": 7368 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "11564", "caller": "0x7fff5854fae4", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000496" } ], "repeated": 0, "id": 7369 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "11564", "caller": "0x7fff584d7b74", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000025e" }, { "name": "SubKey", "value": "CLSID\\{A1DB7B5E-D0EA-4FE0-93C4-314505788272}" }, { "name": "Handle", "value": "0x00000496" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{A1DB7B5E-D0EA-4FE0-93C4-314505788272}" } ], "repeated": 0, "id": 7370 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "11564", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000496" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{A1DB7B5E-D0EA-4FE0-93C4-314505788272}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 7371 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "11564", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000496" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 7372 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "11564", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xd6g\\x12l\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\x96\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00l\\x00\\x00\\x00\\x80\\xd7g\\x12l\\x00\\x00\\x00" } ], "repeated": 0, "id": 7373 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "11564", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{A1DB7B5E-D0EA-4FE0-93C4-314505788272}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{A1DB7B5E-D0EA-4FE0-93C4-314505788272}\\TreatAs" } ], "repeated": 0, "id": 7374 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "11564", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000496" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 7375 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "11564", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000496" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A1DB7B5E-D0EA-4FE0-93C4-314505788272}\\TreatAs" } ], "repeated": 0, "id": 7376 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "11564", "caller": "0x7fff585622e1", "parentcaller": "0x7fff584d7c1d", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000496" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{A1DB7B5E-D0EA-4FE0-93C4-314505788272}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 7377 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "11564", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d81f5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000496" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A1DB7B5E-D0EA-4FE0-93C4-314505788272}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 7378 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "11564", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000496" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A1DB7B5E-D0EA-4FE0-93C4-314505788272}\\(Default)" } ], "repeated": 0, "id": 7379 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "11564", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000496" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "PSFactoryBuffer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A1DB7B5E-D0EA-4FE0-93C4-314505788272}\\(Default)" } ], "repeated": 0, "id": 7380 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "11564", "caller": "0x7fff584d8485", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000496" }, { "name": "SubKey", "value": "InprocServer32" }, { "name": "Handle", "value": "0x0000049a" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A1DB7B5E-D0EA-4FE0-93C4-314505788272}\\InprocServer32" } ], "repeated": 0, "id": 7381 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "11564", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000049a" }, { "name": "ValueName", "value": "InprocServer32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A1DB7B5E-D0EA-4FE0-93C4-314505788272}\\InProcServer32\\InprocServer32" } ], "repeated": 0, "id": 7382 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "11564", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000049a" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A1DB7B5E-D0EA-4FE0-93C4-314505788272}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 7383 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "11564", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000049a" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "C:\\Windows\\System32\\TaskFlowDataEngine.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A1DB7B5E-D0EA-4FE0-93C4-314505788272}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 7384 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "11564", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d8d32", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000049a" }, { "name": "ValueName", "value": "ThreadingModel" }, { "name": "Data", "value": "Both" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A1DB7B5E-D0EA-4FE0-93C4-314505788272}\\InProcServer32\\ThreadingModel" } ], "repeated": 0, "id": 7385 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "11564", "caller": "0x7fff584d855f", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000049a" } ], "repeated": 0, "id": 7386 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "11564", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000496" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{A1DB7B5E-D0EA-4FE0-93C4-314505788272}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 7387 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "11564", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000496" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 7388 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "11564", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x10\\xd5g\\x12l\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\x96\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00l\\x00\\x00\\x00\\x10\\xd6g\\x12l\\x00\\x00\\x00" } ], "repeated": 0, "id": 7389 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "11564", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{A1DB7B5E-D0EA-4FE0-93C4-314505788272}\\InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{A1DB7B5E-D0EA-4FE0-93C4-314505788272}\\InprocHandler32" } ], "repeated": 0, "id": 7390 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "11564", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000496" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 7391 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "11564", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000496" }, { "name": "ObjectAttributesName", "value": "InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A1DB7B5E-D0EA-4FE0-93C4-314505788272}\\InprocHandler32" } ], "repeated": 0, "id": 7392 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "11564", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000496" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{A1DB7B5E-D0EA-4FE0-93C4-314505788272}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 7393 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "11564", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000496" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 7394 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "11564", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x10\\xd5g\\x12l\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\x96\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00l\\x00\\x00\\x00\\x10\\xd6g\\x12l\\x00\\x00\\x00" } ], "repeated": 0, "id": 7395 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "11564", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{A1DB7B5E-D0EA-4FE0-93C4-314505788272}\\InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{A1DB7B5E-D0EA-4FE0-93C4-314505788272}\\InprocHandler" } ], "repeated": 0, "id": 7396 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "11564", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000496" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 7397 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "11564", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000496" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A1DB7B5E-D0EA-4FE0-93C4-314505788272}\\InprocHandler" } ], "repeated": 0, "id": 7398 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "11564", "caller": "0x7fff584d8010", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000496" } ], "repeated": 0, "id": 7399 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "11564", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7400 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "11564", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000024c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7401 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "11564", "caller": "0x7fff584d7b74", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000025e" }, { "name": "SubKey", "value": "CLSID\\{A1DB7B5E-D0EA-4FE0-93C4-314505788272}" }, { "name": "Handle", "value": "0x00000496" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{A1DB7B5E-D0EA-4FE0-93C4-314505788272}" } ], "repeated": 0, "id": 7402 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "11564", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000496" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{A1DB7B5E-D0EA-4FE0-93C4-314505788272}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 7403 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "11564", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000496" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 7404 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "11564", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "@\\xd3g\\x12l\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\x96\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00l\\x00\\x00\\x00@\\xd4g\\x12l\\x00\\x00\\x00" } ], "repeated": 0, "id": 7405 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "11564", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{A1DB7B5E-D0EA-4FE0-93C4-314505788272}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{A1DB7B5E-D0EA-4FE0-93C4-314505788272}\\TreatAs" } ], "repeated": 0, "id": 7406 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "11564", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000496" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 7407 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "11564", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000496" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A1DB7B5E-D0EA-4FE0-93C4-314505788272}\\TreatAs" } ], "repeated": 0, "id": 7408 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "11564", "caller": "0x7fff585622e1", "parentcaller": "0x7fff584d7c1d", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000496" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{A1DB7B5E-D0EA-4FE0-93C4-314505788272}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 7409 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "11564", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1f5c0430000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7410 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "11564", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d81f5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000496" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A1DB7B5E-D0EA-4FE0-93C4-314505788272}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 7411 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "11564", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000496" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A1DB7B5E-D0EA-4FE0-93C4-314505788272}\\(Default)" } ], "repeated": 0, "id": 7412 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "11564", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000496" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "PSFactoryBuffer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A1DB7B5E-D0EA-4FE0-93C4-314505788272}\\(Default)" } ], "repeated": 0, "id": 7413 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "11564", "caller": "0x7fff584d8485", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000496" }, { "name": "SubKey", "value": "InprocServer32" }, { "name": "Handle", "value": "0x0000049a" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A1DB7B5E-D0EA-4FE0-93C4-314505788272}\\InprocServer32" } ], "repeated": 0, "id": 7414 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "11564", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000049a" }, { "name": "ValueName", "value": "InprocServer32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A1DB7B5E-D0EA-4FE0-93C4-314505788272}\\InProcServer32\\InprocServer32" } ], "repeated": 0, "id": 7415 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "11564", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000049a" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A1DB7B5E-D0EA-4FE0-93C4-314505788272}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 7416 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "11564", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000049a" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "C:\\Windows\\System32\\TaskFlowDataEngine.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A1DB7B5E-D0EA-4FE0-93C4-314505788272}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 7417 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "11564", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d8d32", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000049a" }, { "name": "ValueName", "value": "ThreadingModel" }, { "name": "Data", "value": "Both" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A1DB7B5E-D0EA-4FE0-93C4-314505788272}\\InProcServer32\\ThreadingModel" } ], "repeated": 0, "id": 7418 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "11564", "caller": "0x7fff584d855f", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000049a" } ], "repeated": 0, "id": 7419 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "11564", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000496" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{A1DB7B5E-D0EA-4FE0-93C4-314505788272}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 7420 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "11564", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000496" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 7421 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "11564", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xd0\\xd1g\\x12l\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\x96\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00l\\x00\\x00\\x00\\xd0\\xd2g\\x12l\\x00\\x00\\x00" } ], "repeated": 0, "id": 7422 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "11564", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{A1DB7B5E-D0EA-4FE0-93C4-314505788272}\\InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{A1DB7B5E-D0EA-4FE0-93C4-314505788272}\\InprocHandler32" } ], "repeated": 0, "id": 7423 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "11564", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000496" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 7424 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "11564", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000496" }, { "name": "ObjectAttributesName", "value": "InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A1DB7B5E-D0EA-4FE0-93C4-314505788272}\\InprocHandler32" } ], "repeated": 0, "id": 7425 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "11564", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000496" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{A1DB7B5E-D0EA-4FE0-93C4-314505788272}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 7426 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "11564", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000496" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 7427 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "11564", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xd0\\xd1g\\x12l\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\x96\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00l\\x00\\x00\\x00\\xd0\\xd2g\\x12l\\x00\\x00\\x00" } ], "repeated": 0, "id": 7428 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "11564", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{A1DB7B5E-D0EA-4FE0-93C4-314505788272}\\InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{A1DB7B5E-D0EA-4FE0-93C4-314505788272}\\InprocHandler" } ], "repeated": 0, "id": 7429 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "11564", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000496" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 7430 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "11564", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000496" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A1DB7B5E-D0EA-4FE0-93C4-314505788272}\\InprocHandler" } ], "repeated": 0, "id": 7431 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "11564", "caller": "0x7fff584dab08", "parentcaller": "0x7fff584da7d9", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000496" }, { "name": "SubKey", "value": "LocalServer32" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A1DB7B5E-D0EA-4FE0-93C4-314505788272}\\LocalServer32" } ], "repeated": 0, "id": 7432 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "11564", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584da825", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000496" }, { "name": "ValueName", "value": "AppID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A1DB7B5E-D0EA-4FE0-93C4-314505788272}\\AppID" } ], "repeated": 0, "id": 7433 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "11564", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000496" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{A1DB7B5E-D0EA-4FE0-93C4-314505788272}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 7434 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "11564", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000496" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 7435 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "11564", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x10\\xd1g\\x12l\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf}\\x1a\\xff\\x7f\\x00\\x00\\x96\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2}\\x1a\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00l\\x00\\x00\\x00\\x10\\xd2g\\x12l\\x00\\x00\\x00" } ], "repeated": 0, "id": 7436 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "11564", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{A1DB7B5E-D0EA-4FE0-93C4-314505788272}\\LocalServer" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{A1DB7B5E-D0EA-4FE0-93C4-314505788272}\\LocalServer" } ], "repeated": 0, "id": 7437 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "11564", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000496" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 7438 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "11564", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000496" }, { "name": "ObjectAttributesName", "value": "LocalServer" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A1DB7B5E-D0EA-4FE0-93C4-314505788272}\\LocalServer" } ], "repeated": 0, "id": 7439 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "11564", "caller": "0x7fff584dad16", "parentcaller": "0x7fff584d83b8", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000025e" }, { "name": "SubKey", "value": "CLSID\\{A1DB7B5E-D0EA-4FE0-93C4-314505788272}" }, { "name": "Handle", "value": "0x0000049a" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{A1DB7B5E-D0EA-4FE0-93C4-314505788272}" } ], "repeated": 0, "id": 7440 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "11564", "caller": "0x7fff584dad4d", "parentcaller": "0x7fff584d83b8", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x0000049a" }, { "name": "SubKey", "value": "Elevation" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A1DB7B5E-D0EA-4FE0-93C4-314505788272}\\Elevation" } ], "repeated": 0, "id": 7441 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "11564", "caller": "0x7fff584dadb1", "parentcaller": "0x7fff584d83b8", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000049a" } ], "repeated": 0, "id": 7442 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "11564", "caller": "0x7fff584d8010", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000496" } ], "repeated": 0, "id": 7443 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "11564", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff584d25e9", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000266" }, { "name": "SubKey", "value": "CLSID\\{A1DB7B5E-D0EA-4FE0-93C4-314505788272}" }, { "name": "Handle", "value": "0x00000496" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{A1DB7B5E-D0EA-4FE0-93C4-314505788272}" } ], "repeated": 0, "id": 7444 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "11564", "caller": "0x7fff5854f8f8", "parentcaller": "0x7fff584d213b", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000496" }, { "name": "SubKey", "value": "TreatAs" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A1DB7B5E-D0EA-4FE0-93C4-314505788272}\\TreatAs" } ], "repeated": 0, "id": 7445 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "11564", "caller": "0x7fff584d2160", "parentcaller": "0x7fff584c9277", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000496" } ], "repeated": 0, "id": 7446 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "11564", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7447 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "11564", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000024c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7448 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "11564", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1f5c0433000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7449 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "11564", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff5854fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000266" }, { "name": "SubKey", "value": "Interface\\{6405DFF2-9EEE-41C0-885E-034873207439}" }, { "name": "Handle", "value": "0x0000049e" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{6405DFF2-9EEE-41C0-885E-034873207439}" } ], "repeated": 0, "id": 7450 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "11564", "caller": "0x7fff5854fa51", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000049e" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x000004a2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{6405DFF2-9EEE-41C0-885E-034873207439}\\ProxyStubClsid32" } ], "repeated": 0, "id": 7451 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "11564", "caller": "0x7fff5854fa8c", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a2" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{A1DB7B5E-D0EA-4FE0-93C4-314505788272}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{6405DFF2-9EEE-41C0-885E-034873207439}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 7452 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "11564", "caller": "0x7fff5854fad3", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a2" } ], "repeated": 0, "id": 7453 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "11564", "caller": "0x7fff5854fae4", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000049e" } ], "repeated": 0, "id": 7454 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "11564", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7455 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "11564", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000024c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7456 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "11564", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x11\\x12l\\x00\\x00\\x00\\xfc+\\x00\\x00\\x00\\x00\\x00\\x00,-\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "11564" } ], "repeated": 0, "id": 7457 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "9696", "caller": "0x7fff557fb473", "parentcaller": "0x7fff557fb3c3", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "18" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 7458 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "20" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 7459 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000498" } ], "repeated": 0, "id": 7460 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "11564", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff58117000" }, { "name": "ModuleName", "value": "SHCORE.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7461 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "11564", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff58117000" }, { "name": "ModuleName", "value": "SHCORE.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7462 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\App Paths\\powershell.exe" }, { "name": "Handle", "value": "0x00000498" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\App Paths\\powershell.exe" } ], "repeated": 0, "id": 7463 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000498" }, { "name": "ValueName", "value": "DontUseDesktopChangeRouter" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\App Paths\\PowerShell.exe\\DontUseDesktopChangeRouter" } ], "repeated": 0, "id": 7464 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000498" } ], "repeated": 0, "id": 7465 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e86000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7466 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e86000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7467 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e86000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7468 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e86000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7469 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000498" }, { "name": "DesiredAccess", "value": "0x000f0007", "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_WRITE" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x00000000" }, { "name": "FileName", "value": "" } ], "repeated": 0, "id": 7470 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000498" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1f5c37b0000" }, { "name": "SectionOffset", "value": "0x6c11ecf120" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7471 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000049c" }, { "name": "DesiredAccess", "value": "0x00000040", "pretty_value": "PROCESS_DUP_HANDLE" }, { "name": "ProcessIdentifier", "value": "4484" }, { "name": "ProcessName", "value": "Error obtaining target process name" } ], "repeated": 0, "id": 7472 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000049c" } ], "repeated": 0, "id": 7473 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000049c" }, { "name": "DesiredAccess", "value": "0x00000040", "pretty_value": "PROCESS_DUP_HANDLE" }, { "name": "ProcessIdentifier", "value": "4484" }, { "name": "ProcessName", "value": "Error obtaining target process name" } ], "repeated": 0, "id": 7474 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000498" }, { "name": "TargetProcessHandle", "value": "0x0000049c" }, { "name": "TargetHandle", "value": "0x00002058" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 7475 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000049c" } ], "repeated": 0, "id": 7476 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtAddAtomEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "-%D4#!`````6@````````08$````````" }, { "name": "Atom", "value": "0x0000c07d" } ], "repeated": 0, "id": 7477 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1f5c37b0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 7478 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000498" } ], "repeated": 0, "id": 7479 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "-\\x00%\\x00D\\x004\\x00#\\x00!\\x00`\\x00`\\x00`\\x00`\\x00`\\x006\\x00@\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x000\\x008\\x00$\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00" }, { "name": "Size", "value": "64" }, { "name": "Atom", "value": "0x0000c07d" } ], "repeated": 0, "id": 7480 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000498" }, { "name": "DesiredAccess", "value": "0x00000040", "pretty_value": "PROCESS_DUP_HANDLE" }, { "name": "ProcessIdentifier", "value": "4484" }, { "name": "ProcessName", "value": "Error obtaining target process name" } ], "repeated": 0, "id": 7481 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0x00000498" }, { "name": "SourceHandle", "value": "0x00002058" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000049c" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 7482 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000498" } ], "repeated": 0, "id": 7483 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000049c" } ], "repeated": 0, "id": 7484 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtDeleteAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "Atom", "value": "0x0000c07d" } ], "repeated": 0, "id": 7485 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e86000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7486 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e86000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7487 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000049c" }, { "name": "DesiredAccess", "value": "0x000f0007", "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_WRITE" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x00000000" }, { "name": "FileName", "value": "" } ], "repeated": 0, "id": 7488 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000049c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1f5c37b0000" }, { "name": "SectionOffset", "value": "0x6c11ecf0a0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7489 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000498" }, { "name": "DesiredAccess", "value": "0x00000040", "pretty_value": "PROCESS_DUP_HANDLE" }, { "name": "ProcessIdentifier", "value": "4484" }, { "name": "ProcessName", "value": "Error obtaining target process name" } ], "repeated": 0, "id": 7490 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000498" } ], "repeated": 0, "id": 7491 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000498" }, { "name": "DesiredAccess", "value": "0x00000040", "pretty_value": "PROCESS_DUP_HANDLE" }, { "name": "ProcessIdentifier", "value": "4484" }, { "name": "ProcessName", "value": "Error obtaining target process name" } ], "repeated": 0, "id": 7492 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000049c" }, { "name": "TargetProcessHandle", "value": "0x00000498" }, { "name": "TargetHandle", "value": "0x00002058" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 7493 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000498" } ], "repeated": 0, "id": 7494 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtAddAtomEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "-%D4#!`````6@````````08$````````" }, { "name": "Atom", "value": "0x0000c07d" } ], "repeated": 0, "id": 7495 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1f5c37b0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 7496 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000049c" } ], "repeated": 0, "id": 7497 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "-\\x00%\\x00D\\x004\\x00#\\x00!\\x00`\\x00`\\x00`\\x00`\\x00`\\x006\\x00@\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x000\\x008\\x00$\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00" }, { "name": "Size", "value": "64" }, { "name": "Atom", "value": "0x0000c07d" } ], "repeated": 0, "id": 7498 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000049c" }, { "name": "DesiredAccess", "value": "0x00000040", "pretty_value": "PROCESS_DUP_HANDLE" }, { "name": "ProcessIdentifier", "value": "4484" }, { "name": "ProcessName", "value": "Error obtaining target process name" } ], "repeated": 0, "id": 7499 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0x0000049c" }, { "name": "SourceHandle", "value": "0x00002058" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000498" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 7500 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000049c" } ], "repeated": 0, "id": 7501 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000498" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1f5c37b0000" }, { "name": "SectionOffset", "value": "0x6c11ecf0f0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7502 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1f5c37b0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 7503 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000498" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1f5c37b0000" }, { "name": "SectionOffset", "value": "0x6c11ecf0f0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7504 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000498" } ], "repeated": 0, "id": 7505 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1f5c37b0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 7506 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "synchronization", "api": "NtQueryInformationAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "-\\x00%\\x00D\\x004\\x00#\\x00!\\x00`\\x00`\\x00`\\x00`\\x00`\\x006\\x00@\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x000\\x008\\x00$\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00`\\x00" }, { "name": "Size", "value": "64" }, { "name": "Atom", "value": "0x0000c07d" } ], "repeated": 0, "id": 7507 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000498" }, { "name": "DesiredAccess", "value": "0x00000040", "pretty_value": "PROCESS_DUP_HANDLE" }, { "name": "ProcessIdentifier", "value": "4484" }, { "name": "ProcessName", "value": "Error obtaining target process name" } ], "repeated": 0, "id": 7508 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0x00000498" }, { "name": "SourceHandle", "value": "0x00002058" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000049c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 7509 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000498" } ], "repeated": 0, "id": 7510 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000049c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1f5c37b0000" }, { "name": "SectionOffset", "value": "0x6c11ecf0c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7511 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1f5c37b0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 7512 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000049c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1f5c37b0000" }, { "name": "SectionOffset", "value": "0x6c11ecf0c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7513 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000049c" } ], "repeated": 0, "id": 7514 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1f5c37b0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 7515 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "windows", "api": "SendNotifyMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000100ac" }, { "name": "Message", "value": "0x00000403" } ], "repeated": 0, "id": 7516 }, { "timestamp": "2026-05-29 01:05:18,040", "thread_id": "9696", "caller": "0x7ff7e415ed20", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "user32" }, { "name": "BaseAddress", "value": "0x7fff581b0000" } ], "repeated": 0, "id": 7517 }, { "timestamp": "2026-05-29 01:05:18,368", "thread_id": "9696", "caller": "0x7ff7e415ed31", "parentcaller": "0x7ff7e415205e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000320" } ], "repeated": 0, "id": 7518 }, { "timestamp": "2026-05-29 01:05:18,368", "thread_id": "9696", "caller": "0x7ff7e415ed31", "parentcaller": "0x7ff7e415205e", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "oleaut32.dll" }, { "name": "ModuleHandle", "value": "0x7fff58860000" } ], "repeated": 0, "id": 7519 }, { "timestamp": "2026-05-29 01:05:18,368", "thread_id": "9696", "caller": "0x7ff7e415210e", "parentcaller": "0x7ff7e415468d", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\CurrentControlSet\\Control\\MiniNT" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\MiniNT" } ], "repeated": 0, "id": 7520 }, { "timestamp": "2026-05-29 01:05:18,368", "thread_id": "9696", "caller": "0x7ff7e4152747", "parentcaller": "0x7ff7e4152d21", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\PowerShell" }, { "name": "Handle", "value": "0x0000049c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PowerShell" } ], "repeated": 0, "id": 7521 }, { "timestamp": "2026-05-29 01:05:18,368", "thread_id": "9696", "caller": "0x7ff7e4152861", "parentcaller": "0x7ff7e4152d21", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000049c" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "1" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PowerShell\\1" } ], "repeated": 0, "id": 7522 }, { "timestamp": "2026-05-29 01:05:18,368", "thread_id": "9696", "caller": "0x7ff7e4152ab6", "parentcaller": "0x7ff7e4152d21", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000049c" }, { "name": "Index", "value": "1" }, { "name": "Name", "value": "3" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PowerShell\\3" } ], "repeated": 0, "id": 7523 }, { "timestamp": "2026-05-29 01:05:18,368", "thread_id": "9696", "caller": "0x7ff7e4152ab6", "parentcaller": "0x7ff7e4152d21", "category": "registry", "api": "RegEnumKeyExW", "status": false, "return": "0x00000103", "pretty_return": "NO_MORE_ITEMS", "arguments": [ { "name": "Handle", "value": "0x0000049c" }, { "name": "Index", "value": "2" }, { "name": "Name", "value": "" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PowerShell\\" } ], "repeated": 0, "id": 7524 }, { "timestamp": "2026-05-29 01:05:18,368", "thread_id": "9696", "caller": "0x7ff7e4152b54", "parentcaller": "0x7ff7e4152d21", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\PowerShell\\3\\PowerShellEngine" }, { "name": "Handle", "value": "0x00000498" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PowerShell\\3\\PowerShellEngine" } ], "repeated": 0, "id": 7525 }, { "timestamp": "2026-05-29 01:05:18,368", "thread_id": "9696", "caller": "0x7ff7e4152c23", "parentcaller": "0x7ff7e4152d21", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000049c" } ], "repeated": 0, "id": 7526 }, { "timestamp": "2026-05-29 01:05:18,368", "thread_id": "9696", "caller": "0x7ff7e4153413", "parentcaller": "0x7ff7e4152f35", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000498" }, { "name": "ValueName", "value": "PowerShellVersion" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PowerShell\\3\\PowerShellEngine\\PowerShellVersion" } ], "repeated": 0, "id": 7527 }, { "timestamp": "2026-05-29 01:05:18,368", "thread_id": "9696", "caller": "0x7ff7e4153594", "parentcaller": "0x7ff7e4152f35", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000498" }, { "name": "ValueName", "value": "PowerShellVersion" }, { "name": "Data", "value": "5.1.19041.1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PowerShell\\3\\PowerShellEngine\\PowerShellVersion" } ], "repeated": 0, "id": 7528 }, { "timestamp": "2026-05-29 01:05:18,368", "thread_id": "9696", "caller": "0x7ff7e4153413", "parentcaller": "0x7ff7e4153339", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000498" }, { "name": "ValueName", "value": "RuntimeVersion" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PowerShell\\3\\PowerShellEngine\\RuntimeVersion" } ], "repeated": 0, "id": 7529 }, { "timestamp": "2026-05-29 01:05:18,368", "thread_id": "9696", "caller": "0x7ff7e4153594", "parentcaller": "0x7ff7e4153339", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000498" }, { "name": "ValueName", "value": "RuntimeVersion" }, { "name": "Data", "value": "v4.0.30319" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PowerShell\\3\\PowerShellEngine\\RuntimeVersion" } ], "repeated": 0, "id": 7530 }, { "timestamp": "2026-05-29 01:05:18,368", "thread_id": "9696", "caller": "0x7ff7e4153413", "parentcaller": "0x7ff7e415335d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000498" }, { "name": "ValueName", "value": "ConsoleHostAssemblyName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PowerShell\\3\\PowerShellEngine\\ConsoleHostAssemblyName" } ], "repeated": 0, "id": 7531 }, { "timestamp": "2026-05-29 01:05:18,368", "thread_id": "9696", "caller": "0x7ff7e4153594", "parentcaller": "0x7ff7e415335d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000498" }, { "name": "ValueName", "value": "ConsoleHostAssemblyName" }, { "name": "Data", "value": "Microsoft.PowerShell.ConsoleHost, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=msil" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PowerShell\\3\\PowerShellEngine\\ConsoleHostAssemblyName" } ], "repeated": 0, "id": 7532 }, { "timestamp": "2026-05-29 01:05:18,368", "thread_id": "9696", "caller": "0x7ff7e4153122", "parentcaller": "0x7ff7e41521d0", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000498" } ], "repeated": 0, "id": 7533 }, { "timestamp": "2026-05-29 01:05:18,368", "thread_id": "9696", "caller": "0x7ff7e415235a", "parentcaller": "0x7ff7e415468d", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\PowerShell\\3" }, { "name": "Handle", "value": "0x00000498" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PowerShell\\3" } ], "repeated": 0, "id": 7534 }, { "timestamp": "2026-05-29 01:05:18,368", "thread_id": "9696", "caller": "0x7ff7e41523b2", "parentcaller": "0x7ff7e415468d", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000498" } ], "repeated": 0, "id": 7535 }, { "timestamp": "2026-05-29 01:05:18,368", "thread_id": "9696", "caller": "0x7ff7e4152429", "parentcaller": "0x7ff7e415468d", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\PowerShell\\3\\PowerShellEngine" }, { "name": "Handle", "value": "0x00000498" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PowerShell\\3\\PowerShellEngine" } ], "repeated": 0, "id": 7536 }, { "timestamp": "2026-05-29 01:05:18,368", "thread_id": "9696", "caller": "0x7ff7e41524b3", "parentcaller": "0x7ff7e415468d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000498" }, { "name": "ValueName", "value": "NetFrameworkV4IsInstalled" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PowerShell\\3\\PowerShellEngine\\NetFrameworkV4IsInstalled" } ], "repeated": 0, "id": 7537 }, { "timestamp": "2026-05-29 01:05:18,368", "thread_id": "9696", "caller": "0x7ff7e415258f", "parentcaller": "0x7ff7e415468d", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000498" } ], "repeated": 0, "id": 7538 }, { "timestamp": "2026-05-29 01:05:18,383", "thread_id": "9696", "caller": "0x7ff7e4151884", "parentcaller": "0x7ff7e41525fb", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff3f9e2000" }, { "name": "ModuleName", "value": "mscoree.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7539 }, { "timestamp": "2026-05-29 01:05:18,383", "thread_id": "9696", "caller": "0x7ff7e4151884", "parentcaller": "0x7ff7e41525fb", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ADVAPI32.dll" }, { "name": "BaseAddress", "value": "0x7fff599c0000" } ], "repeated": 0, "id": 7540 }, { "timestamp": "2026-05-29 01:05:18,383", "thread_id": "9696", "caller": "0x7ff7e4151884", "parentcaller": "0x7ff7e41525fb", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff599c0000", "arguments": [ { "name": "lpLibFileName", "value": "ADVAPI32.dll" }, { "name": "dwFlags", "value": "0x00000000" } ], "repeated": 0, "id": 7541 }, { "timestamp": "2026-05-29 01:05:18,383", "thread_id": "9696", "caller": "0x7ff7e4151884", "parentcaller": "0x7ff7e41525fb", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x7fff599c0000" }, { "name": "FunctionName", "value": "RegOpenKeyExW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff599d6180" } ], "repeated": 0, "id": 7542 }, { "timestamp": "2026-05-29 01:05:18,383", "thread_id": "9696", "caller": "0x7ff7e4151884", "parentcaller": "0x7ff7e41525fb", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff3f9e2000" }, { "name": "ModuleName", "value": "mscoree.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7543 }, { "timestamp": "2026-05-29 01:05:18,383", "thread_id": "9696", "caller": "0x7ff7e4151884", "parentcaller": "0x7ff7e41525fb", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\.NETFramework\\Policy\\" }, { "name": "Handle", "value": "0x00000494" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\.NETFramework\\Policy\\" } ], "repeated": 0, "id": 7544 }, { "timestamp": "2026-05-29 01:05:18,383", "thread_id": "9696", "caller": "0x7ff7e4151884", "parentcaller": "0x7ff7e41525fb", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff3f9e2000" }, { "name": "ModuleName", "value": "mscoree.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7545 }, { "timestamp": "2026-05-29 01:05:18,383", "thread_id": "9696", "caller": "0x7ff7e4151884", "parentcaller": "0x7ff7e41525fb", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x7fff599c0000" }, { "name": "FunctionName", "value": "RegQueryInfoKeyW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff599d63a0" } ], "repeated": 0, "id": 7546 }, { "timestamp": "2026-05-29 01:05:18,383", "thread_id": "9696", "caller": "0x7ff7e4151884", "parentcaller": "0x7ff7e41525fb", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff3f9e2000" }, { "name": "ModuleName", "value": "mscoree.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7547 }, { "timestamp": "2026-05-29 01:05:18,383", "thread_id": "9696", "caller": "0x7ff7e4151884", "parentcaller": "0x7ff7e41525fb", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000494" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "5" }, { "name": "MaxSubKeyLength", "value": "9" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 7548 }, { "timestamp": "2026-05-29 01:05:18,383", "thread_id": "9696", "caller": "0x7ff7e4151884", "parentcaller": "0x7ff7e41525fb", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff3f9e2000" }, { "name": "ModuleName", "value": "mscoree.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7549 }, { "timestamp": "2026-05-29 01:05:18,383", "thread_id": "9696", "caller": "0x7ff7e4151884", "parentcaller": "0x7ff7e41525fb", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x7fff599c0000" }, { "name": "FunctionName", "value": "RegEnumKeyExW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff599d5b90" } ], "repeated": 0, "id": 7550 }, { "timestamp": "2026-05-29 01:05:18,383", "thread_id": "9696", "caller": "0x7ff7e4151884", "parentcaller": "0x7ff7e41525fb", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff3f9e2000" }, { "name": "ModuleName", "value": "mscoree.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7551 }, { "timestamp": "2026-05-29 01:05:18,383", "thread_id": "9696", "caller": "0x7ff7e4151884", "parentcaller": "0x7ff7e41525fb", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "Index", "value": "4" }, { "name": "Name", "value": "v4.0" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\.NETFramework\\policy\\v4.0" } ], "repeated": 0, "id": 7552 }, { "timestamp": "2026-05-29 01:05:18,383", "thread_id": "9696", "caller": "0x7ff7e4151884", "parentcaller": "0x7ff7e41525fb", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "Index", "value": "3" }, { "name": "Name", "value": "Upgrades" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\.NETFramework\\policy\\Upgrades" } ], "repeated": 0, "id": 7553 }, { "timestamp": "2026-05-29 01:05:18,383", "thread_id": "9696", "caller": "0x7ff7e4151884", "parentcaller": "0x7ff7e41525fb", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "Index", "value": "2" }, { "name": "Name", "value": "standards" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\.NETFramework\\policy\\standards" } ], "repeated": 0, "id": 7554 }, { "timestamp": "2026-05-29 01:05:18,383", "thread_id": "9696", "caller": "0x7ff7e4151884", "parentcaller": "0x7ff7e41525fb", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "Index", "value": "1" }, { "name": "Name", "value": "Servicing" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\.NETFramework\\policy\\Servicing" } ], "repeated": 0, "id": 7555 }, { "timestamp": "2026-05-29 01:05:18,383", "thread_id": "9696", "caller": "0x7ff7e4151884", "parentcaller": "0x7ff7e41525fb", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "AppPatch" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\.NETFramework\\policy\\AppPatch" } ], "repeated": 0, "id": 7556 }, { "timestamp": "2026-05-29 01:05:18,383", "thread_id": "9696", "caller": "0x7ff7e4151884", "parentcaller": "0x7ff7e41525fb", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000494" }, { "name": "SubKey", "value": "v4.0" }, { "name": "Handle", "value": "0x00000498" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\.NETFramework\\policy\\v4.0" } ], "repeated": 0, "id": 7557 }, { "timestamp": "2026-05-29 01:05:18,383", "thread_id": "9696", "caller": "0x7ff7e4151884", "parentcaller": "0x7ff7e41525fb", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000498" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "1" }, { "name": "MaxValueNameLength", "value": "5" }, { "name": "MaxValueLength", "value": "24" } ], "repeated": 0, "id": 7558 }, { "timestamp": "2026-05-29 01:05:18,383", "thread_id": "9696", "caller": "0x7ff7e4151884", "parentcaller": "0x7ff7e41525fb", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff3f9e2000" }, { "name": "ModuleName", "value": "mscoree.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7559 }, { "timestamp": "2026-05-29 01:05:18,383", "thread_id": "9696", "caller": "0x7ff7e4151884", "parentcaller": "0x7ff7e41525fb", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x7fff599c0000" }, { "name": "FunctionName", "value": "RegEnumValueW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff599d68e0" } ], "repeated": 0, "id": 7560 }, { "timestamp": "2026-05-29 01:05:18,383", "thread_id": "9696", "caller": "0x7ff7e4151884", "parentcaller": "0x7ff7e41525fb", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff3f9e2000" }, { "name": "ModuleName", "value": "mscoree.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7561 }, { "timestamp": "2026-05-29 01:05:18,383", "thread_id": "9696", "caller": "0x7ff7e4151884", "parentcaller": "0x7ff7e41525fb", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000498" }, { "name": "Index", "value": "0" }, { "name": "ValueName", "value": "30319" }, { "name": "Data", "value": "30319-30319" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\.NETFramework\\policy\\v4.0\\30319" } ], "repeated": 0, "id": 7562 }, { "timestamp": "2026-05-29 01:05:18,383", "thread_id": "9696", "caller": "0x7ff7e4151884", "parentcaller": "0x7ff7e41525fb", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff3f9e2000" }, { "name": "ModuleName", "value": "mscoree.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7563 }, { "timestamp": "2026-05-29 01:05:18,383", "thread_id": "9696", "caller": "0x7ff7e4151884", "parentcaller": "0x7ff7e41525fb", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x7fff599c0000" }, { "name": "FunctionName", "value": "RegCloseKey" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff599d6930" } ], "repeated": 0, "id": 7564 }, { "timestamp": "2026-05-29 01:05:18,383", "thread_id": "9696", "caller": "0x7ff7e4151884", "parentcaller": "0x7ff7e41525fb", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff3f9e2000" }, { "name": "ModuleName", "value": "mscoree.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7565 }, { "timestamp": "2026-05-29 01:05:18,383", "thread_id": "9696", "caller": "0x7ff7e4151884", "parentcaller": "0x7ff7e41525fb", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000498" } ], "repeated": 0, "id": 7566 }, { "timestamp": "2026-05-29 01:05:18,383", "thread_id": "9696", "caller": "0x7ff7e4151884", "parentcaller": "0x7ff7e41525fb", "category": "filesystem", "api": "NtQueryAttributesFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\mscoree.dll.local" } ], "repeated": 0, "id": 7567 }, { "timestamp": "2026-05-29 01:05:18,383", "thread_id": "9696", "caller": "0x7ff7e4151884", "parentcaller": "0x7ff7e41525fb", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\.NETFramework" }, { "name": "Handle", "value": "0x000004ac" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\.NETFramework" } ], "repeated": 0, "id": 7568 }, { "timestamp": "2026-05-29 01:05:18,383", "thread_id": "9696", "caller": "0x7ff7e4151884", "parentcaller": "0x7ff7e41525fb", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff3f9e2000" }, { "name": "ModuleName", "value": "mscoree.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7569 }, { "timestamp": "2026-05-29 01:05:18,383", "thread_id": "9696", "caller": "0x7ff7e4151884", "parentcaller": "0x7ff7e41525fb", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x7fff599c0000" }, { "name": "FunctionName", "value": "RegQueryValueExW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff599d6160" } ], "repeated": 0, "id": 7570 }, { "timestamp": "2026-05-29 01:05:18,383", "thread_id": "9696", "caller": "0x7ff7e4151884", "parentcaller": "0x7ff7e41525fb", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff3f9e2000" }, { "name": "ModuleName", "value": "mscoree.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7571 }, { "timestamp": "2026-05-29 01:05:18,383", "thread_id": "9696", "caller": "0x7ff7e4151884", "parentcaller": "0x7ff7e41525fb", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ac" }, { "name": "ValueName", "value": "InstallRoot" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\.NETFramework\\InstallRoot" } ], "repeated": 0, "id": 7572 }, { "timestamp": "2026-05-29 01:05:18,383", "thread_id": "9696", "caller": "0x7ff7e4151884", "parentcaller": "0x7ff7e41525fb", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ac" }, { "name": "ValueName", "value": "InstallRoot" }, { "name": "Data", "value": "C:\\Windows\\Microsoft.NET\\Framework64\\" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\.NETFramework\\InstallRoot" } ], "repeated": 0, "id": 7573 }, { "timestamp": "2026-05-29 01:05:18,383", "thread_id": "9696", "caller": "0x7ff7e4151884", "parentcaller": "0x7ff7e41525fb", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ac" } ], "repeated": 0, "id": 7574 }, { "timestamp": "2026-05-29 01:05:18,383", "thread_id": "9696", "caller": "0x7ff7e4151884", "parentcaller": "0x7ff7e41525fb", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x1f5c0427f10", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" }, { "name": "FirstCreateTimeLow", "value": "0x47aa0a60" }, { "name": "FirstCreateTimeHigh", "value": "0x01da265b" } ], "repeated": 0, "id": 7575 }, { "timestamp": "2026-05-29 01:05:18,383", "thread_id": "9696", "caller": "0x7ff7e4151884", "parentcaller": "0x7ff7e41525fb", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ac" } ], "repeated": 0, "id": 7576 }, { "timestamp": "2026-05-29 01:05:18,383", "thread_id": "9696", "caller": "0x7ff7e4151884", "parentcaller": "0x7ff7e41525fb", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 7577 }, { "timestamp": "2026-05-29 01:05:18,383", "thread_id": "9696", "caller": "0x7ff7e4151884", "parentcaller": "0x7ff7e41525fb", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\.NETFramework" }, { "name": "Handle", "value": "0x00000494" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\.NETFramework" } ], "repeated": 0, "id": 7578 }, { "timestamp": "2026-05-29 01:05:18,383", "thread_id": "9696", "caller": "0x7ff7e4151884", "parentcaller": "0x7ff7e41525fb", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "ValueName", "value": "InstallRoot" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\.NETFramework\\InstallRoot" } ], "repeated": 0, "id": 7579 }, { "timestamp": "2026-05-29 01:05:18,383", "thread_id": "9696", "caller": "0x7ff7e4151884", "parentcaller": "0x7ff7e41525fb", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "ValueName", "value": "InstallRoot" }, { "name": "Data", "value": "C:\\Windows\\Microsoft.NET\\Framework64\\" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\.NETFramework\\InstallRoot" } ], "repeated": 0, "id": 7580 }, { "timestamp": "2026-05-29 01:05:18,383", "thread_id": "9696", "caller": "0x7ff7e4151884", "parentcaller": "0x7ff7e41525fb", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 7581 }, { "timestamp": "2026-05-29 01:05:18,383", "thread_id": "9696", "caller": "0x7ff7e4151884", "parentcaller": "0x7ff7e41525fb", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x1f5c04284b0", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" }, { "name": "FirstCreateTimeLow", "value": "0x47aa0a60" }, { "name": "FirstCreateTimeHigh", "value": "0x01da265b" } ], "repeated": 0, "id": 7582 }, { "timestamp": "2026-05-29 01:05:18,383", "thread_id": "9696", "caller": "0x7ff7e4151884", "parentcaller": "0x7ff7e41525fb", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 7583 }, { "timestamp": "2026-05-29 01:05:18,383", "thread_id": "9696", "caller": "0x7ff7e4151884", "parentcaller": "0x7ff7e41525fb", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\.NETFramework" }, { "name": "Handle", "value": "0x00000494" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\.NETFramework" } ], "repeated": 0, "id": 7584 }, { "timestamp": "2026-05-29 01:05:18,383", "thread_id": "9696", "caller": "0x7ff7e4151884", "parentcaller": "0x7ff7e41525fb", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "ValueName", "value": "InstallRoot" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\.NETFramework\\InstallRoot" } ], "repeated": 0, "id": 7585 }, { "timestamp": "2026-05-29 01:05:18,383", "thread_id": "9696", "caller": "0x7ff7e4151884", "parentcaller": "0x7ff7e41525fb", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "ValueName", "value": "InstallRoot" }, { "name": "Data", "value": "C:\\Windows\\Microsoft.NET\\Framework64\\" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\.NETFramework\\InstallRoot" } ], "repeated": 0, "id": 7586 }, { "timestamp": "2026-05-29 01:05:18,383", "thread_id": "9696", "caller": "0x7ff7e4151884", "parentcaller": "0x7ff7e41525fb", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 7587 }, { "timestamp": "2026-05-29 01:05:18,383", "thread_id": "9696", "caller": "0x7ff7e4151884", "parentcaller": "0x7ff7e41525fb", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei" }, { "name": "DllBase", "value": "0x7fff1c3e0000" } ], "repeated": 0, "id": 7588 }, { "timestamp": "2026-05-29 01:05:18,383", "thread_id": "9696", "caller": "0x7ff7e4151884", "parentcaller": "0x7ff7e41525fb", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-core-synch-l1-2-0" }, { "name": "BaseAddress", "value": "0x7fff577a0000" } ], "repeated": 0, "id": 7589 }, { "timestamp": "2026-05-29 01:05:18,383", "thread_id": "9696", "caller": "0x7ff7e4151884", "parentcaller": "0x7ff7e41525fb", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-core-fibers-l1-1-1" }, { "name": "BaseAddress", "value": "0x7fff577a0000" } ], "repeated": 0, "id": 7590 }, { "timestamp": "2026-05-29 01:05:18,383", "thread_id": "9696", "caller": "0x7ff7e4151884", "parentcaller": "0x7ff7e41525fb", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-core-synch-l1-2-0" }, { "name": "BaseAddress", "value": "0x7fff577a0000" } ], "repeated": 0, "id": 7591 }, { "timestamp": "2026-05-29 01:05:18,383", "thread_id": "9696", "caller": "0x7ff7e4151884", "parentcaller": "0x7ff7e41525fb", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-core-fibers-l1-1-1" }, { "name": "BaseAddress", "value": "0x7fff577a0000" } ], "repeated": 0, "id": 7592 }, { "timestamp": "2026-05-29 01:05:18,383", "thread_id": "9696", "caller": "0x7ff7e4151884", "parentcaller": "0x7ff7e41525fb", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-core-localization-l1-2-1" }, { "name": "BaseAddress", "value": "0x7fff577a0000" } ], "repeated": 0, "id": 7593 }, { "timestamp": "2026-05-29 01:05:18,383", "thread_id": "9696", "caller": "0x7ff7e4151884", "parentcaller": "0x7ff7e41525fb", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ADVAPI32.dll" }, { "name": "BaseAddress", "value": "0x7fff599c0000" } ], "repeated": 0, "id": 7594 }, { "timestamp": "2026-05-29 01:05:18,383", "thread_id": "9696", "caller": "0x7ff7e4151884", "parentcaller": "0x7ff7e41525fb", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" }, { "name": "BaseAddress", "value": "0x7fff1c3e0000" } ], "repeated": 0, "id": 7595 }, { "timestamp": "2026-05-29 01:05:18,383", "thread_id": "9696", "caller": "0x7ff7e4151884", "parentcaller": "0x7ff7e41525fb", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff1c3e0000", "arguments": [ { "name": "lpLibFileName", "value": "C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" }, { "name": "dwFlags", "value": "0x00000008" } ], "repeated": 0, "id": 7596 }, { "timestamp": "2026-05-29 01:05:18,383", "thread_id": "9696", "caller": "0x7ff7e4151884", "parentcaller": "0x7ff7e41525fb", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "mscoreei.dll" }, { "name": "ModuleHandle", "value": "0x7fff1c3e0000" }, { "name": "FunctionName", "value": "RegisterShimImplCallback" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff1c3e1f20" } ], "repeated": 0, "id": 7597 }, { "timestamp": "2026-05-29 01:05:18,383", "thread_id": "9696", "caller": "0x7ff7e4151884", "parentcaller": "0x7ff7e41525fb", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": false, "return": "0xffffffffc0000139", "pretty_return": "ENTRYPOINT_NOT_FOUND", "arguments": [ { "name": "ModuleName", "value": "mscoreei.dll" }, { "name": "ModuleHandle", "value": "0x7fff1c3e0000" }, { "name": "FunctionName", "value": "RegisterShimImplCleanupCallback" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x00000000" } ], "repeated": 0, "id": 7598 }, { "timestamp": "2026-05-29 01:05:18,383", "thread_id": "9696", "caller": "0x7ff7e4151884", "parentcaller": "0x7ff7e41525fb", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": false, "return": "0xffffffffc0000139", "pretty_return": "ENTRYPOINT_NOT_FOUND", "arguments": [ { "name": "ModuleName", "value": "mscoreei.dll" }, { "name": "ModuleHandle", "value": "0x7fff1c3e0000" }, { "name": "FunctionName", "value": "SetShellShimInstance" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x00000000" } ], "repeated": 0, "id": 7599 }, { "timestamp": "2026-05-29 01:05:18,383", "thread_id": "9696", "caller": "0x7ff7e4151884", "parentcaller": "0x7ff7e41525fb", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "mscoreei.dll" }, { "name": "ModuleHandle", "value": "0x7fff1c3e0000" }, { "name": "FunctionName", "value": "OnShimDllMainCalled" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff1c3e11b0" } ], "repeated": 0, "id": 7600 }, { "timestamp": "2026-05-29 01:05:18,383", "thread_id": "9696", "caller": "0x7ff7e4151884", "parentcaller": "0x7ff7e41525fb", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": false, "return": "0xffffffffc0000139", "pretty_return": "ENTRYPOINT_NOT_FOUND", "arguments": [ { "name": "ModuleName", "value": "mscoreei.dll" }, { "name": "ModuleHandle", "value": "0x7fff1c3e0000" }, { "name": "FunctionName", "value": "CorBindToRuntimeEx_RetAddr" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x00000000" } ], "repeated": 0, "id": 7601 }, { "timestamp": "2026-05-29 01:05:18,383", "thread_id": "9696", "caller": "0x7ff7e4151884", "parentcaller": "0x7ff7e41525fb", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "mscoreei.dll" }, { "name": "ModuleHandle", "value": "0x7fff1c3e0000" }, { "name": "FunctionName", "value": "CorBindToRuntimeEx" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff1c4062a0" } ], "repeated": 0, "id": 7602 }, { "timestamp": "2026-05-29 01:05:18,383", "thread_id": "9696", "caller": "0x7ff7e4151884", "parentcaller": "0x7ff7e41525fb", "category": "filesystem", "api": "NtQueryAttributesFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\mscoree.dll.local" } ], "repeated": 0, "id": 7603 }, { "timestamp": "2026-05-29 01:05:18,383", "thread_id": "9696", "caller": "0x7ff7e4151884", "parentcaller": "0x7ff7e41525fb", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\.NETFramework" }, { "name": "Handle", "value": "0x000004ac" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\.NETFramework" } ], "repeated": 0, "id": 7604 }, { "timestamp": "2026-05-29 01:05:18,383", "thread_id": "9696", "caller": "0x7ff7e4151884", "parentcaller": "0x7ff7e41525fb", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ac" }, { "name": "ValueName", "value": "InstallRoot" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\.NETFramework\\InstallRoot" } ], "repeated": 0, "id": 7605 }, { "timestamp": "2026-05-29 01:05:18,383", "thread_id": "9696", "caller": "0x7ff7e4151884", "parentcaller": "0x7ff7e41525fb", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ac" }, { "name": "ValueName", "value": "InstallRoot" }, { "name": "Data", "value": "C:\\Windows\\Microsoft.NET\\Framework64\\" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\.NETFramework\\InstallRoot" } ], "repeated": 0, "id": 7606 }, { "timestamp": "2026-05-29 01:05:18,383", "thread_id": "9696", "caller": "0x7ff7e4151884", "parentcaller": "0x7ff7e41525fb", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ac" } ], "repeated": 0, "id": 7607 }, { "timestamp": "2026-05-29 01:05:18,383", "thread_id": "9696", "caller": "0x7ff7e4151884", "parentcaller": "0x7ff7e41525fb", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\.NETFramework" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\.NETFramework" } ], "repeated": 0, "id": 7608 }, { "timestamp": "2026-05-29 01:05:18,383", "thread_id": "9696", "caller": "0x7ff7e4151884", "parentcaller": "0x7ff7e41525fb", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\.NETFramework" }, { "name": "Handle", "value": "0x0000049c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\.NETFramework" } ], "repeated": 0, "id": 7609 }, { "timestamp": "2026-05-29 01:05:18,399", "thread_id": "9696", "caller": "0x7ff7e4151884", "parentcaller": "0x7ff7e41525fb", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x1f5c0427d30", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\Microsoft.NET\\Framework64\\*" }, { "name": "FirstCreateTimeLow", "value": "0xc881410f" }, { "name": "FirstCreateTimeHigh", "value": "0x01d5acde" } ], "repeated": 0, "id": 7610 }, { "timestamp": "2026-05-29 01:05:18,399", "thread_id": "9696", "caller": "0x7ff7e4151884", "parentcaller": "0x7ff7e41525fb", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000320" }, { "name": "DesiredAccess", "value": "0x00120080", "pretty_value": "FILE_READ_ATTRIBUTES|READ_CONTROL|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7611 }, { "timestamp": "2026-05-29 01:05:18,399", "thread_id": "9696", "caller": "0x7ff7e4151884", "parentcaller": "0x7ff7e41525fb", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000320" } ], "repeated": 0, "id": 7612 }, { "timestamp": "2026-05-29 01:05:18,399", "thread_id": "9696", "caller": "0x7ff7e4151884", "parentcaller": "0x7ff7e41525fb", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ac" } ], "repeated": 0, "id": 7613 }, { "timestamp": "2026-05-29 01:05:18,399", "thread_id": "9696", "caller": "0x7ff7e4151884", "parentcaller": "0x7ff7e41525fb", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff1c487000" }, { "name": "ModuleName", "value": "mscoreei.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7614 }, { "timestamp": "2026-05-29 01:05:18,399", "thread_id": "9696", "caller": "0x7ff7e4151884", "parentcaller": "0x7ff7e41525fb", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "SHLWAPI.dll" }, { "name": "BaseAddress", "value": "0x7fff58ac0000" } ], "repeated": 0, "id": 7615 }, { "timestamp": "2026-05-29 01:05:18,399", "thread_id": "9696", "caller": "0x7ff7e4151884", "parentcaller": "0x7ff7e41525fb", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff58ac0000", "arguments": [ { "name": "lpLibFileName", "value": "SHLWAPI.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 7616 }, { "timestamp": "2026-05-29 01:05:18,399", "thread_id": "9696", "caller": "0x7ff7e4151884", "parentcaller": "0x7ff7e41525fb", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "SHLWAPI.dll" }, { "name": "ModuleHandle", "value": "0x7fff58ac0000" }, { "name": "FunctionName", "value": "UrlIsW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff58ac6c30" } ], "repeated": 0, "id": 7617 }, { "timestamp": "2026-05-29 01:05:18,399", "thread_id": "9696", "caller": "0x7ff7e4151884", "parentcaller": "0x7ff7e41525fb", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff1c487000" }, { "name": "ModuleName", "value": "mscoreei.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7618 }, { "timestamp": "2026-05-29 01:05:18,399", "thread_id": "9696", "caller": "0x7ff7e4151884", "parentcaller": "0x7ff7e41525fb", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000004ac" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe.config" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7619 }, { "timestamp": "2026-05-29 01:05:18,399", "thread_id": "9696", "caller": "0x7ff7e4151884", "parentcaller": "0x7ff7e41525fb", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1f5c0447000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7620 }, { "timestamp": "2026-05-29 01:05:18,399", "thread_id": "9696", "caller": "0x7ff7e4151884", "parentcaller": "0x7ff7e41525fb", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000004ac" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe.config" }, { "name": "Buffer", "value": "\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n